# Cloudflare state for phasefinal.com

Not applied by any script — recorded here so the edge configuration is
reviewable and reproducible rather than living only in someone's dashboard.

## DNS

| name | type | value | proxied |
|---|---|---|---|
| `www.phasefinal.com` | A | `38.120.12.44` | yes |
| `phasefinal.com` | A | `38.120.12.44` | yes |

`38.120.12.44` is the Anaheim public IP, forwarded to ana-docker's Traefik.
The apex 301s to `www` via a Traefik middleware, not a Cloudflare rule.

## Cache ruleset

`cache-ruleset.json` is the `http_request_cache_settings` phase entrypoint.
Applied with:

```bash
TOK=$(secret get nh3-dev/.config/cloudflare/phasefinal-cache-token)
curl -X PUT "https://api.cloudflare.com/client/v4/zones/$ZONE/rulesets/phases/http_request_cache_settings/entrypoint" \
  -H "Authorization: Bearer $TOK" -H 'Content-Type: application/json' \
  --data @cache-ruleset.json
```

**Edge and browser TTL are both `respect_origin` on purpose.** Cache policy is
declared once, in `../conf/nginx.conf`, which is in git — 300s on the document
so a dictated edit goes live quickly, a year on the immutable assets. Setting a
fixed edge TTL here would split that policy across two systems that then have to
be kept in agreement by memory.

## Zone settings

- **Always Online: on.** This, not the cache TTL, is what actually keeps the
  site reachable during an origin outage — Cloudflare serves a crawler-archived
  copy. With a 300s document TTL, caching alone would only mask about five
  minutes.
- **Email Address Obfuscation: on** (Cloudflare's default). The contact block
  depends on it — `inquiry@phasefinal.com` is written as a plain `mailto:` in
  the markup and rewritten at the edge. Do not hand-obfuscate it in the HTML;
  that interferes.

## Token

`nh3-dev/.config/cloudflare/phasefinal-cache-token` in the vault. Scoped to this
zone. Note it is an **account-scoped** token, so `/user/tokens/verify` reports
"Invalid API Token" while `/accounts/<id>/tokens/verify` reports `active` —
check the account endpoint, not the user one.