Files

Даня Архипов 060971da75 docs: re-verify production identity and domain cutover status

Co-authored-by: Cursor <cursoragent@cursor.com>

2026-07-16 08:43:37 +00:00

3.1 KiB

Raw Blame History

CLOUDFLARE_NAMED_TUNNEL_SETUP

Goal

Постоянный HTTPS для arhipovdan.ru / www.arhipovdan.ru → production http://127.0.0.1:3100 (owl-web-1), без открытия 80/443 на OwlPrime.

Quick Tunnel (*.trycloudflare.com) сохранять до полного PASS постоянного домена.

Architecture choice

REG.RU = registrar only
Cloudflare = authoritative DNS + Named Tunnel + managed TLS

Current blocker in this environment

cloudflared tunnel list → no origin cert (cert.pem)
CLOUDFLARE_API_TOKEN → unset

Named Tunnel нельзя создать/привязать DNS из coder без cloudflared login или API token.

Recommended tunnel name

owlprime-sorter-production

Config template (do not commit credentials)

Path suggestion (host, outside git):

~/.cloudflared/config.yml
~/.cloudflared/<TUNNEL_UUID>.json   # credentials — chmod 600

tunnel: <TUNNEL_UUID>
credentials-file: /home/<user>/.cloudflared/<TUNNEL_UUID>.json

ingress:
  - hostname: arhipovdan.ru
    service: http://127.0.0.1:3100
  - hostname: www.arhipovdan.ru
    service: http://127.0.0.1:3100
  - service: http_status:404

Service target assumes cloudflared on host network namespace with publish 127.0.0.1:3100 (current). If cloudflared runs in Docker, use http://host.docker.internal:3100 or shared network alias http://owl-web-1:80 — never a ephemeral container IP.

Operator steps (when Cloudflare access available)

cloudflared login (or set API token with Tunnel + Zone DNS edit).
cloudflared tunnel list — reuse existing sorter tunnel if present.
Else: cloudflared tunnel create owlprime-sorter-production
Write config (template above). Validate: cloudflared tunnel ingress validate
Run connector (systemd preferred): cloudflared tunnel run owlprime-sorter-production
Add domain to Cloudflare → note exact assigned nameservers.
Import all DNS from DNS_MIGRATION_INVENTORY.md / REG.RU panel.
Create public hostnames / cloudflared tunnel route dns <tunnel> arhipovdan.ru (+ www).
Remove conflicting A 185.160.137.162 for apex/www in Cloudflare zone.
Only then change NS at REG.RU.
Keep Quick Tunnel until:

curl -s https://arhipovdan.ru/version.json
# expected commit from production
PLAYWRIGHT_BASE_URL=https://arhipovdan.ru EXPECTED_COMMIT=<sha> npm run test:e2e:production

Coexistence with Quick Tunnel

Process	Role
`cloudflared tunnel --url http://127.0.0.1:3100`	Temporary public URL
Named Tunnel connector	Permanent hostnames (after CF zone)

They can run in parallel; different Cloudflare edge bindings.

Secrets policy

Never commit:

*.json credentials
cert.pem
API tokens
tunnel tokens in systemd unit Environment=

Status (2026-07-16)

Named Tunnel created: NO (auth missing — no cert.pem / CLOUDFLARE_API_TOKEN)
Ingress prepared as docs: YES
Connector healthy: N/A
DNS route: N/A
NS cutover: WAITING_USER — Cloudflare nameservers not assigned yet
Quick Tunnel: KEEP RUNNING until permanent HTTPS PASS

3.1 KiB Raw Blame History