54 lines
2.4 KiB
Markdown
54 lines
2.4 KiB
Markdown
# Cloudflare state for phasefinal.com
|
|
|
|
Not applied by any script — recorded here so the edge configuration is
|
|
reviewable and reproducible rather than living only in someone's dashboard.
|
|
|
|
## DNS
|
|
|
|
| name | type | value | proxied |
|
|
|---|---|---|---|
|
|
| `www.phasefinal.com` | CNAME | `phasefinal.pages.dev` | yes |
|
|
| `phasefinal.com` | CNAME | `phasefinal.pages.dev` | yes |
|
|
|
|
Since 2026-10-04 both are Cloudflare Pages custom domains (project `phasefinal`). They used to be
|
|
A `38.120.12.44` → ana-docker's Traefik, which also 301'd the apex to www. That redirect is now a
|
|
zone Redirect Rule (phase `http_request_dynamic_redirect`): `(http.host eq "phasefinal.com")` →
|
|
301 `concat("https://www.phasefinal.com", http.request.uri.path)`, query string preserved. The cache rule below still applies and
|
|
is harmless with Pages as the origin (it respects origin headers).
|
|
|
|
## Cache ruleset
|
|
|
|
`cache-ruleset.json` is the `http_request_cache_settings` phase entrypoint.
|
|
Applied with:
|
|
|
|
```bash
|
|
TOK=$(secret get nh3-dev/.config/cloudflare/phasefinal-cache-token)
|
|
curl -X PUT "https://api.cloudflare.com/client/v4/zones/$ZONE/rulesets/phases/http_request_cache_settings/entrypoint" \
|
|
-H "Authorization: Bearer $TOK" -H 'Content-Type: application/json' \
|
|
--data @cache-ruleset.json
|
|
```
|
|
|
|
**Edge and browser TTL are both `respect_origin` on purpose.** Cache policy is
|
|
declared once, in `../conf/nginx.conf`, which is in git — 300s on the document
|
|
so a dictated edit goes live quickly, a year on the immutable assets. Setting a
|
|
fixed edge TTL here would split that policy across two systems that then have to
|
|
be kept in agreement by memory.
|
|
|
|
## Zone settings
|
|
|
|
- **Always Online: on.** This, not the cache TTL, is what actually keeps the
|
|
site reachable during an origin outage — Cloudflare serves a crawler-archived
|
|
copy. With a 300s document TTL, caching alone would only mask about five
|
|
minutes.
|
|
- **Email Address Obfuscation: on** (Cloudflare's default). The contact block
|
|
depends on it — `inquiry@phasefinal.com` is written as a plain `mailto:` in
|
|
the markup and rewritten at the edge. Do not hand-obfuscate it in the HTML;
|
|
that interferes.
|
|
|
|
## Token
|
|
|
|
`nh3-dev/.config/cloudflare/phasefinal-cache-token` in the vault. Scoped to this
|
|
zone. Note it is an **account-scoped** token, so `/user/tokens/verify` reports
|
|
"Invalid API Token" while `/accounts/<id>/tokens/verify` reports `active` —
|
|
check the account endpoint, not the user one.
|