2.3 KiB
[2026-10-04] pfi-ana-webhost destroyed; phasefinal.com on Cloudflare Pages; two new Cloudflare tokens
pfi-ana-webhost (VM 110, Debian 11 + Virtualmin) is destroyed (Prime: "retire the webhost — we may want one back in
the future, and if so we'll build it fresh"). It served nothing live: its one vhost dragonfirepro.com was drop-caught
by a third party in 2025-09, and dragonfireacoustics.com moved on 2026-09-24 to Cloudflare Pages in the client's own
account (project dragonfireacoustics, source on nh3-dev ~/development/adhoc/dragonfireacoustics-site, now pushed to
private gitea vh/dragonfireacoustics-site; domain on Cloudflare Registrar to 2035-10-30, transfer-locked). Found via an
agent-feedback memory in albok, not the fleet; the 2026-09-17 "expires 10-30 / webhost is dead" entries are superseded.
Cleanup: FortiGate policy 18, VIPs web-to-webhost + ssh-to-webhost (SSH was open to the internet), address, service,
DHCP reservation; public A pfi-ana-webhost.phasefinal.com; pfi-ana-webhost.ana.internal; inventory moved to
docs/retired/pfi-ana-webhost/. 38.120.12.45 is unmapped. Last image pbs-ana:backup/vm/110/2026-10-04T10:28:18Z.
phasefinal.com moved off ana-docker to Cloudflare Pages (project phasefinal, our account vh@phasefinal):
www + apex CNAME → phasefinal.pages.dev, apex → www as a zone Redirect Rule (Pages _redirects cannot cross hosts),
_headers carries the old nginx headers, 404.html added (without it Pages serves the home page for every unknown
path). Privacy page's hosting line rewritten with Prime-approved wording. Deploy: stacks/phasefinal-web/deploy-pages.sh.
Nobody had recorded why it went to ana-docker on 2026-08-29; it was the default placement, not a weighed choice.
Cloudflare tokens: Prime vaulted an account token-creator (nh3-dev/.config/cloudflare/infra-ops-token-creator,
Cloudflare name infra-ops-api); infra-ops minted infra-ops-pages with it (vault
nh3-dev/.config/cloudflare/infra-ops-pages-token: Pages Write + all zones Zone Read, DNS Write, Dynamic URL Redirects
Write, Cache Settings Write, Cache Purge). Account tokens verify at /accounts/<id>/tokens/verify, not /user/….
Details: auto-memory reference_infra_ops_cloudflare_dns_token. Commits 55e4d01, 513f6ef, 905862a.