Cloudflare state for phasefinal.com

Not applied by any script — recorded here so the edge configuration is reviewable and reproducible rather than living only in someone's dashboard.

DNS

name	type	value	proxied
`www.phasefinal.com`	CNAME	`phasefinal.pages.dev`	yes
`phasefinal.com`	CNAME	`phasefinal.pages.dev`	yes

Since 2026-10-04 both are Cloudflare Pages custom domains (project phasefinal). They used to be A 38.120.12.44 → ana-docker's Traefik, which also 301'd the apex to www; that redirect is gone until a Redirect Rule can be created (see ../README.md). The cache rule below still applies and is harmless with Pages as the origin (it respects origin headers).

Cache ruleset

cache-ruleset.json is the http_request_cache_settings phase entrypoint. Applied with:

TOK=$(secret get nh3-dev/.config/cloudflare/phasefinal-cache-token)
curl -X PUT "https://api.cloudflare.com/client/v4/zones/$ZONE/rulesets/phases/http_request_cache_settings/entrypoint" \
  -H "Authorization: Bearer $TOK" -H 'Content-Type: application/json' \
  --data @cache-ruleset.json

Edge and browser TTL are both respect_origin on purpose. Cache policy is declared once, in ../conf/nginx.conf, which is in git — 300s on the document so a dictated edit goes live quickly, a year on the immutable assets. Setting a fixed edge TTL here would split that policy across two systems that then have to be kept in agreement by memory.

Zone settings

Always Online: on. This, not the cache TTL, is what actually keeps the site reachable during an origin outage — Cloudflare serves a crawler-archived copy. With a 300s document TTL, caching alone would only mask about five minutes.
Email Address Obfuscation: on (Cloudflare's default). The contact block depends on it — inquiry@phasefinal.com is written as a plain mailto: in the markup and rewritten at the edge. Do not hand-obfuscate it in the HTML; that interferes.

Token

nh3-dev/.config/cloudflare/phasefinal-cache-token in the vault. Scoped to this zone. Note it is an account-scoped token, so /user/tokens/verify reports "Invalid API Token" while /accounts/<id>/tokens/verify reports active — check the account endpoint, not the user one.