Tenant Setup Guide

How to create and configure a new SlopDrop tenant. Use the admin dashboard at admin.slopdrop.dev for tenant creation and visibility management. WAF and Access app configuration is still manual.

Step 1: Create Tenant

Option A: Admin dashboard (preferred)

1. Go to admin.slopdrop.dev/tenants/new
2. Enter slug, name, plan
3. Submit

Option B: D1 directly

cd packages/api

npx wrangler d1 execute slopdrop --remote --command \
  "INSERT INTO tenants (id, slug, name, plan, created_at) \
   VALUES ('tenant_<slug>', '<slug>', '<Display Name>', 'free', datetime('now'))"

Replace <slug> with the tenant identifier (lowercase, alphanumeric, hyphens). This becomes the subdomain: <slug>.slopdrop.dev.

Verify:

npx wrangler d1 execute slopdrop --remote --command \
  "SELECT slug, name, plan FROM tenants"

Step 2: Add to WAF Allowlist

The WAF custom rule blocks all subdomains not in the allowlist. Add the new tenant:

1. Cloudflare Dashboard → Security → WAF → Custom Rules
2. Edit the "Block unknown subdomains" rule
3. Add: AND Hostname does not equal {slug}.slopdrop.dev
4. Save

Without this step, requests to {slug}.slopdrop.dev are blocked at the WAF layer and never reach the Worker.

Step 3: Configure Cloudflare Access

Each tenant subdomain needs a Cloudflare Access application to control who can view rendered documents.

1. Go to Cloudflare Zero Trust Dashboard
2. Access → Applications → Add an application
3. Type: Self-hosted
4. Application name: SlopDrop - <Tenant Name>
5. Subdomain: <slug>.slopdrop.dev
6. Session duration: 24 hours (or your preference)

Access Policy

Add an Allow policy with rules for who can access:

Authentication Method

Recommended: Google OAuth (any Google account, not limited to Workspace).

Setup:

1. GCP Console → APIs & Credentials → Create OAuth Client ID (Web application)
2. Redirect URI: https://<team>.cloudflareaccess.com/cdn-cgi/access/callback
3. Cloudflare Zero Trust → Settings → Authentication → Add Google → paste Client ID + Secret

Alternative: One-time PIN (less secure — codes can be shared).

Step 4: Set Visibility

By default, tenants are private — they require a valid Cloudflare Access JWT. The Worker verifies this cryptographically.

To make a tenant public (e.g. for documentation):

1. Go to admin.slopdrop.dev/tenants
2. Click the visibility toggle for the tenant

Or via D1:

npx wrangler d1 execute slopdrop --remote --command \
  "UPDATE tenants SET is_public = 1 WHERE slug = '<slug>'"

Step 5: User Login

Once the tenant and Access policy exist, users authenticate via the CLI:

slop login --tenant <slug>

This opens the browser, goes through Cloudflare Access authentication, and stores a local API token.

Step 6: Configure Global Watch (Optional)

Add the tenant to ~/.slop/global.yaml for automatic file syncing:

projects:
  - tenant: <slug>
    project: <project-name>
    ignore: ["node_modules/**", ".git/**"]
    sources:
      - path: ~/path/to/docs
        patterns: ["**/*.md"]

Then: slop watch --global --initial-sync

Automation Roadmap

The manual steps above will be replaced with:

slop admin create-tenant <slug> \
  --name "Display Name" \
  --emails "admin@company.com" \
  --domain "@company.com"

This would:

1. Insert tenant into D1
2. Create Cloudflare Access application via API
3. Configure Access policy with specified emails/domains
4. Output the tenant URL and next steps