24 lines
2.3 KiB
Markdown
24 lines
2.3 KiB
Markdown
# `[2026-10-04]` pfi-ana-webhost destroyed; phasefinal.com on Cloudflare Pages; two new Cloudflare tokens
|
|
|
|
**pfi-ana-webhost (VM 110, Debian 11 + Virtualmin) is destroyed** (Prime: "retire the webhost — we may want one back in
|
|
the future, and if so we'll build it fresh"). It served nothing live: its one vhost `dragonfirepro.com` was drop-caught
|
|
by a third party in 2025-09, and `dragonfireacoustics.com` moved on 2026-09-24 to **Cloudflare Pages in the client's own
|
|
account** (project `dragonfireacoustics`, source on nh3-dev `~/development/adhoc/dragonfireacoustics-site`, now pushed to
|
|
private gitea `vh/dragonfireacoustics-site`; domain on Cloudflare Registrar to 2035-10-30, transfer-locked). Found via an
|
|
agent-feedback memory in albok, not the fleet; the 2026-09-17 "expires 10-30 / webhost is dead" entries are superseded.
|
|
Cleanup: FortiGate policy 18, VIPs `web-to-webhost` + `ssh-to-webhost` (SSH was open to the internet), address, service,
|
|
DHCP reservation; public A `pfi-ana-webhost.phasefinal.com`; `pfi-ana-webhost.ana.internal`; inventory moved to
|
|
`docs/retired/pfi-ana-webhost/`. **38.120.12.45 is unmapped.** Last image `pbs-ana:backup/vm/110/2026-10-04T10:28:18Z`.
|
|
|
|
**phasefinal.com moved off ana-docker to Cloudflare Pages** (project `phasefinal`, our account `vh@phasefinal`):
|
|
www + apex CNAME → `phasefinal.pages.dev`, apex → www as a zone Redirect Rule (Pages `_redirects` cannot cross hosts),
|
|
`_headers` carries the old nginx headers, `404.html` added (without it Pages serves the home page for every unknown
|
|
path). Privacy page's hosting line rewritten with Prime-approved wording. Deploy: `stacks/phasefinal-web/deploy-pages.sh`.
|
|
Nobody had recorded why it went to ana-docker on 2026-08-29; it was the default placement, not a weighed choice.
|
|
|
|
**Cloudflare tokens:** Prime vaulted an account **token-creator** (`nh3-dev/.config/cloudflare/infra-ops-token-creator`,
|
|
Cloudflare name `infra-ops-api`); infra-ops minted **`infra-ops-pages`** with it (vault
|
|
`nh3-dev/.config/cloudflare/infra-ops-pages-token`: Pages Write + all zones Zone Read, DNS Write, Dynamic URL Redirects
|
|
Write, Cache Settings Write, Cache Purge). Account tokens verify at `/accounts/<id>/tokens/verify`, not `/user/…`.
|
|
Details: auto-memory `reference_infra_ops_cloudflare_dns_token`. Commits 55e4d01, 513f6ef, 905862a.
|