ZTNA in one sentence: the network doesn't trust you — you prove yourself on every request, and the origin never sees anyone who hasn't. This portfolio is left public so anyone can see it; the same Cloudflare edge still gates the file platform (save://, an R2 bucket) — by mTLS: your device presents a client certificate (a "badge") at the TLS handshake. No password, no login, ever. Try it — type save in the terminal.
$ curl -I https://save.blueberryservices.co.za
HTTP/2 403
save:// — your device needs its badge
# a request without a client cert dies here, before anything loads
how it works:
1. dns: ztna + save → proxied through cloudflare (github pages / r2 worker)
2. handshake: your device presents its badge — a client cert from cloudflare's managed CA
3. no badge → 403, the gate tells you to get one at save://enroll
4. badged → the worker touches r2; this page is served openly
5. no vpn, no client, no exposed origin — the certificate is the key
try it:
type save in the terminal → save down lists the bucket, save upload opens the drop site (badge the device once at save://enroll)