Documentation Sites — Access & Authorization
The project runs two Docusaurus sites with different access policies. See Docs Architecture & Publishing for how they are built and deployed.
| Site | URL | Access |
|---|---|---|
| User docs | https://docs.rat.gd | Public — no authentication required |
| Dev docs | https://dev-docs.rat.gd | Private — GDPR-Labs GitHub org members only |
User docs — public access
The user-facing documentation site (docs.rat.gd) is publicly accessible. There is no authentication gate, no Cloudflare Access policy, and no login required.
Why public: the user docs contain end-user guidance (how to use the ROPA app, privacy policy, terms of service) that must be reachable by any user without a GitHub account or org membership.
How it is served: the site is deployed to Cloudflare Pages and served directly. Cloudflare's CDN handles caching and HTTPS. No Zero Trust Application is attached to the docs-rat Pages project.
The custom domain
docs.rat.gdis proxied through Cloudflare, so all standard Cloudflare protections (DDoS, bot management) are active even without an Access policy.
Dev docs — Zero Trust Access (private)
The developer documentation site is protected by Cloudflare Zero Trust Access. Only members of the GDPR-Labs GitHub organization can access it. Unauthenticated users are redirected to a login page and denied access if they are not org members.
Access URL
The protected site is served at:
https://dev-docs.rat.gd
Note: The underlying Cloudflare Pages URL
dev-docs-rat.pages.devstill exists, but the custom domaindev-docs.rat.gdis the canonical access point.
Authentication flow
- User navigates to
https://dev-docs.rat.gd - Cloudflare Zero Trust intercepts the request
- User is redirected to the Cloudflare Access login page
- User clicks Sign in with GitHub
- GitHub OAuth verifies the user's identity and org membership
- If the user belongs to GDPR-Labs, access is granted and a JWT session cookie is issued
- If the user does not belong to the org, access is denied
Zero Trust configuration
| Setting | Value |
|---|---|
| Team domain | gdpr-labs.cloudflareaccess.com |
| Application type | Self-hosted |
| Application domain | dev-docs.rat.gd |
| Policy name | Allow GDPR-Labs GitHub members |
| Policy action | Allow |
| Identity provider | GitHub (OAuth App) |
| Allow rule | GitHub Organizations = GDPR-Labs |
GitHub OAuth App
The GitHub OAuth App used for authentication is owned by the GDPR-Labs organization.
| Setting | Value |
|---|---|
| App name | CloudFlare Pages Access |
| Owner | GDPR-Labs |
| Authorization callback URL | https://gdpr-labs.cloudflareaccess.com/cdn-cgi/access/callback |
The Client ID and Client Secret are configured in Cloudflare Zero Trust and must not be rotated without updating them there as well.
Granting access to a new member
- Invite the user to the GDPR-Labs GitHub organization
- The user must accept the invitation
- On first login, GitHub will ask the user to authorize the OAuth App — they must click Grant next to the GDPR-Labs organization
- The user can then access
https://dev-docs.rat.gdvia GitHub login
Revoking access
To revoke access for a user, remove them from the GDPR-Labs GitHub organization. Their existing Cloudflare Access session will expire according to the configured session timeout, after which they will no longer be able to log in.
Troubleshooting
"That account does not have access"
The user is authenticated with GitHub but is not a member of the GDPR-Labs organization, or did not grant the OAuth App access to the org during login.
Fix: Ask the user to go to github.com/settings/applications, find the CloudFlare Pages Access app, and ensure GDPR-Labs shows as Granted.
Login page does not show a GitHub button
The GitHub identity provider is not linked to the Access Application in Zero Trust.
Fix: Go to Zero Trust → Access → Applications → edit the app → Policies → verify the policy is attached and the GitHub IdP is enabled.
Callback URL error during login
The Authorization callback URL in the GitHub OAuth App does not match what Cloudflare expects.
Fix: Set the callback URL in the GitHub OAuth App to exactly https://gdpr-labs.cloudflareaccess.com/cdn-cgi/access/callback — no trailing slash.
"Incorrect client credentials" error
The Client Secret in Cloudflare does not match the one in the GitHub OAuth App, usually due to a trailing space when pasting.
Fix: Regenerate the client secret in GitHub, paste it into a plain text editor to verify there are no extra spaces, then update it in Zero Trust → Settings → Authentication → GitHub IdP.