A Locked Front Door
The front door finally got a real lock.
My plan was n8n’s own two-factor sign-in, but that turned out to need a paid plan. So Cloudflare Access (the free Zero Trust tier) now stands in front of both n8n and the home dashboard. You sign in with a one-time code emailed to an approved address, and the session lasts 24 hours. n8n’s webhook paths get a bypass rule, so my automations still get through. My home DNS sends these names through Cloudflare even on the LAN, so the lock works at home and away. At home that means two logins for n8n, and I’m fine with that. Tested it from outside the LAN too.
Behind that, version 0.4.0 of the dashboard has its own edit login: username, password and an authenticator app code. The edit buttons stay hidden until you sign in, and without the login settings the dashboard stays read-only. A small script on my Mac generated those settings. It shows a QR code to scan, checks one code before saving, and only writes a SOPS-encrypted Kubernetes Secret. Flux decrypts it in the cluster, so nothing secret sits in git in plain text. First try with the authenticator code worked perfectly, and up popped the edit buttons.
Last, Grafana. Self sign-up was already off, but only by default, and defaults change. Now the config pins it with allow_sign_up = false, through a PR in the GitOps repo and rolled out by Flux. The signup API now answers “User signup is disabled”. Nobody wanders in and makes an account, and a chart update can’t quietly open that door again.
Quite the feeling of accomplishment. Another step closer to a cluster I’d trust in production.