Cloudflare

Connect Cloudflare with a scoped API token so the agent can see a client's DNS records, proxying, SSL/TLS and security events, and propose the exact records to add or change.

In the appPlatformSettingsDomains and websitesCloudflare

Connect Cloudflare so the agent can see how a client's domains are set up there. When a problem comes down to DNS, HTTPS or a visitor being blocked, the agent can tell from what it sees. When a missing or wrong record is the cause, it proposes the exact record. Nothing changes until a person approves it.

A platform can have GoDaddy, Cloudflare or both, for different domains. Each domain is at one host only.

Make the token#

Use an API token. Never use the Global API Key: it opens the whole Cloudflare account, and we refuse it.

1
At Cloudflare, open My Profile › API Tokens and click Create Token. Choose Create Custom Token.
2
Name it so you know what it's for, such as Cerberius Agents (read).
3
Add the permissions in the table below. Each line is three choices: Zone, then the item, then Read or Edit.
4
Under Zone Resources, choose Include › Specific zone and pick each domain the agent should see. Add a line for each domain. Don't choose All zones.
5
Create the token and copy it. Cloudflare shows it only once.

Permission	What the agent gets	Needed?
Zone › Zone › Read	Finds the domain, its status and its name servers	Yes
Zone › DNS › Read	The DNS records, and whether each goes through Cloudflare's proxy	Yes
Zone › Zone Settings › Read	The SSL/TLS mode (Off, Flexible, Full or Full (strict))	Recommended
Zone › SSL and Certificates › Read	The edge certificates: their status, names and expiry	Recommended
Zone › Analytics › Read	Security events from the last day: blocks and challenges	Recommended
Zone › DNS › Edit	Lets an approved change add, set or remove records	Only if you allow DNS changes

Without a recommended permission the agent sees less, and Check connection says which one is missing.

Connect it#

1
Here, go to Settings › Domains and websites. Click Connect a domain host (or Connect another, if GoDaddy is already there), and choose Cloudflare.
2
Under API token, click Add Cloudflare token… and paste it.
3
Under Domains, list the domains this platform may use, one per line. Click Save.
4
Click Check connection. It shows whether the token works, how many records each domain has, the SSL/TLS mode, and which permissions the token lacks.
5
To let the agent propose changes, switch on DNS changes under Settings › Approved changes, and give the token Zone › DNS › Edit.

Only the domains you list

A token may see more domains than the ones you list, for example when it was made for All zones. Cerberius Agents only ever reads or changes the domains you list under Domains. Any other domain is refused, even if the agent asks for it.

A domain listed under GoDaddy can't also be listed under Cloudflare. Remove it from one first.

Check connection can't tell whether the token has Zone › DNS › Edit without changing something, so it doesn't try. If the permission is missing, the first approved change fails and says so. Nothing is changed.

What the agent sees#

At the start of each run, the agent gets for each domain:

The zone: whether it is active or paused, and Cloudflare's name servers for it.
The DNS records, up to 200, and whether each A, AAAA and CNAME record is proxied (through Cloudflare, the orange cloud) or DNS only.
The SSL/TLS mode, which decides how Cloudflare reaches the website's own server. Flexible uses plain HTTP, a common cause of redirect loops.
The edge certificates: their status, the names they cover, and when they expire.
Security events from the last day, up to 20: what Cloudflare blocked or challenged, when, for which address, and from which IP and country. This helps when a requester says they are blocked.

It never gets the token. A record changed at Cloudflare only counts if the domain's name servers are Cloudflare's. The agent checks that first.

Changes#

A DNS change shows on the ticket as Change DNS at Cloudflare, with each record listed:

What it says	What happens
Add a record	The record is added next to the ones already there. If the same record is already there, nothing changes.
Set a record	Every record of that type and name becomes exactly the values listed.
Remove every record	Every record of that type and name is removed.

Each A, AAAA or CNAME record also says (proxied), (DNS only) or (proxy as it is now). A new record is DNS only unless the change says otherwise. Setting a record without saying keeps the proxy as it was. A proxied record's TTL is always automatic.

When a person approves it:

Cerberius Agents reads the records it touches. If one can't be read, nothing changes.
It makes the records in order, and stops at the first one Cloudflare refuses. The ticket says what was there before and what was done.
The agent checks the result and drafts the reply to the requester.

Only A, AAAA, CNAME, MX and TXT records can change. Name server (NS) and SOA records never change. One change is made at one host: records at GoDaddy and at Cloudflare are proposed as separate changes.

The agent never changes Cloudflare's own settings: not SSL/TLS, firewall rules or caching. If one of those is the fix, it says so in its findings for a person to make.

If your platform asks two people to approve DNS changes, that applies here too. See Allowing changes.

With your own runner#

When the agent runs on your own runner, the Cloudflare token is kept by you, like your other keys. The domains stay in these settings.

Save the domains first. Then choose how the token is kept: Scrambled for your runner (paste it: your browser scrambles it so only your runner can unscramble it) or In your store (named cloudflare-token). See Two ways to keep your keys.
Your runner reads the domains for each run and gives the agent the same information. Check connection is made by your runner too.
Approved changes are made by your runner, under the same rules as GoDaddy's: the dns section of its rules. It needs dns.domains, removes records only with delete: true, and asks for as many people as min_approvers says. See Microsoft 365, Google and domains.
Your runner sends the token only to Cloudflare's API (api.cloudflare.com), whatever it is asked. It needs version 0.9.0 or later. An older runner tells the agent to update it, and a change waits, then fails saying so.