vh/esh-pfi-infrastructure
1
0
Fork 0
Code Issues 7 Pull Requests Actions Packages Projects Releases Wiki Activity

ops(phasefinal-web): dedicated infra-ops-pages token; apex->www as a Cloudflare Redirect Rule

Browse Source
This commit is contained in:
vh
2026-10-04 17:37:32 -07:00
parent 513f6ef38f
commit 905862a58e
4 changed files with 11 additions and 14 deletions
Download Patch File Download Diff File Expand all files Collapse all files
stacks/phasefinal-web/README.md
+5 -8
View File
@@ -31,19 +31,16 @@ rather than broken, which is the failure mode you won't notice.
stacks/phasefinal-web/deploy-pages.sh # conf/site → Pages production (branch main)
```
Needs a vaulted Cloudflare token with Account → Cloudflare Pages: Edit (see the script).
⚠ The 2026-10-04 migration used jackdaw's token as a one-off; a dedicated
`nh3-dev/.config/cloudflare/infra-ops-pages-token` is pending Prime. Check the result on
the per-deploy preview URL wrangler prints before trusting the custom domains.
Uses the account token `infra-ops-pages` (vault `nh3-dev/.config/cloudflare/infra-ops-pages-token`).
Check the result on the per-deploy preview URL wrangler prints before trusting the custom domains.
## DNS and redirects
`www.phasefinal.com` and `phasefinal.com` → CNAME `phasefinal.pages.dev`, Cloudflare-proxied
(both are Pages custom domains). Cloudflare-proxied is also what provides the email-address
obfuscation the contact block relies on. ⚠ **The apex no longer 301s to www**: Traefik used
to do that, Pages `_redirects` cannot redirect between hostnames, and no vaulted token may
create a zone Redirect Rule. Both hostnames serve the site until Prime mints a token with
Single Redirect: Edit; then add the rule `phasefinal.com/* → https://www.phasefinal.com/${1}` (301).
obfuscation the contact block relies on. **The apex 301s to www through a zone Redirect Rule**
(`http_request_dynamic_redirect` entrypoint, path and query kept), since Pages `_redirects` cannot
redirect between hostnames. Traefik did this before the move.
## Lesson from the ana-docker era (2026-08-29)
stacks/phasefinal-web/cloudflare/README.md
+3 -2
View File
@@ -11,8 +11,9 @@ reviewable and reproducible rather than living only in someone's dashboard.
| `phasefinal.com` | CNAME | `phasefinal.pages.dev` | yes |
Since 2026-10-04 both are Cloudflare Pages custom domains (project `phasefinal`). They used to be
A `38.120.12.44` → ana-docker's Traefik, which also 301'd the apex to www; that redirect is gone
until a Redirect Rule can be created (see `../README.md`). The cache rule below still applies and
A `38.120.12.44` → ana-docker's Traefik, which also 301'd the apex to www. That redirect is now a
zone Redirect Rule (phase `http_request_dynamic_redirect`): `(http.host eq "phasefinal.com")` →
301 `concat("https://www.phasefinal.com", http.request.uri.path)`, query string preserved. The cache rule below still applies and
is harmless with Pages as the origin (it respects origin headers).
## Cache ruleset
stacks/phasefinal-web/deploy-pages.sh
+2 -3
View File
@@ -2,9 +2,8 @@
# Deploy phasefinal.com to Cloudflare Pages (project `phasefinal`, account vh@phasefinal).
# stacks/phasefinal-web/deploy-pages.sh
# The site is the static tree in conf/site/ (with its _headers and 404.html); there is no build step.
# Token: a Cloudflare API token with Account → Cloudflare Pages: Edit, read from the vault.
# PAGES_TOKEN_KEY defaults to the dedicated infra-ops token (to be minted by Prime);
# the 2026-10-04 migration used nh3-dev/development/jackdaw/cloudflare-api-token as a one-off.
# Token: the account token `infra-ops-pages` (Pages Write + zone DNS/redirect/cache), vaulted at
# nh3-dev/.config/cloudflare/infra-ops-pages-token. Override with PAGES_TOKEN_KEY.
set -euo pipefail
here=$(cd "$(dirname "$0")" && pwd)
key=${PAGES_TOKEN_KEY:-nh3-dev/.config/cloudflare/infra-ops-pages-token}