# Cloudflare baseline (TRA)

## Goals

- Proxied DNS (orange cloud) for the public hostname
- TLS full (strict) when origin cert is valid
- Cache static assets under `/build/` and `/fonts/`
- Bypass cache for `/admin`, `/horizon`, `/pulse`, `/health`

## Cache purge

Use the Cloudflare API with an env token (never commit the token):

```bash
# Required env: CLOUDFLARE_ZONE_ID, CLOUDFLARE_API_TOKEN
./scripts/cloudflare-purge.sh
```

## WAF

- Enable managed ruleset
- Rate-limit `/admin/login` at the edge (in addition to app throttle)