ops: phasefinal.com moved to Cloudflare Pages; pfi-ana-webhost destroyed and removed from inventory, DNS and the FortiGate

stacks/phasefinal-web/deploy-pages.sh

@@ -0,0 +1,19 @@
+#!/usr/bin/env bash
+# Deploy phasefinal.com to Cloudflare Pages (project `phasefinal`, account vh@phasefinal).
+#   stacks/phasefinal-web/deploy-pages.sh
+# The site is the static tree in conf/site/ (with its _headers and 404.html); there is no build step.
+# Token: a Cloudflare API token with Account → Cloudflare Pages: Edit, read from the vault.
+#   PAGES_TOKEN_KEY defaults to the dedicated infra-ops token (to be minted by Prime);
+#   the 2026-10-04 migration used nh3-dev/development/jackdaw/cloudflare-api-token as a one-off.
+set -euo pipefail
+here=$(cd "$(dirname "$0")" && pwd)
+key=${PAGES_TOKEN_KEY:-nh3-dev/.config/cloudflare/infra-ops-pages-token}
+CLOUDFLARE_API_TOKEN=$(secret get "$key") || { echo "no token at vault key $key (set PAGES_TOKEN_KEY)" >&2; exit 2; }
+export CLOUDFLARE_API_TOKEN
+CLOUDFLARE_ACCOUNT_ID=$(curl -s -m 15 -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN" https://api.cloudflare.com/client/v4/accounts \
+  | python3 -c 'import json,sys; r=json.load(sys.stdin)["result"]; print(next(a["id"] for a in r if a["name"]=="vh@phasefinal"))')
+export CLOUDFLARE_ACCOUNT_ID
+# run wrangler from a scratch dir so it never drops .wrangler/ state into the repo
+cd "$(mktemp -d)"
+npx -y wrangler@4 pages deploy "$here/conf/site" --project-name phasefinal --branch main --commit-dirty=true \
+  --commit-message "deploy from eshpfi-management $(git -C "$here" rev-parse --short HEAD)"