# Cloudflare

All DNS zones managed through Cloudflare. Provides DNS, CDN proxying, SSL, and WAF.

## Account

- Account email: Kentsteve@hotmail.com
- Account ID: 3b9022223ff5a6ea1018b3645324dbea
- Zones: kaburu.co and all client domains

## API Token

**IMPORTANT:** Must use a USER-scoped token (dash.cloudflare.com/profile/api-tokens)
NOT an account-scoped token. Account tokens cannot edit zones owned by the user profile.

Token name: Hermes-CARO-cfut
File: /root/.secrets/cloudflare (kaburusvr)
IP lock: 49.13.202.144 AND 2a01:4f8:1c18:91ab::1 (both IPv4 and IPv6 required)
Permissions: Account WAF:Edit, Account Rulesets:Edit, Firewall Services:Edit, DNS:Edit, Zone:Edit, Zone Settings:Edit, Cache Rules:Edit, Config Rules:Edit

⚠️ **Do NOT confuse with the "Hermes" token** (DNS-only, no WAF/firewall perms). The correct token name is **Hermes-CARO-cfut**.

The legacy IP Access Rules API (`/firewall/access_rules/rules`) returns 403 even with this token.
Use the **WAF custom rules** endpoint instead:
```bash
curl -s -X PUT "https://api.cloudflare.com/client/v4/zones/$ZONE_ID/rulesets/phases/http_request_firewall_custom/entrypoint" \
  -H "Authorization: Bearer $CF_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"rules":[{"action":"block","expression":"(ip.src eq X.X.X.X)","description":"reason"}]}'
```

Verify token:
```bash
curl -s -X GET "https://api.cloudflare.com/client/v4/accounts/ACCOUNT_ID/tokens/verify" \
  -H "Authorization: Bearer TOKEN"
```

## DNS update procedure

```bash
CF_TOKEN="TOKEN"
ZONE_ID="zone-id-from-api"
SERVER_IP="49.13.202.144"

# Get zone ID
curl -s "https://api.cloudflare.com/client/v4/zones?name=domain.com" \
  -H "Authorization: Bearer $CF_TOKEN"

# Update A record
curl -s -X PATCH "https://api.cloudflare.com/client/v4/zones/ZONE_ID/dns_records/RECORD_ID" \
  -H "Authorization: Bearer $CF_TOKEN" \
  -H "Content-Type: application/json" \
  --data '{"content":"IP_ADDRESS"}'
```

## Known quirks

- kaburusvr connects over IPv6 — CF token MUST have IPv6 address in IP filter
- Account API tokens (cfat_) vs user API tokens (cfut_) are different — zones need user tokens
- Cloudflare proxying (orange cloud) means SSL cert on origin can be self-signed initially
- After DNS cutover, re-issue SSL via CyberPanel for proper Let's Encrypt cert

## ⚠️ CRITICAL: Do NOT use Page Rules for WordPress caching

Cache Everything page rules with wp-admin/wp-login bypass are **dangerous and broken**.
The bypass rules don't catch AJAX, REST API, or other admin endpoints — cached admin sessions
get served to other visitors, exposing full admin access.

**Instead:**
- Rely on LiteSpeed cache + Redis at the origin for WordPress caching
- If you need edge caching, use Cloudflare Cache Rules (new UI), not Page Rules
- Cache Rules support negative conditions (match everything EXCEPT admin paths) which actually work
- Page Rules are deprecated by Cloudflare and should be avoided for new configurations

**Cleanup history:** 78 Page Rules deleted across 26 zones on 2026-06-21.

## UK-Only Geo-Blocking (2026-08-20)

**Applied to:** 21 zones via CF WAF custom rulesets API
**Excluded (global access):** jafricasafari, womenunlimited, myretonmarquees, ggsgenerators, l8waterhygiene (owner in Spain), kaburu.cc/casa/xyz, kaburusvr.uk, rvweb.co.uk

**Rule logic:**
- **Rule 1 (skip):** All non-browser traffic passes through: WP API paths (`/wp-json/`, `/wc-api/`, `/wp-admin/`, `/wp-login.php`, `/admin-ajax.php`, `/wp-cron.php`, `/xmlrpc.php`, `/wp-content/`), bots (Google, Bing, Baidu, UptimeRobot, Wordfence, ShortPixel, FastPixel, Ahrefs, RankMath, Rankwatch), server IP (49.13.202.144)
- **Rule 2 (managed_challenge):** Non-UK browsers get Cloudflare CAPTCHA

**Effect:** Real browser page views from outside UK get challenged. All API/webhook/plugin/bot traffic passes through regardless of origin. Catches AI scrapers (ChatGPT, Anthropic) disguised as browsers.

**To add more zones:** Edit `/tmp/cf-geoblock-update.py` on kaburusvr (EXCLUDED_ZONES set), run `python3 /tmp/cf-geoblock-update.py`

**To add more bots/paths:** Edit BOT_EXPRESSION in the script, run update on all zones