Compendium

Handoff to IncomeProject — Cloudflare Access + custom domain for Compendium

4 min read

Handoff to IncomeProject — Cloudflare Access + custom domain

Why this routing

Per d:/Projects/PROJECTS.md, IncomeProject owns brand/listing/buyer-facing execution for the Hudson cluster. Two adjacent infrastructure decisions belong to IncomeProject as well:

  1. Custom domains under hudsonenterprisesllc.com — IncomeProject holds the registrar credentials, the Cloudflare account that nameservers point at, and the DNS hygiene playbook.
  2. Cloudflare Access (Zero Trust) — IncomeProject already runs Access policies for other surfaces in the cluster. Compendium becomes another self-hosted app under the same tenant.

This brief is the request from Compendium. The user has authorized IncomeProject to execute.

What’s already done on the Compendium side

Compendium ships the build. The following are committed and pushed on main of adamhudson777/Compendium as of commit 29a7e23 and forward:

  1. scripts/quartz-overrides/quartz.config.ts — baseUrl updated to compendium.hudsonenterprisesllc.com (this is the requested subdomain — confirm or override).
  2. scripts/quartz-overrides/static/_headers — Cloudflare Pages headers file. Sets HSTS, X-Content-Type-Options, Permissions-Policy, Referrer-Policy, and cache rules tuned for Pagefind + Quartz static assets. Will be emitted to public/_headers on next build.
  3. Pagefind-backed client-side search is now in place (replaces flexsearch — see scripts/quartz-overrides/PAGEFIND.md). The deployed-site search will work without any Access exception.

What IncomeProject needs to execute

1. DNS — point compendium.hudsonenterprisesllc.com at the Pages project

The Pages project is compendium under the Cloudflare account that hosts hudsonenterprisesllc.com. Last successful deploy: https://69fd5ad9.compendium-01j.pages.dev (commit 29a7e23, 2026-05-25).

Option A (preferred — orange-cloud proxied):

  • Cloudflare dashboard → hudsonenterprisesllc.com zone → DNS → Records → Add record
  • Type: CNAME, Name: compendium, Target: compendium-01j.pages.dev, Proxy status: Proxied (orange cloud), TTL: Auto
  • Then Cloudflare dashboard → Workers & Pages → compendium project → Custom domains → Set up a custom domain → enter compendium.hudsonenterprisesllc.com → activate. Cloudflare auto-issues an edge cert via Universal SSL.

Option B (DNS-only — not preferred): same as A but proxy off. Loses Cloudflare Access gating, which is the whole point. Don’t do this.

2. Cloudflare Access — gate the new domain

The user is the only authorized identity for this site (personal reference library).

  • Cloudflare dashboard → Zero Trust → Access → Applications → Add an application → Self-hosted
  • Application name: Compendium
  • Session duration: 1 month (or whatever the cluster standard is)
  • Application domain: compendium.hudsonenterprisesllc.com
  • Identity providers: One-time PIN (no other IdP needed for a single-user app)
  • Policies: one policy, Action: Allow
    • Rule: Selector: Emails — Value: adamleehudson81@gmail.com (confirm — this was the value in Compendium’s pre-existing ACTIONS_REQUIRED.md §3)
    • Optionally add ahudson@superiorag.com as a second allowed email if the user wants both addresses.
  • Save.

Test: open an incognito window → go to https://compendium.hudsonenterprisesllc.com → should redirect to a Cloudflare Access challenge requesting an email → enter the allowed address → receive a one-time PIN → log in → land on the Compendium home page.

3. (Optional) Tighten the bypass

The original *.pages.dev URL (https://compendium-01j.pages.dev) will still resolve and serve the same content without Access gating unless you also add it to the Access application’s domain list or remove its production binding.

Two ways to handle:

  • Add compendium-01j.pages.dev as a second application domain in the same Access policy. This forces Access on both URLs. Cleanest.
  • Or: disable the *.pages.dev preview URL entirely in Pages project settings → Settings → Custom domains → remove the auto-assigned domain. Requires a new deploy to take effect.

Pick whichever IncomeProject’s playbook prefers.

After IncomeProject completes

  1. Confirm the new URL works (with login) and the *.pages.dev URL is either gated or removed.
  2. Notify Compendium so this handoff can be marked closed. Either:
    • Edit this file’s frontmatter status: open → status: closed (open a Compendium session and do it), or
    • Just tell the user; Compendium will close the loop in its next session.
  3. Optional: confirm the chosen subdomain in this brief — if IncomeProject prefers kb.hudsonenterprisesllc.com, library.hudsonenterprisesllc.com, notes.hudsonenterprisesllc.com, etc., Compendium can update its baseUrl and rebuild.

Constraints from Compendium’s side

  • Compendium is read-only with respect to other projects (locked rule in System/Conventions.md). This brief lives in Compendium; the execution lives in IncomeProject. No reciprocal writes.
  • Compendium can rebuild + redeploy at any time. After IncomeProject configures the domain, Compendium will re-run scripts/build-site.ps1 + scripts/deploy-public.ps1 so baseUrl + _headers are reflected on the live site.

Open question for the user

Confirm subdomain choice. Current placeholder: compendium.hudsonenterprisesllc.com. Reasonable alternatives: kb., library., notes., ref..

Generated by Compendium session 2026-05-25 at commit 29a7e23.

Graph View