Achhina's Digital Garden

2026-06-22 Remote MCP One-Month Access Sessions

3 min read

2026-06-22 Remote MCP One-Month Access Sessions

Follow-up to 2026-06-21 Remote Obsidian MCP Connector.

What I set out to do

Stop the remote Obsidian MCP connector (Cloudflare Access-gated obsidian-mcp.achhina.com) from making me re-authenticate roughly every 24h. Secondary thread: explore moving the MCP server off the MacBook to something always-on and free/cheap.

What I actually did

Killed the daily re-auth. Learned there are two timers, both defaulting to 24h, and both must be raised:

  • Global session duration (Access controls → Access settings) — how often Access re-checks the IdP across all apps.
  • Application session duration (the Obsidian MCP app’s Details) — per-app default.

Raising only the app session does nothing, because the 24h global timer still forces an IdP round-trip. Set both to 1 month (730h, the maximum Cloudflare offers) by driving the Zero Trust dashboard with Playwright. Verified the “Allow owner” policy is Same as application session duration, so no policy override shortens it. Re-loaded the app page to confirm the save stuck (there was an “Access services degradation” banner at the time).

Confirmed the Google-IdP behavior. My IdP is Google. Cloudflare does not re-validate the Google token mid-session — the global timer just controls when Access bounces me back to Google, now monthly. If the phone stays signed into Google, that monthly redirect is silent (no password/consent). So the felt timer is just the Cloudflare 1-month session.

Off-Mac hosting (advisory only, nothing built). The blocker is that the vault lives in iCloud, which won’t mount on Linux, so any off-Mac host needs a sync bridge. Settled on two-way git (Obsidian Git on Mac/phone + host pull/push) with the big caveat that .git inside an iCloud folder corrupts — cleanest fix is making git the source of truth and retiring iCloud. Target host: Oracle Cloud Always Free. Crucial constraint: a headless host has no browser to complete Google OAuth even once, so it would have to switch from interactive Access to a Cloudflare service token (CF-Access-Client-Id/Secret).

What was striking

  • Two independent timers. “Set the session to a month” is a two-place change; the global timer silently overrides the app one. Easy to set the wrong one and see no effect.
  • 1 month is the ceiling for interactive Access — there is no “never expire.” Past a month, or for anything headless, a service token is the only option.
  • With Google IdP, Cloudflare isn’t continuously checking the token, so the earlier worry that “Google forces re-login sooner” was overstated for this case.
  • The Cloudflare One dashboard is hostile to Playwright — snapshots and even screenshots timed out and navigation threw “frame detached” until a fresh goto settled. Deep-linking needs the one.dash.cloudflare.com/<account>/... base; adding /one/ myself doubled the path to a 404.

Top tomorrow

  1. Decide whether to actually move the server off-Mac (Oracle free tier + two-way git + service token) or leave it on the always-awake Mac.
  2. If staying on the Mac: this is done — no further action.
  3. Still optionally rotate the Google client secret (briefly visible in a setup screenshot yesterday).

Graph View

Backlinks