Optimizing Cloudflare Access Configuration Documentation

docs/en_US/guide/dashboard.md

@@ -32,11 +32,15 @@ Nezha Monitoring uses Github, Gitlab, or Gitee as admin accounts.
 1. Click “Register application”.  
 2. Save the Client ID on the page, then click “Generate a new client secret” to create a new Client Secret, which will be displayed only once, **please keep it safe**.
 
-## Using Cloudflare Access as OAuth2 Provider
+## Using Cloudflare Access as an OAuth2 Provider
 
-If you encounter issues using Github, Gitlab, or Gitee as admin login, consider switching to [using Cloudflare Access as the OAuth2 provider](/en_US/guide/q8.html).
+If you encounter issues using GitHub, GitLab, or Gitee for admin account logins, consider switching to [Cloudflare Access as your OAuth2 provider](/en_US/guide/q8.html) for authentication.
 
-### Creating a SaaS-OIDC Application
+### Setting Up a New SaaS-OIDC Application
+
+:::warning
+The following steps are for users who have already started using Zero Trust. If you have not previously used Cloudflare Zero Trust, we strongly recommend that you first read the [Guide on Using Cloudflare Access as an OAuth2 Provider](/en_US/guide/q8.html) to understand the configuration examples and setup process.
+:::
 
 1. Go to [Zero Trust Dashboard](https://one.dash.cloudflare.com) and log in with your Cloudflare account.
 2. `My Team` -> `Users` -> `<specific user>` -> Get `User ID` and save it.

docs/en_US/guide/loginq.md

@@ -57,4 +57,9 @@ If you are configuring Github login on a server in mainland China, switching to
 
 ### net/http: TLS handshake timeout
 
-Same as above.
+Same as above.
+
+### Unable to receive email verification codes using Cloudflare Access as an OAuth2 Provider
+
+- Ensure that the email verification policy has been correctly configured in `Policies`.
+- Verify that the email address you provided is correct. Note that email addresses not on the policy whitelist will not receive verification codes.

docs/en_US/guide/q8.md

@@ -1,3 +1,6 @@
+---
+outline: deep
+---
 # Cloudflare Access OAuth2 Configuration
 If you encounter issues logging in as an administrator using Github, Gitlab, or Gitee, you may consider switching to Cloudflare Access as the OAuth2 provider.
 
@@ -20,18 +23,33 @@ Oauth2:
 | ClientID/ClientSecret | `Access` -> `Application` -> `Add an Application` <br/> -> `SaaS` -> `OIDC`     |
 | Endpoint              | `Access` -> `Application` -> `Application URL` -> `Only keep the protocol and domain, no path` |
 
-### Creating a SaaS-OIDC Application
+### Setting Up a New SaaS-OIDC Application
 
-Go to Zero Trust Dashboard: https://one.dash.cloudflare.com
+Navigate to the Zero Trust Dashboard: [https://one.dash.cloudflare.com/](https://one.dash.cloudflare.com/). Choose or create a new account, then follow these steps:
 
-1. `My Team` -> `Users` -> `<specific user>` -> Get `User ID` and save it;
-2. `Access` -> `Application` -> `Add an Application`;
-3. Select `SaaS`, enter a custom application name (e.g., nezha) in `Application`, select `OIDC`, and click `Add application`;
-4. In `Scopes`, select `openid`, `email`, `profile`, `groups`;
-5. Fill in your CallBack URL in `Redirect URLs`, such as `https://dashboard.example.com/oauth2/callback`;
-6. Record the `Client ID`, `Client Secret`, and the protocol and domain part of the `Issuer` URL, such as `https://xxxxx.cloudflareaccess.com`;
-7. Edit the Dashboard configuration file (usually located at `/opt/nezha/dashboard/data/config.yaml`), modify the `Oauth2` configuration according to the example configuration, and restart the Dashboard service.
+1. Go to `My Team` -> `Users` -> Click `<specific user>` -> Obtain and save the `User ID`. *(If this is your first time using Zero Trust, the Users list will be empty, and you can skip this step; users will appear after completing a verification.)*
+2. Navigate to `Access` -> `Applications` -> `Add an Application`.
+3. Select `SaaS`. In the `Application` field, enter a custom application name (e.g., `nezha`), select `OIDC`, and then click `Add application`.
+4. For `Scopes`, select `openid`, `email`, `profile`, `groups`.
+5. In `Redirect URLs`, enter your Dashboard Callback URL, such as `https://dashboard.example.com/oauth2/callback`.
+6. Record the `Client ID`, `Client Secret`, and the protocol and domain part of the `Issuer` address, for example, `https://xxxxx.cloudflareaccess.com`.
+7. Edit the Dashboard configuration file (usually located at `/opt/nezha/dashboard/data/config.yaml`), adjust the `OAuth2` settings according to the example configuration, and restart the Dashboard service.
 
-### Authentication Policy Configuration
+### Identity Verification Strategy Configuration
 
-After completing the Dashboard setup, you also need to configure the authentication policy in the Zero Trust Dashboard: `Access` -> `Applications` -> `<application name>` -> `Policies`. You can choose from over ten SSO authentication methods, including email OTP verification, hardware key verification, etc. For detailed configuration, please refer to the [Cloudflare Zero Trust documentation](https://developers.cloudflare.com/cloudflare-one/).
+After setting up the Dashboard, you need to configure identity verification policies in the Zero Trust Dashboard. Navigate to: `Access` -> `Applications` -> `<application name>` -> `Policies`. You can choose from various SSO authentication methods, including email OTP and hardware key verification. For detailed configurations, refer to the [Cloudflare Zero Trust Documentation](https://developers.cloudflare.com/cloudflare-one/).
+
+### Policy Configuration Example (One-time PIN)
+
+Using email OTP as the default verification method:
+
+1. Navigate to `Access` -> `Applications` -> `<application name>` -> `Policies` -> `Add a policy`.
+2. Set a `Policy Name`, for example, `OTP`, and set `Action` to `Allow`.
+3. Under `Configure rules`, add a new `Include` rule. Select `Emails` as the `Selector` and enter your email address in the textbox.
+4. Click `Save policy` to save the configuration.
+
+### Testing the Policy
+
+1. If the configuration is correct, when you visit the Dashboard login interface, it will display as "Log in with Cloudflare Account." Clicking on login will redirect you to the Cloudflare Access login page.
+2. Enter the email address configured previously, click `Send me a code`, and then enter the code received to log in to the Dashboard.
+3. If `User ID` was not specified in `Admin` during previous steps, an error message will be displayed after login: "This user is not an administrator of this site and cannot log in." At this point, you need to go to `My Team` -> `Users`, find the corresponding user, click on the username to get the `User ID`, and enter it into the `Admin` section of the Dashboard configuration file. After restarting the Dashboard service, try logging in again.

docs/en_US/guide/q9.md

@@ -1,3 +1,6 @@
+---
+outline: deep
+---
 # Enable GPU monitoring
 
 GPU monitoring is a new feature implemented in Nezha Monitoring v0.17.x. Before using the feature, please check you Dashboard version is higher than v0.17.2 and Agent version is higher than v0.17.0.