Cloudflare DNS/TLS cutover matrix

DNS records, TLS mode, proxy enablement, public smoke checks and rollback are staged as manual operator-only steps. QA performs no Cloudflare API call and touches no production domain.

Cutover statusItems: 7Stages: 6Route checks: 7Cloudflare env names: 3

Staging firsttrue

Health requiredtrue

Route smoke requiredtrue

DNS coveredtrue

TLS coveredtrue

Rollback coveredtrue

No API calltrue

No LAN blocktrue

Stages

preflightItems: 2Required: 2

dnsItems: 1Required: 1

tlsItems: 1Required: 1

proxyItems: 1Required: 1

smokeItems: 1Required: 1

rollbackItems: 1Required: 0

Cutover items

Local release gates are greenpreflight

MUPZA_LOCAL_RELEASE_READINESS_INDEX_QA_SMOKE_V1_PASSRequired before production alias: true

Run local readiness, secret guard and route smoke before touching DNS.

Staging health endpoint passespreflight

mupzaos_staging_health_endpoint_v1Required before production alias: true

Verify HTTPS staging /api/health returns value-free OK before proxying traffic.

Create staging DNS recorddns

Dashboard-only DNS action, no API token in repo.Required before production alias: true

Create a staging A/AAAA or CNAME record manually in Cloudflare dashboard.

Set TLS mode after origin is readytls

TLS setup stays manual and reversible.Required before production alias: true

Use Cloudflare TLS mode only after Nginx/origin health checks pass.

Enable proxy for stagingproxy

Production alias remains untouched.Required before production alias: true

Enable Cloudflare proxy for staging only after health and route smoke pass.

Run public route smokesmoke

7 AWS staging route checks reused.Required before production alias: true

Open public staging routes and confirm value-free health plus POS/operator pages.

Rollback DNS or proxy moderollback

Rollback path required before public DNS trust.Required before production alias: false

Keep previous DNS/proxy state noted so staging cutover can be reverted immediately.