Cloudflare Pages — Setup Guide

TL;DR · the six phases

Sign up for Cloudflare (free, ~2 min)
Install the wrangler CLI
Authenticate wrangler with your account (browser-based)
Deploy the public bundle (./publish.sh deploy)
Enable Zero Trust Access in the Cloudflare dashboard
Test the deployed URL in an incognito window

Total time start to finish: ~20 minutes.

PREREQUISITES

macOS Terminal access
Node.js installed — verify with node --version. Install with brew install node if missing.
The public bundle is already built — lives at command centre/cowork-dashboard-public/ (184 files, 62 MB)
A Google account for the Access login (using b.kaisharis@gmail.com)

Phase 1

Sign up for Cloudflare

~2 min

Open https://dash.cloudflare.com/sign-up
Enter email + create a password (use a password manager)
Verify your email — Cloudflare sends a link, click it
You'll land on the Cloudflare dashboard with an empty account
Skip the "Add a website" prompt — you don't need a domain for Pages
Skip the upsell to Pro / Business — free tier covers everything here

Done when: you can see the Cloudflare dashboard at dash.cloudflare.com with your account name top-right.

Phase 2

Install the wrangler CLI

~1 min

wrangler is Cloudflare's deployment tool. One global npm install.

npm install -g wrangler

Verify:

wrangler --version

Should print something like wrangler 3.x.x or higher.

Common gotcha: if you see EACCES: permission denied, either prefix with sudo or set up an npm prefix in your home directory to avoid sudo. See npm's guide.

Phase 3

Authenticate wrangler

~1 min

wrangler login

This opens your default browser → Cloudflare OAuth page → click Allow → return to Terminal.

Verify:

wrangler whoami

Should print your Cloudflare email + account ID.

Phase 4

Deploy the bundle

~2 min

From the command centre folder:

cd ~/Documents/Claude/Projects/command\ centre
./publish.sh deploy

What this does:

Rebuilds the public bundle (transforms paths, strips sensitive AI Doctor links)
Uploads everything to Cloudflare Pages as a project called command-centre
First time only: prompts you to confirm project name + production branch — press Enter through the defaults

Wait for output like:

✨ Deployment complete! Take a peek over at
   https://<some-hash>.command-centre.pages.dev

Two URLs are now live:

Production URL — https://command-centre.pages.dev (or similar)
Preview URL — the hash-prefixed one above (this deploy's specific snapshot)

⚠️ At this point the site is PUBLIC — anyone with the URL can see everything. Do not share the URL yet. Move straight to Phase 5 to lock it down.

Phase 5

Enable Cloudflare Access (Zero Trust)

~8 min

This is the auth layer. Anyone hitting your URL will see Cloudflare's login screen first — only your Google account can get past it.

5a · Open Zero Trust

Cloudflare dashboard → left sidebar → Zero Trust
First time: it asks you to create a Zero Trust account. Pick a team name (e.g., bambos) — this becomes part of your auth URL: bambos.cloudflareaccess.com. Choose the Free plan ($0, up to 50 users).
Skip onboarding tour

5b · Add Google as an identity provider

Zero Trust dashboard → Settings (left sidebar) → Authentication
Under "Login methods" click Add new
Choose Google
Cloudflare needs Google OAuth credentials. Two options:
- Easy: click "Use Cloudflare's OAuth app" if offered
- Manual: follow Cloudflare's Google IdP guide — takes ~5 min in Google Cloud Console
Save. Google is now a valid login method.

Skip-if-impatient option: use Cloudflare's built-in One-time PIN method (email magic links) instead. Already enabled by default. You'd get a 6-digit code emailed each time you log in. Less smooth than Google but zero setup.

5c · Create an Access application

Zero Trust dashboard → Access → Applications → Add an application
Choose Self-hosted
Application name: Command Centre
Session duration: 1 month (or 1 week for more frequent re-auth)
Application domain:
- Subdomain: command-centre
- Domain: pages.dev (from the dropdown)
- Leave path empty
Click Next

5d · Add a policy

Policy name: Bambos only
Action: Allow
Session duration: inherit from application
Configure rules → Include:
- Selector: Emails
- Value: b.kaisharis@gmail.com
Click Next → Add application

5e · (Optional) Add identity providers to this app

If you set up Google in 5b, on the next screen choose to allow Google + One-time PIN. Otherwise just One-time PIN.

Done when: Application appears in the Access → Applications list with status "Active".

Phase 6

Test

~3 min

Open an incognito / private window (so it doesn't use existing Cloudflare cookies)
Visit https://command-centre.pages.dev
You should see a Cloudflare login screen (not the dashboard directly)
Sign in with b.kaisharis@gmail.com (Google) or request a one-time PIN
After auth, dashboard loads
Click through each of the 9 internal project cards — confirm each loads
Click the Retirement Planner card — confirm it opens the Netlify URL in a new tab

If a card returns 404: the bundle missed a file. Re-run ./publish.sh and inspect cowork-dashboard-public/ for the missing path.

If you see the dashboard WITHOUT being prompted to log in: the Access policy isn't applied. Double-check Phase 5c step 5 (domain spelt exactly).

Maintenance — re-publishing updates

Whenever you edit dashboard.html or any of the linked project HTMLs:

cd ~/Documents/Claude/Projects/command\ centre
./publish.sh deploy

That's it. Re-builds the bundle and pushes a new deploy. Old deploys stay accessible at their preview URLs (useful for rollback).

If you want to inspect the bundle locally before deploying:

./publish.sh                       # build only
open cowork-dashboard-public/index.html
# happy? then:
./publish.sh deploy

Optional — Custom domain

If you'd rather use a domain you own (e.g., dashboard.bambos.com):

Cloudflare dashboard → Workers & Pages → click command-centre
Custom domains tab → Set up a custom domain
Enter your domain → follow DNS instructions
Then go back to Zero Trust → Access → Applications → edit Command Centre → change application domain to your custom domain

The Access policy automatically applies to the custom domain too.

Troubleshooting

wrangler pages deploy says "no project found"

First-time deploys ask to create the project. If you skipped that, run:

wrangler pages project create command-centre --production-branch=main

Then retry deploy.

Auth screen never appears (site is public)

Access only kicks in once the application is created AND the policy is attached. Confirm both in Zero Trust → Access → Applications.

npm install -g wrangler fails with EACCES

Either prefix with sudo, or set up an npm prefix in your home directory (cleaner long-term).

An internal link 404s after deploy

The source file may exist but publish.sh didn't copy it. Look at the script's per-project section, add any missing path. The transform sed only rewrites ../ → ./ — it doesn't invent files that aren't in the bundle.

The longevity page is missing a section

The strip script neutralised a sensitive link. That's expected. The original page in ~/Documents/Claude/Projects/ai doctor/longevity-command-center.html is untouched and still has full links.

I want to remove someone from access

Zero Trust → Access → Applications → Command Centre → Policies → edit "Bambos only" → adjust emails.

I want to revoke all sessions immediately

Zero Trust → My Team → Users → revoke session. Next page load forces re-auth.

Files in this folder

File	Purpose
`dashboard.html`	Source-of-truth dashboard (file:// version, with `../` paths)
`cowork-dashboard-public/`	Built bundle, regenerated by publish.sh — gitignore this
`publish.sh`	Build script (`./publish.sh` to build, `./publish.sh deploy` to ship)
`strip_longevity_links.py`	Helper: neutralises sensitive medical-PDF links in AI Doctor during build
`CLOUDFLARE_SETUP.html`	This guide

The source dashboard.html is the only file you edit. publish.sh regenerates everything else.