iansteitz1-eng cloudflare-dns-deploy
YAML → Cloudflare DNS → nginx → certbot, in one command.
When to use
- New subdomain launches (replaces dashboard click + SSH + nginx + certbot dance)
- DNS audits (
--dry-runshows drift between YAML and live) - Multi-zone management (one YAML covers all your zones)
- Pruning stale records (
--prunedeletes A/AAAA/CNAME/TXT/MX not in YAML)
How it works
- Reads
dns_records.yaml - For each zone, lists current Cloudflare records
- For each declared record: matches by (zone, type, name). Creates if absent; patches if drift in content/TTL/proxied.
- With
--server-setup: waits for DNS propagation, enables nginx site, runs certbot, verifies HTTPS.
Env vars required
| Var | Required for | Notes |
|---|---|---|
CLOUDFLARE_API_TOKEN |
all | Scoped Token (Zone:Read + DNS:Edit on target zones) |
Token creation: dash.cloudflare.com → My Profile → API Tokens → Create Token → "Edit zone DNS" template.
Safety
- Default is dry-run. No API write until
--apply. - Doesn't delete by default.
--pruneis the explicit opt-in to remove records. - Server-setup is opt-in. Default
--applyonly touches Cloudflare; you don't accidentally invoke certbot. - Cert renewal stays under certbot.timer — this skill issues; renewal is automatic via the system service.
Hosted version
Vox Ordo runs this with:
- Multi-zone team management
- Scheduled drift checks (alerts on manual dashboard changes)
- Approval workflow for
--pruneand--server-setup - Free tier · BYOK · no credit card
License
Apache 2.0