Proposed Architecture for the Lab Active Report¶

The goal is to maintain the report in GitHub while providing the lab with a secure, continuously updated web version.

1. Source Control — GitHub¶

The Jupyter Book source files, notebooks, figures, and supporting content remain in a private GitHub repository.

GitHub serves as the source of truth for the project and preserves the complete version history of the report.

2. Automated Build and Deployment — Cloudflare¶

The private GitHub repository is connected to Cloudflare Pages through Cloudflare’s GitHub integration.

When changes are pushed to the designated production branch, Cloudflare automatically:

GitHub → Build Jupyter Book → Deploy updated website

This means the lab always sees the latest deployed version without requiring us to manually rebuild or upload the website.

3. Secure Access — Cloudflare Access / Zero Trust¶

The deployed website is protected by Cloudflare Access.

Authorized lab members authenticate before viewing the report. If GitHub is used as the identity provider, Access policies can restrict entry based on approved GitHub organization or team membership.

Therefore, making the source repository private and protecting the deployed website are handled as two separate security layers:

Private GitHub repository
→ protects source code and research files

Cloudflare Access
→ controls who can view the deployed report

Overall Workflow¶

Research work
↓
Jupyter notebooks / Markdown / figures
↓
Private GitHub repository
↓
Push or merge into production branch
↓
Cloudflare automatically builds the Jupyter Book
↓
Cloudflare deploys the updated site
↓
Cloudflare Access authenticates authorized lab members
↓
Lab members view the latest active research report

Where Everything Lives¶

• Source code and report content: Private GitHub repository

• Version history and collaboration: GitHub

• Build and deployment: Cloudflare

• Hosted web version: Cloudflare

• Viewer authentication and access control: Cloudflare Access