https://lino-labs.pages.dev. Wrangler's OAuth scope does not include access:edit, so the Zero Trust policy must be applied by hand. Steps below — flip it ON NOW.
Cloudflare Access — gate the deploy (do this first)
Heads up: the account-scoped /access URL 404s until Zero Trust is initialized on the account. Use the flow below — it goes through dash.cloudflare.com, which works on a fresh account.
- Open https://dash.cloudflare.com/ and sign in (account
LinoLabs). - In the left sidebar, click Zero Trust. First-time only: it will prompt for a team name — enter
linolabs(gives youlinolabs.cloudflareaccess.com), then pick the Free plan and confirm. - Once inside Zero Trust, go to Access controls → Applications → Create new application.
- Choose Self-hosted and private, then Add public hostname.
- Application name:
Lino Labs Umbrella. Session duration:24h. - Public hostname:
lino-labs.pages.dev(path/*to gate the whole site). - Identity providers: leave the default One-Time PIN on.
- Add a policy — Action: Allow, include rule Emails →
w72861313@gmail.com(plus any other allowed addresses). - Save. Visit https://lino-labs.pages.dev in a private window to confirm the OTP gate fires.
Until step 9 completes, the URL is publicly browsable. Don't share the URL.
Recommendation: Cloudflare Pages
Why: free, static-host with global CDN, no build step needed (just upload the directory), private-link option via Cloudflare Access if you want it gated, and a single wrangler pages deploy command gets it phone-accessible at a real URL in < 30 seconds.
Tradeoff vs alternatives:
| Cloudflare Pages picked | Free · global CDN · one-line deploy · Access gate optional · custom domain trivial. |
| Vercel | Also free for hobby — but overkill for static HTML, account locked to GitHub, marginally more friction. |
| GitHub Pages | Requires a public repo (or paid private) — and the umbrella references absolute file paths Sebastian probably doesn't want public. |
| Tailscale Serve / Funnel | Best for "laptop must be on" mode; Sebastian wanted phone access from anywhere, which means it should survive laptop sleep — Tailscale Funnel can do this but requires laptop awake or a separate host. |
Re-deploy after edits
The Pages project lino-labs already exists. To push changes:
- From ~/dev/lino-labs/, run: ./deploy/cf-pages.sh
- Production URL stays at https://lino-labs.pages.dev. Each deploy also generates a per-build preview at
https://<hash>.lino-labs.pages.dev. - The script's sanity guards abort the upload if app source (
*.tsx,*.swift,package.json,*.ts,*.py,.env*), symlinks, orapps/*/code/directories leak into staging.
What gets uploaded
The cf-pages.sh script uploads only the umbrella itself — it follows symlinks via --commit-dirty behaviour but uses an explicit allow-list so app source code (bpm, klip, knead repos) does not leak to the public CDN. Only the HTML/CSS/JS dashboard files ship.