Skip to content

Cloudflare

Purpose

Document the Cloudflare-managed DNS, zone security, and R2 object storage this project's Terraform provisions - and draw a hard line around what this documentation portal is allowed to touch.

Resources, by module

Module Resource Applied by Purpose
cloudflare-dns cloudflare_record staging, production, (dev, unapplied) Proxied A record(s) pointing at the shared K3s node's public IP (read from platform's state, never a node the DNS root itself creates) - 1 record for staging, 2 for production (apex + www)
cloudflare-security cloudflare_zone_settings_override production only (manage_zone_settings) Zone-wide SSL/TLS + WAF settings - applied once per zone, so only one environment root should own it or two applies would fight over the same zone
cloudflare-r2 cloudflare_r2_bucket staging, production, (dev, unapplied) One media bucket per environment; a separate backup bucket exists too (see Operations → Backup)

R2 access keys are a manual step, deliberately

R2 access key ID/secret are not a Terraform resource attribute anywhere in this project - generated by hand in the Cloudflare dashboard after terraform apply creates the bucket, and go directly into the Kubernetes Secret (backend.existingSecretName - see Kubernetes → Helm), never into Terraform state or a Terraform output.

Hostname-based routing, not per-environment IPs

Every environment's DNS record points at the same shared K3s node public IP - Traefik (K3s's bundled Ingress controller) routes purely on the incoming Host header, so staging's and production's Ingress objects (in separate namespaces) coexist on one node/IP without conflict, as long as their hostnames differ (they always do). See Kubernetes → Ingress.

What this portal will never do

  • Modify akshayathreadworld.in's production DNS records.
  • Modify any existing production Cloudflare Worker or application route.
  • Attach a custom domain to anything without your explicit, separate approval.
  • Guess at or select a Cloudflare account without confirming with you first.

Any Cloudflare Pages work for this documentation portal itself is a brand-new, separate Pages project (akshaya-devops) - see the Cloudflare Pages preparation notes in this portal's own change history. It never touches akshayathreadworld.in or any existing Worker/route.