proxmox/docs/04-configuration/CLOUDFLARE_API_SETUP.md

# Cloudflare API Setup - Quick Start

> Modern note: This guide is still useful for API workflow, but its original RPC target examples came from a pre-standardization mapping. Current RPC tunnel/DNS targets are `rpc-http-pub.d-bis.org` / `rpc-ws-pub.d-bis.org` -> VMID `2201` (`192.168.11.221`) and `rpc-http-prv.d-bis.org` / `rpc-ws-prv.d-bis.org` -> VMID `2101` (`192.168.11.211`). Confirm live values in `docs/04-configuration/RPC_ENDPOINTS_MASTER.md`.

**Last Updated:** 2026-01-31  
**Document Version:** 1.0  
**Status:** Active Documentation

---

## Automated Configuration via API

This will configure both tunnel routes and DNS records automatically using the Cloudflare API.

---

## Step 1: Get Cloudflare API Credentials

### Option A: API Token (Recommended)

1. Go to: https://dash.cloudflare.com/profile/api-tokens
2. Click **Create Token**
3. Use **Edit zone DNS** template OR create custom token with:
   - **Zone** → **DNS** → **Edit**
   - **Account** → **Cloudflare Tunnel** → **Edit**
4. Copy the token

### Option B: Global API Key (Legacy)

1. Go to: https://dash.cloudflare.com/profile/api-tokens
2. Scroll to **API Keys** section
3. Click **View** next to "Global API Key"
4. Copy your Email and Global API Key

---

## Step 2: Set Up Credentials

**Interactive Setup:**
```bash
cd /home/intlc/projects/proxmox
./scripts/setup-cloudflare-env.sh
```

**Or manually create `.env` file:**
```bash
cat > .env <<EOF
CLOUDFLARE_API_TOKEN="your-api-token-here"
DOMAIN="d-bis.org"
TUNNEL_TOKEN="eyJhIjoiNTJhZDU3YTcxNjcxYzVmYzAwOWVkZjA3NDQ2NTgxOTYiLCJ0IjoiMTBhYjIyZGEtOGVhMy00ZTJlLWE4OTYtMjdlY2UyMjExYTA1IiwicyI6IlptRXlOMkkyTVRrdE1EZzFNeTAwTkRBNExXSXhaalF0Wm1KaE5XVmpaVEEzTVdGbCJ9"
EOF

chmod 600 .env
```

---

## Step 3: Run Configuration Script

```bash
cd /home/intlc/projects/proxmox
./scripts/configure-cloudflare-api.sh
```

**What it does:**
1. ✅ Gets zone ID for `d-bis.org`
2. ✅ Gets account ID
3. ✅ Extracts tunnel ID from token
4. ✅ Configures 4 tunnel routes (rpc-http-pub, rpc-ws-pub, rpc-http-prv, rpc-ws-prv)
5. ✅ Creates/updates 4 DNS CNAME records
6. ✅ Enables proxy on all DNS records

---

## What Gets Configured

### Tunnel Routes:
- `rpc-http-pub.d-bis.org` → `https://192.168.11.221:443`
- `rpc-ws-pub.d-bis.org` → `https://192.168.11.221:443`
- `rpc-http-prv.d-bis.org` → `https://192.168.11.211:443`
- `rpc-ws-prv.d-bis.org` → `https://192.168.11.211:443`

### DNS Records:
- All 4 endpoints → CNAME → `<tunnel-id>.cfargotunnel.com` (🟠 Proxied)

---

## Troubleshooting

### "Could not determine account ID"
Add to `.env`:
```
CLOUDFLARE_ACCOUNT_ID="your-account-id"
```

Get account ID from: Cloudflare Dashboard → Right sidebar → Account ID

### "API request failed"
- Verify API token has correct permissions
- Check token is not expired
- Verify domain is in your Cloudflare account

### "Zone not found"
- Verify domain `d-bis.org` is in your Cloudflare account
- Or set `CLOUDFLARE_ZONE_ID` in `.env`

---

## Verify Configuration

After running the script:

1. **Check Tunnel Routes:**
   - Zero Trust → Networks → Tunnels → Your Tunnel → Configure
   - Should see 4 public hostnames

2. **Check DNS Records:**
   - DNS → Records
   - Should see 4 CNAME records (🟠 Proxied)

3. **Test Endpoints:**
   ```bash
   curl https://rpc-http-pub.d-bis.org/health
   ```

---

## Files Created

- `.env` - Your API credentials (keep secure!)
- Scripts are in: `scripts/configure-cloudflare-api.sh`