Connecting to the UpsQuad VPN (Cloudflare WARP)

All UpsQuad cloud environments are private — no public IPs, no public endpoints. The only way to reach them (databases, internal services, the jump box, and later GKE/Cloud Run admin) is over the Cloudflare WARP VPN, authenticated with your @upsquad.ai identity. This guide gets you connected.

1. Install the WARP client

Download the Cloudflare WARP client for your OS:

• macOS / Windows: https://1.1.1.1/ (or the Mac App Store / MS Store)
• Linux: cloudflare-warp package — https://pkg.cloudflareclient.com/

2. Enroll in the UpsQuad Zero Trust organization

1. Open WARP → Settings (gear) → Account → Login with Cloudflare Zero Trust.
2. Team name: upsquad (full URL upsquad.cloudflareaccess.com).
3. Authenticate with your @upsquad.ai Google identity.
4. Toggle WARP On (the icon should read Connected).

Access is gated by WARP enrollment — any enrolled @upsquad.ai device can reach the routed private networks. (If enrollment is rejected, the device enrollment policy may need your address added in the Zero Trust dashboard → Settings → WARP Client → Device enrollment.)

3. Verify connectivity

With WARP connected, you should reach the beta environment's private services (these have no public exposure):

# CloudSQL (Postgres) — PSC endpoint
nc -vz 10.14.0.10 5432        # => succeeded

# Memorystore Redis Cluster — PSC discovery endpoint
nc -vz 10.14.0.2 6379         # => succeeded

# Jump box / dev box SSH
ssh <you>@65.21.252.138

The negative test (proves it's VPN-only): turn WARP off and re-run — all of the above must time out. If they still connect with WARP off, you're not actually going through the tunnel; check your split-tunnel config.

4. What you can reach over WARP

Target	Address	Notes
Beta CloudSQL	10.14.0.10:5432	Postgres 16 + pgvector, TLS required
Beta Redis Cluster	10.14.0.2:6379	TLS + IAM auth
Jump box (vbhel) SSH	65.21.252.138:22	dedicated devbox-ssh tunnel
Beta nodes / pods / services	10.10–10.12.x	routed; no workloads listening yet
GKE control plane	172.16.0.0/28	only after GKE is activated (see notes)

Connection strings for the data services come from Secret Manager (you need project access):

gcloud secrets versions access latest --secret=database-url-beta \
  --project=upsquad-beta --billing-project=upsquad-core

5. How the routing works (FYI)

WARP's default Split Tunnel excludes the RFC1918 private ranges (10/8, 172.16/12, 192.168/16) so it won't break your home/office LAN. We carve our GCP ranges out of that exclude so only 10.8.0.0/13 + 10.16.0.0/12 (covering beta 10.10–10.14 and prod 10.20–10.24) route through the tunnel; everything else stays on your local network. The GKE control-plane range 172.16.0.0/28 will be carved similarly when GKE is activated.

After any routing change, reconnect WARP (toggle off/on) so the client pulls the updated routes.

6. Troubleshooting

Symptom	Check
Everything times out on WARP	WARP shows Connected? Re-login to the upsquad team.
One range times out, others work	That range may not be carved into Split Tunnel yet, or nothing is listening there.
Works with WARP off	You're not on the tunnel — that traffic is going local; verify the route is advertised.
Enrollment rejected	Device enrollment policy must allow @upsquad.ai.

Related

• Architecture: docs/hld/cloud-foundation-beta-prod.md, ADR-0018
• Jump box SSH tunnel: docs/runbooks/devbox-ssh-warp.md
• IP allocation: docs/network/ip-allocation.md