vh
9e986d8ee8
Cache rule on www.phasefinal.com with edge and browser TTL both respect_origin, so cache policy stays declared once in nginx.conf rather than split between the repo and the dashboard. Always Online enabled, which is what actually survives an origin outage; a 300s document TTL alone would only mask five minutes. Verified: document and assets both reach cf-cache-status HIT, apex 301s to www, edge email obfuscation active.
51 lines
2.0 KiB
Markdown
51 lines
2.0 KiB
Markdown
# Cloudflare state for phasefinal.com
|
|
|
|
Not applied by any script — recorded here so the edge configuration is
|
|
reviewable and reproducible rather than living only in someone's dashboard.
|
|
|
|
## DNS
|
|
|
|
| name | type | value | proxied |
|
|
|---|---|---|---|
|
|
| `www.phasefinal.com` | A | `38.120.12.44` | yes |
|
|
| `phasefinal.com` | A | `38.120.12.44` | yes |
|
|
|
|
`38.120.12.44` is the Anaheim public IP, forwarded to ana-docker's Traefik.
|
|
The apex 301s to `www` via a Traefik middleware, not a Cloudflare rule.
|
|
|
|
## Cache ruleset
|
|
|
|
`cache-ruleset.json` is the `http_request_cache_settings` phase entrypoint.
|
|
Applied with:
|
|
|
|
```bash
|
|
TOK=$(secret get nh3-dev/.config/cloudflare/phasefinal-cache-token)
|
|
curl -X PUT "https://api.cloudflare.com/client/v4/zones/$ZONE/rulesets/phases/http_request_cache_settings/entrypoint" \
|
|
-H "Authorization: Bearer $TOK" -H 'Content-Type: application/json' \
|
|
--data @cache-ruleset.json
|
|
```
|
|
|
|
**Edge and browser TTL are both `respect_origin` on purpose.** Cache policy is
|
|
declared once, in `../conf/nginx.conf`, which is in git — 300s on the document
|
|
so a dictated edit goes live quickly, a year on the immutable assets. Setting a
|
|
fixed edge TTL here would split that policy across two systems that then have to
|
|
be kept in agreement by memory.
|
|
|
|
## Zone settings
|
|
|
|
- **Always Online: on.** This, not the cache TTL, is what actually keeps the
|
|
site reachable during an origin outage — Cloudflare serves a crawler-archived
|
|
copy. With a 300s document TTL, caching alone would only mask about five
|
|
minutes.
|
|
- **Email Address Obfuscation: on** (Cloudflare's default). The contact block
|
|
depends on it — `inquiry@phasefinal.com` is written as a plain `mailto:` in
|
|
the markup and rewritten at the edge. Do not hand-obfuscate it in the HTML;
|
|
that interferes.
|
|
|
|
## Token
|
|
|
|
`nh3-dev/.config/cloudflare/phasefinal-cache-token` in the vault. Scoped to this
|
|
zone. Note it is an **account-scoped** token, so `/user/tokens/verify` reports
|
|
"Invalid API Token" while `/accounts/<id>/tokens/verify` reports `active` —
|
|
check the account endpoint, not the user one.
|