Forge · Application Delivery Golden Path · Executive Report

Cloudflare POC: the building blocks work

Status as of 24 September 2026 · Proof of concept · Non-production

Outcome: In one working session we stood up a live, monitored static site on Cloudflare, built entirely from reviewable code and a tightly scoped credential, with no access to production. The Cloudflare half of the V1 golden path is proven. The main remaining risk is the automated GitHub pipeline, which is the next spike.

1 session

From zero tooling to a live, monitored site

Production accounts reachable by the POC credential

Secrets in code, site files or tickets

3 / 0 / 0

Resources added / changed / destroyed, via reviewed plan

What we set out to prove, and where we landed

Question	Status	Evidence
Can infrastructure be created from code, with a preview before any change?	Proven	Terraform previewed then created the hosting project, custom domain and DNS entry. No manual console changes.
Can we work with least-privilege access?	Proven	The credential works only on the test account and one test zone. Production accounts were checked and correctly refused.
Can a site be deployed and served?	Proven	The Forge portal is live on Cloudflare's global network.
Can we observe real user experience?	Proven	Datadog Real User Monitoring is live. It only collects after visitor consent and masks anything typed.
Does it work from inside an enterprise network?	Proven	Yes, with one known tooling setting.
Can the site run on a company domain with a certificate?	Waiting	Configured on Cloudflare. Waiting for one entry at the external DNS provider.
Can access be limited to employees (single sign-on)?	Waiting	Design agreed. Needs one-time setup: Zero Trust enablement and a sign-on app registration.
Can teams ship through GitHub with no stored keys?	Not yet tested	This is the core V1 promise and the largest open risk. Every deployment today ran from an engineer's machine.

Bottom line: 5 of 8 proven, 2 waiting on other teams, 1 not yet tested. Nothing found so far blocks the V1 design.

Forge Cloudflare POC · Executive Report1 / 2

Lessons, risks and asks

What we learned

Confirms the plan

Code-reviewed infrastructure changes are practical and fast.
Cloudflare permissions support the test/production separation we need.
Monitoring, with privacy controls, can be in the template from day one.
Internal-only access is a one-time setup, then a small change per site.

Changes the plan

Public DNS is hosted outside Cloudflare. Each new hostname needs a change there too. Automate or pre-approve it, or it becomes a bottleneck.
Enterprise network controls affect tooling. A one-line fix that belongs in onboarding and pipelines.
Credential setup was the slowest step. A standard, pre-approved permission set would speed onboarding.

Risks

Risk	Level	Mitigation
GitHub keyless deployment may not work as assumed.	High	Next spike, before further build-out. Fallback: short-lived, narrowly scoped deploy credentials in GitHub.
External DNS dependency slows every new site.	Medium	Agree an owner and fast path, or use a Cloudflare-managed test zone.
POC site is currently public.	Medium	Content checked: no company data. Employee-only access follows sign-on setup.
Session replay records all consented visits.	Low	Typed text is masked. Reduce the rate or confirm with Privacy before wider use.

Decisions and support needed

Identity team: Register the sign-on application so the site can be limited to employees.
DNS owner: Add the POC hostname entry and agree a standard process for future hostnames.
Sponsor: Approve the GitHub pipeline spike as next priority. It decides whether V1 ships as designed.
Privacy (optional): Confirm session replay is acceptable for internal sites.

Next steps

#	Step	Depends on
1	Spike GitHub → pipeline → Cloudflare deployment with no stored keys	Test GitHub repository
2	Restrict the POC site to employees via single sign-on	Sign-on app registration
3	Enable the company custom domain and certificate	External DNS entry
4	Move infrastructure state to shared, protected storage	Step 1
5	Measure time-to-first-deploy with a pilot team	Steps 1–3

Scope: non-production test account only. No production resources created, changed or accessed.2 / 2