ADR 0011: Every CMS behind Cloudflare Access

Status

Accepted, 2026-10-29.

Context

The point of Launch is to show a CMS that is not reachable from the public internet, while its Front-end stays fast and public.

Decision

• Each CMS’s admin and API sit behind a Cloudflare Access application. Only the Front-end is public.
• Front-ends and the MCP Worker that reach a locked CMS over the network read with an Access Service token. A Service token never maps to a CMS user, so it can only read.
• The Payload Front-end runs in the same Worker as the CMS and reads through the Local API, so it needs no Service token; Access locks only /admin and /api there.
• packages/access (@patronage/access) holds JWT verification, the Access-aware fetch, the Payload auth strategy and the provisioning script.
• wordpress-shared/patronage-access is the WordPress mu-plugin that verifies Access JWTs, configured with PATRONAGE_ACCESS_* constants.

Consequences

• New code that talks to a CMS reuses these packages instead of porting its own checks.
• See spike 05.