Cloudflare Setup
Live inventory of the Cloudflare account — DNS, Pages, Workers, KV, D1 — reconciled against wrangler configs and deploy scripts.
Everything customer-facing is fronted by one Cloudflare account. This page was built from a live read-only query of the account (via the Cloudflare MCP) reconciled against the repo's wrangler configs and CI workflows.
Account: Vinglobal2026@gmail.com's Account · ID 285737ee5f719cb8bfbb037e4614bec4 · plan Free. Zone: octopuscards.io (8718c9d3d2679e723fa7f1417513275f), nameservers jocelyn/lennon.ns.cloudflare.com, registrar GoDaddy. Snapshot taken 2026-07-23.
DNS records
The two apex A-record IPs are the whole origin story: 65.109.119.112 = PROD, 94.130.137.222 = SANDBOX + telemetry.
| Record | Type | Target | Proxied | What it is |
|---|---|---|---|---|
api.octopuscards.io | A | 65.109.119.112 | ✅ | PROD Go API |
app.octopuscards.io | A | 65.109.119.112 | ✅ | PROD client portal |
warden.octopuscards.io | A | 65.109.119.112 | ✅ | PROD admin UI |
sandbox-api.octopuscards.io | A | 94.130.137.222 | ✅ | SANDBOX API |
sandbox-app.octopuscards.io | A | 94.130.137.222 | ✅ | SANDBOX client |
sandbox-warden.octopuscards.io | A | 94.130.137.222 | ✅ | SANDBOX admin |
telemetry.octopuscards.io | A | 94.130.137.222 | ✅ | SigNoz UI (→ :8080) |
otel.octopuscards.io | A | 94.130.137.222 | ✅ | OTLP ingest (→ :4318) |
octopuscards.io, www | CNAME | octopus-website-8ce.pages.dev | ✅ | Marketing site (Pages) |
developer.octopuscards.io | CNAME | octopus-docs.pages.dev | ✅ | Developer docs (Pages) |
claim.octopuscards.io | AAAA 100:: | (Worker route) | ✅ | Grasshopper claim worker |
sandbox-claim.octopuscards.io | AAAA 100:: | (Worker route) | ✅ | Grasshopper sandbox worker |
mocky-balboa.octopuscards.io | AAAA 100:: | (Worker route) | ✅ | Mock API worker |
Email (Google Workspace + SendGrid)
MX → smtp.google.com (Google Workspace). SendGrid handles transactional/marketing mail: CNAMEs em8947, s1/s2._domainkey, url1147, 106188436 → sendgrid.net. DMARC is p=quarantine; Google DKIM present. Keep these when touching DNS or deliverability breaks.
Cloudflare Pages (2 projects)
| Project | Production domains | Repo source | Build |
|---|---|---|---|
| octopus-website | octopuscards.io, www.octopuscards.io (+ octopus-website-8ce.pages.dev) | frontend/octopus-website | GHA → wrangler pages deploy out |
| octopus-docs | developer.octopuscards.io (+ octopus-docs.pages.dev) | frontend/octopus-docs | GHA → wrangler pages deploy out |
Both are static Next.js exports (output: 'export'), production branch master, uses_functions: false. Deploys are CLI-driven from CI (no Pages Git integration, no wrangler.toml) — deploy-octopus-website.yml / deploy-octopus-docs.yml build with bun and push out/.
Cloudflare Workers (3 scripts)
| Worker | Route | Source | Bindings |
|---|---|---|---|
| grasshopper | claim.octopuscards.io/* | frontend/grasshopper | D1 DB→grasshopper, KV octopus_token, 5 rate-limiters, Turnstile/OTel vars, secrets |
| grasshopper-sandbox | sandbox-claim.octopuscards.io/* | same (--env sandbox) | D1 grasshopper_sandbox, KV octopus_token_sandbox, isolated rate-limiters |
| mocky-balboa | (no route; *.workers.dev / mocky-balboa.octopuscards.io) | frontend/mocky-balboa | D1 DB→mocky |
All use nodejs_compat, workers_dev: false for grasshopper (custom routes only), last deployed from wrangler via GHA. Deploy workflows apply remote D1 migrations before wrangler deploy.
KV namespaces
| Namespace | ID | Used by |
|---|---|---|
octopus_token | baef37073e854a2386877d34c379c265 | grasshopper (prod) — caches the Octopus JWT to cut /auth/login fan-out |
octopus_token_sandbox | da808b8fe6774da893745dd1dc64b57c | grasshopper-sandbox |
D1 databases
The MCP token in use lacked D1/R2 read scope, so these IDs come from the repo's wrangler configs (reconciled, not live-verified). If you need to manage them, use a token with D1 permissions or the dashboard.
| Database | ID | Binding | Owner |
|---|---|---|---|
grasshopper | d99ec4a1-5833-48ca-8eb6-49568a13d5fd | DB | grasshopper (prod) |
grasshopper_sandbox | d0f8b860-… (see wrangler.jsonc) | DB | grasshopper-sandbox |
mocky | 6dad79fb-db2d-43df-b6eb-96d27b34b89e | DB | mocky-balboa |
Grasshopper's D1 denormalizes some Octopus catalog data (octopus_voucher_product_id, etc.) but is an independent store with its own Drizzle migration lifecycle in frontend/grasshopper/drizzle/migrations/. Apply with bunx wrangler d1 migrations apply grasshopper [--remote|--local].
Caching & TLS posture
- Edge caching is centralized in the Cloudflare dashboard (Cache Rules), not in nginx — the origin nginx is a dumb pass-through for the proxied hosts. Tune caching in the CF dashboard so it stays in one place.
- All customer-facing records are proxied (orange cloud), so origin IPs are hidden behind Cloudflare and TLS terminates at the edge; origin certs are Let's Encrypt via certbot.
- Certbot HTTP-01 caveat: grey-cloud a record temporarily to issue/renew an origin cert (see Infrastructure).
R2
R2 is not enabled on this account (the API returns "enable R2 in the dashboard"). No buckets are in use.
Managing Cloudflare going forward
- Programmatic: CI uses
CLOUDFLARE_API_TOKEN+CLOUDFLARE_ACCOUNT_IDsecrets; locally,bunx wrangler ...from eachfrontend/<app>dir. - Read-only introspection (what built this page) is available via the Cloudflare MCP — handy for auditing live state vs.
wranglerconfig drift. Grant the token D1/R2 scopes if you need those enumerated too.
Metrics & Tracing
The OpenTelemetry → SigNoz observability catalog — every custom metric with its type/unit/attributes, the tracing conventions, log fields, the export pipeline, and the dimension-compliance gaps and dead metrics.
Secrets & Configuration
Where every credential, secret, and config value lives across the platform — and how to rotate each one.