124 lines
3.5 KiB
Markdown
124 lines
3.5 KiB
Markdown
# Cloudflare DNS Configuration
|
|
|
|
DNS management for vish.gg and thevish.io domains.
|
|
|
|
## Overview
|
|
|
|
All public-facing services use Cloudflare for:
|
|
- DNS management
|
|
- DDoS protection (orange cloud proxy)
|
|
- SSL/TLS termination
|
|
- Caching
|
|
|
|
## DNS Records - vish.gg
|
|
|
|
### 🟠 Proxied (Orange Cloud) - Protected
|
|
|
|
These domains route through Cloudflare's network, hiding your real IP:
|
|
|
|
| Domain | Service | Host |
|
|
|--------|---------|------|
|
|
| `vish.gg` | Main website | Atlantis |
|
|
| `www.vish.gg` | Main website | Atlantis |
|
|
| `sso.vish.gg` | Authentik SSO | Calypso |
|
|
| `gf.vish.gg` | Grafana | homelab-vm |
|
|
| `git.vish.gg` | Gitea | Calypso |
|
|
| `pw.vish.gg` | Vaultwarden | Atlantis |
|
|
| `ntfy.vish.gg` | Ntfy notifications | homelab-vm |
|
|
| `cal.vish.gg` | Calendar | Atlantis |
|
|
| `mastodon.vish.gg` | Mastodon | Atlantis |
|
|
| `vp.vish.gg` | Piped (YouTube) | Concord NUC |
|
|
| `mx.vish.gg` | Mail proxy | Atlantis |
|
|
|
|
### ⚪ DNS Only (Grey Cloud) - Direct Connection
|
|
|
|
These domains expose your real IP (use only when necessary):
|
|
|
|
| Domain | Reason for DNS-only |
|
|
|--------|---------------------|
|
|
| `*.vish.gg` | Wildcard fallback |
|
|
| `api.vish.gg` | API endpoints (Concord NUC) |
|
|
| `api.vp.vish.gg` | Piped API |
|
|
| `spotify.vish.gg` | Spotify API |
|
|
| `client.spotify.vish.gg` | Spotify client |
|
|
| `in.vish.gg` | Invidious |
|
|
|
|
## DDNS Updaters
|
|
|
|
Dynamic DNS is managed by `favonia/cloudflare-ddns` containers:
|
|
|
|
### Atlantis NAS
|
|
- **Stack**: `dynamicdnsupdater.yaml`
|
|
- **Proxied**: Most vish.gg and thevish.io domains
|
|
- Updates when Atlantis's public IP changes
|
|
|
|
### Calypso NAS
|
|
- **Stack**: `dynamic_dns.yaml`
|
|
- **Proxied**: `sso.vish.gg`, `git.vish.gg`, `gf.vish.gg`
|
|
- Updates when Calypso's public IP changes
|
|
|
|
### Concord NUC
|
|
- **Stack**: `dyndns_updater.yaml`
|
|
- **DNS Only**: API endpoints (require direct connection)
|
|
|
|
## Cloudflare API
|
|
|
|
API token for DDNS: `REDACTED_CLOUDFLARE_TOKEN`
|
|
|
|
### Query DNS Records
|
|
```bash
|
|
curl -s "https://api.cloudflare.com/client/v4/zones/4dbd15d096d71101b7c0c6362b307a66/dns_records" \
|
|
-H "Authorization: Bearer $TOKEN" | jq '.result[] | {name, proxied}'
|
|
```
|
|
|
|
### Enable/Disable Proxy
|
|
```bash
|
|
# Get record ID
|
|
RECORD_ID=$(curl -s "https://api.cloudflare.com/client/v4/zones/ZONE_ID/dns_records?name=example.vish.gg" \
|
|
-H "Authorization: Bearer $TOKEN" | jq -r '.result[0].id')
|
|
|
|
# Enable proxy (orange cloud)
|
|
curl -X PATCH "https://api.cloudflare.com/client/v4/zones/ZONE_ID/dns_records/$RECORD_ID" \
|
|
-H "Authorization: Bearer $TOKEN" \
|
|
-H "Content-Type: application/json" \
|
|
--data '{"proxied":true}'
|
|
```
|
|
|
|
## SSL/TLS Configuration
|
|
|
|
- **Mode**: Full (Strict)
|
|
- **Origin Certificate**: Cloudflare-issued for `*.vish.gg`
|
|
- **Certificate ID**: `lONWNn` (Synology reverse proxy)
|
|
|
|
## Adding New Subdomains
|
|
|
|
1. **Create DNS record** via Cloudflare dashboard or API
|
|
2. **Set proxy status**: Orange cloud for public services
|
|
3. **Update DDNS config** on appropriate host
|
|
4. **Configure reverse proxy** on Synology
|
|
5. **Test connectivity** and SSL
|
|
|
|
## IP Addresses
|
|
|
|
| IP | Location | Services |
|
|
|----|----------|----------|
|
|
| `YOUR_WAN_IP` | Home (Atlantis/Calypso) | Most services |
|
|
| `YOUR_WAN_IP` | Concord NUC | API endpoints |
|
|
| `YOUR_WAN_IP` | VPS | nx, obs, pp, wb |
|
|
|
|
## Troubleshooting
|
|
|
|
### DNS not resolving
|
|
- Check Cloudflare dashboard for propagation
|
|
- Verify DDNS container is running
|
|
- Check API token permissions
|
|
|
|
### SSL errors
|
|
- Ensure Cloudflare SSL mode is "Full (Strict)"
|
|
- Verify origin certificate is valid
|
|
- Check reverse proxy SSL settings
|
|
|
|
### Proxy issues
|
|
- Some services (SSH, non-HTTP) can't use orange cloud
|
|
- APIs may need direct connection for webhooks
|