Marketplace / Blueprint 11
LIVESecurity / security

Zero-Trust Edge & Identity

Expose private AI services through centralized identity and outbound-only tunnel ingress.

Review my build

Interactive platform map

Architecture in context

The focused blueprint, its required foundation, and declared recommendations.

Core Selected Automatic Required path
Blueprint 11 / Security

Zero-Trust Edge & Identity

Expose private AI services through centralized identity and outbound-only tunnel ingress.

1 vCPU2 GB RAM6 services
01 / Problem

What this replaces

Self-hosted services commonly accumulate public ports, inconsistent login methods and ad-hoc per-app security.

02 / Outcome

What your team gains

A centralized edge with SSO, access policy, reverse-proxy controls and a tunnel architecture that does not require a publicly routable origin service port.

03 / Capability

What is inside the blueprint

Authentik OIDC/OAuth2 provider and source roles
Authorization code, client credentials, device code, refresh token and token exchange support
SAML provider with metadata/signing/property mappings
LDAP provider with LDAPS and supported code-based MFA patterns
Proxy and forward-auth providers
Single-app or domain-level forward auth
SCIM 2.0 user/group provisioning and SCIM sources
Authentik blueprints for identity configuration as code
Traefik host/path routing
Middleware chains
TLS termination
Load balancing and health checks
Cloudflare outbound-only tunnel
Block-all-ingress/allow-egress origin model
Tunnel replicas/failover and multiple connector connections
04 / Architecture

How it fits the platform

User -> Cloudflare network/tunnel -> Traefik -> Authentik authorization middleware -> protected application; origin initiates outbound tunnel connections.

Included services

cloudflared, Traefik, Authentik, authentik-worker, authentik-postgres, Redis

Platform requirements
05 / Delivery

From prerequisites to operation

Prerequisites
  1. Domain/Cloudflare account
  2. Identity source/user model
  3. TLS and route inventory
Deployment
  1. Create tunnel and routes
  2. Deploy Traefik routing
  3. Deploy Authentik server/worker/database/Redis
  4. Configure forward auth or OIDC per app
  5. Apply route-level policies
Configuration
  1. Providers/flows
  2. Groups/policies
  3. SCIM/LDAP/SAML if needed
  4. Forward-auth mode
  5. Tunnel replicas
  6. Traefik middleware and health checks
Operations
  1. User lifecycle
  2. Credential/token rotation
  3. Tunnel health
  4. Proxy header trust
  5. Policy review
  6. Auth database backups
06 / Combinations

What this unlocks with other layers

Zero-Trust Edge & Identity + Threat Detection & Runtime Security

Zero-Trust AI Service

Remote AI access without exposing origin service ports, with centralized authentication and behavioral remediation.

07 / Technology

Technology behind this capability

PostgreSQLRUNNING - three separate DB instances in censusAuthentikRUNNING - server + worker + DB + RedisRedisRUNNING - Authentik cache/task brokerTraefikRUNNING - only ingress pathCloudflare TunnelRUNNING