feat(access): authorize OpenClaw endpoint

[xnoto]

Summary

Creates a dedicated, fail-closed Cloudflare Access application for openclaw.makeitwork.cloud. Interactive access is restricted to the existing GitHub identity provider and makeitworkcloud-admins group, with 24-hour application and policy sessions.

No DNS record, TunnelBinding, tunnel route, service token, OpenClaw workload, provider version, or secret is created here. kustomize-cluster will exclusively own the later route and workload; it must not be merged until this Access application has been applied.

Fixes # N/A — owner-directed OpenClaw deployment

Type of change

• Infrastructure (OpenTofu root or module)

Validation

• Required pull-request checks pass — OpenTofu test and plan passed.
• Generated or centrally distributed files were regenerated by their owning automation, not hand-edited — CI committed the terraform-docs README update.

The plan is exactly 1 to add, 0 to change, 0 to destroy: the dedicated Access application. No apply ran.

Final review evidence:

• Independent adversarial code review: advance; no Critical/High/Medium/Low findings.
• Infrastructure security review: advance; no Critical/High/Medium/Low findings.
• Validation-coverage review identified CI and generated-documentation prerequisites; both are now satisfied by the final CI run.
• Release-readiness review confirmed the producer/consumer boundary and required route ordering.

Impact and rollout

Producer: tfroot-cloudflare is the canonical Cloudflare Access owner. Consumer: a later interactive browser-facing OpenClaw Control UI endpoint.

Ordered delivery:

1. This PR has completed its CI validation and planned one fail-closed Access application.
2. After review and explicit merge approval, merge to main; the environment-gated production apply must be explicitly approved.
3. Confirm the Access application exists and remains fail-closed.
4. In a separate kustomize-cluster PR, add the OpenClaw workload and its TunnelBinding/DNS route only after the Access application is reconciled.
5. Verify GitHub-admin login and the retained OpenClaw gateway-token requirement.

Rollback: remove the future TunnelBinding route first; then revert this application through a new reviewed PR and environment-gated apply.

Safety and secrets

• Contains no plaintext secrets, decrypted SOPS values, state files, kubeconfigs, tokens, or private endpoints
• No local OpenTofu init/plan/apply/destroy/import/state operations were run or claimed — plans come from pull-request checks
• Breaking or irreversible effects are described above with rollback notes

AI-assisted change: implementation and review coordination were performed by an AI agent.

[github-actions]

OpenTofu Test

OpenTofu test passed.

View the workflow run.

View run output

Terraform validate.......................................................Passed
Terraform validate with tflint...........................................Passed
Checkov..................................................................Passed
Terraform fmt............................................................Passed
Terraform docs...........................................................Passed
Detect hardcoded secrets.................................................Passed
check for case conflicts.................................................Passed
check for merge conflicts................................................Passed
check for broken symlinks............................(no files to check)Skipped
check vcs permalinks.....................................................Passed
detect destroyed symlinks................................................Passed
detect private key.......................................................Passed
fix end of files.........................................................Passed
mixed line ending........................................................Passed
trim trailing whitespace.................................................Passed
don't commit to branch..................................................Skipped
check for added large files..............................................Passed

[github-actions]

OpenTofu Plan

OpenTofu plan passed.

View the workflow run.

View run output

OpenTofu will perform the following actions:

  # cloudflare_zero_trust_access_application.openclaw will be created
  + resource "cloudflare_zero_trust_access_application" "openclaw" {
      + account_id                 = (sensitive value)
      + allowed_idps               = [
          + "e584ea47-1251-4939-95f4-4daf4a58cd31",
        ]
      + app_launcher_visible       = true
      + aud                        = (known after apply)
      + destinations               = (known after apply)
      + domain                     = "openclaw.makeitwork.cloud"
      + http_only_cookie_attribute = true
      + id                         = (known after apply)
      + name                       = "OpenClaw"
      + policies                   = [
          + {
              + decision   = "allow"
              + include    = [
                  + {
                      + group = {
                          + id = "e0d9e873-31d7-4536-9234-3dad8a99d84d"
                        }
                    },
                ]
              + name       = "makeitworkcloud-admins"
              + precedence = 1
            },
        ]
      + self_hosted_domains        = (known after apply)
      + session_duration           = "24h"
      + type                       = "self_hosted"
    }

Plan: 1 to add, 0 to change, 0 to destroy.
OpenTofu will perform the following actions:

  # cloudflare_zero_trust_access_application.openclaw will be created
  + resource "cloudflare_zero_trust_access_application" "openclaw" {
      + account_id                 = (sensitive value)
      + allowed_idps               = [
          + "e584ea47-1251-4939-95f4-4daf4a58cd31",
        ]
      + app_launcher_visible       = true
      + aud                        = (known after apply)
      + destinations               = (known after apply)
      + domain                     = "openclaw.makeitwork.cloud"
      + http_only_cookie_attribute = true
      + id                         = (known after apply)
      + name                       = "OpenClaw"
      + policies                   = [
          + {
              + decision   = "allow"
              + include    = [
                  + {
                      + group = {
                          + id = "e0d9e873-31d7-4536-9234-3dad8a99d84d"
                        }
                    },
                ]
              + name       = "makeitworkcloud-admins"
              + precedence = 1
            },
        ]
      + self_hosted_domains        = (known after apply)
      + session_duration           = "24h"
      + type                       = "self_hosted"
    }

Plan: 1 to add, 0 to change, 0 to destroy.