Add OpenClaw local and Mac mini setup skill

infrastructure/cloudflare/cloudflare-zero-trust/SKILL.md

@@ -0,0 +1,39 @@
+---
+name: cloudflare-zero-trust
+description: Protect internal apps with Cloudflare Access, device posture, and Zero Trust policies.
+license: MIT
+metadata:
+  author: devops-skills
+  version: "1.0"
+---
+
+# Cloudflare Zero Trust
+
+Secure access to internal services without exposing public VPN endpoints.
+
+## Core Workflow
+
+1. Register application in Cloudflare Access.
+2. Integrate identity provider (Google Workspace, Okta, Entra ID).
+3. Define access policies by group, email domain, and device posture.
+4. Add logging and alerts for blocked requests.
+
+## Tunnel Setup
+
+```bash
+cloudflared tunnel login
+cloudflared tunnel create internal-app
+cloudflared tunnel route dns internal-app app.example.com
+cloudflared tunnel run internal-app
+```
+
+## Best Practices
+
+- Enforce MFA and managed-device posture checks.
+- Use service tokens for CI/CD automation.
+- Review app policies quarterly.
+
+## Related Skills
+
+- [zero-trust](../../../security/network/zero-trust/) - Zero trust architecture fundamentals
+- [dns-management](../../networking/dns-management/) - DNS routing concepts