vh
9e986d8ee8
Cache rule on www.phasefinal.com with edge and browser TTL both respect_origin, so cache policy stays declared once in nginx.conf rather than split between the repo and the dashboard. Always Online enabled, which is what actually survives an origin outage; a 300s document TTL alone would only mask five minutes. Verified: document and assets both reach cf-cache-status HIT, apex 301s to www, edge email obfuscation active.
2.0 KiB
Cloudflare state for phasefinal.com
Not applied by any script — recorded here so the edge configuration is reviewable and reproducible rather than living only in someone's dashboard.
DNS
| name | type | value | proxied |
|---|---|---|---|
www.phasefinal.com |
A | 38.120.12.44 |
yes |
phasefinal.com |
A | 38.120.12.44 |
yes |
38.120.12.44 is the Anaheim public IP, forwarded to ana-docker's Traefik.
The apex 301s to www via a Traefik middleware, not a Cloudflare rule.
Cache ruleset
cache-ruleset.json is the http_request_cache_settings phase entrypoint.
Applied with:
TOK=$(secret get nh3-dev/.config/cloudflare/phasefinal-cache-token)
curl -X PUT "https://api.cloudflare.com/client/v4/zones/$ZONE/rulesets/phases/http_request_cache_settings/entrypoint" \
-H "Authorization: Bearer $TOK" -H 'Content-Type: application/json' \
--data @cache-ruleset.json
Edge and browser TTL are both respect_origin on purpose. Cache policy is
declared once, in ../conf/nginx.conf, which is in git — 300s on the document
so a dictated edit goes live quickly, a year on the immutable assets. Setting a
fixed edge TTL here would split that policy across two systems that then have to
be kept in agreement by memory.
Zone settings
- Always Online: on. This, not the cache TTL, is what actually keeps the site reachable during an origin outage — Cloudflare serves a crawler-archived copy. With a 300s document TTL, caching alone would only mask about five minutes.
- Email Address Obfuscation: on (Cloudflare's default). The contact block
depends on it —
inquiry@phasefinal.comis written as a plainmailto:in the markup and rewritten at the edge. Do not hand-obfuscate it in the HTML; that interferes.
Token
nh3-dev/.config/cloudflare/phasefinal-cache-token in the vault. Scoped to this
zone. Note it is an account-scoped token, so /user/tokens/verify reports
"Invalid API Token" while /accounts/<id>/tokens/verify reports active —
check the account endpoint, not the user one.