One-time setup
Set up secure staff login
Cloudflare Access handles your real login screen and verifies staff identities before the workshop portal is served. A password written into HTML would be insecure.
Not protected by uploading the ZIP alone
Do not enter live customer details until Cloudflare Access is configured and tested for both workshop.trailsurge.co.uk and your Pages deployment addresses.
1. Protect your workshop domain
- Open Cloudflare Dashboard → Zero Trust → Access controls → Applications.
- Select Create new application → Self-hosted and private.
- Name it TrailSurge Workshop and add public hostname
workshop.trailsurge.co.uk. - Create an Allow policy with Emails set to the exact permitted staff email addresses (Finlay, Harley, and Dave only if required). Do not use Everyone or all valid emails.
- Use a suitable login method such as One-time PIN. If not listed, add it under Zero Trust identity providers first.
- Save and test the site in a private/incognito browser. An unauthorised email address must be refused.
If the custom domain does not appear in Access because your DNS uses IONOS rather than a Cloudflare-managed zone, you may need to add the zone to Cloudflare or adjust the configuration; see the official documentation.
2. Protect the Pages URLs too
Cloudflare Pages' project and preview URLs can remain public if you protect only your custom domain. In Workers & Pages → your project → Settings, review Access policy, then follow Cloudflare's instructions for protecting trailsurge-workshop.pages.dev and preview deployments. Test each address while signed out.
See the detailed SETUP-GUIDE.md included in the ZIP and the official Cloudflare Pages Access instructions.
3. Keep existing customer records
The original forms are preserved in this ZIP, including signatures, job management, PDFs and email confirmation. Their data is still stored in the browser on each device: the new login does not turn it into a shared database. If you had saved jobs in an offline HTML file, use its export/backup tools to move those records into the new portal.