# Cloudflare and UptimeRobot Manual Completion Checklist

Purpose: execute and record all manual dashboard tasks that cannot be automated from repository workflows.

## Status Legend

- [ ] Pending
- [x] Done

## 1) Cloudflare Pages Link and Build

- [ ] Connect repo to Cloudflare Pages project
- [ ] Build command set to: `cd frontend && npm run build`
- [ ] Output directory set to: `frontend/dist`
- [ ] Production domain attached to `linearvoid.tv`

Evidence to capture:

- Screenshot of Pages deployment settings
- Deployment URL and latest deployment timestamp

## 2) Tiered Cache Enablement and Validation

- [ ] Smart Tiered Cache enabled for zone
- [ ] Warm request made to hot HLS segment
- [ ] Warm request made to live manifest
- [ ] `Cf-Cache-Status: HIT` observed on repeated requests

Validation commands:

```bash
curl -I https://media.linearvoid.tv/hls/playlist.m3u8
curl -I https://media.linearvoid.tv/hls/<segment>.m4s
```

Evidence to capture:

- Headers from first request (expected MISS)
- Headers from repeated request (expected HIT)

## 3) WAF and Bot Protection

- [ ] OWASP Managed Ruleset enabled
- [ ] Mode set to Simulate
- [ ] Simulate mode reviewed for 48h
- [ ] Mode switched to Block after false-positive review
- [ ] Bot Fight Mode enabled

Evidence to capture:

- WAF ruleset status screenshot
- Count of blocked/challenged events after cutover

## 4) Rate Limiting Rules

- [ ] Rule created for `/api/admin/login`
- [ ] Rule created for `/api/admin/*`
- [ ] Threshold set to `10 requests / 10 seconds / IP`
- [ ] Action set to Managed Challenge
- [ ] Rule order validated

Validation approach:

- Use burst requests from a test client and verify challenge behavior without blocking legitimate admin flow.

Evidence to capture:

- Rule definitions screenshot
- Test result notes (challenge seen / no lockout)

## 5) HTTPS and WSS Hardening

- [ ] Always Use HTTPS enabled
- [ ] HSTS enabled with max-age 31536000
- [ ] HSTS includeSubDomains enabled
- [ ] HSTS preload enabled
- [ ] Minimum TLS version set to 1.2+
- [ ] SSL mode verified as Full (strict)
- [ ] WSS endpoint validated through proxy (`wss://linearvoid.tv/ws`)

Validation commands:

```bash
curl -I https://linearvoid.tv
curl -I https://linearvoid.tv/health
```

Evidence to capture:

- Response headers showing HSTS
- Successful browser WebSocket connect in devtools

## 6) UptimeRobot Monitors

- [ ] HTTP monitor added for `https://linearvoid.tv/health` (5m)
- [ ] Keyword monitor added for `https://linearvoid.tv/hls/playlist.m3u8` (keyword `#EXTM3U`, 5m)
- [ ] Alert trigger set to 2 consecutive failures
- [ ] Notification channels configured (email + Discord/Slack webhook)

Evidence to capture:

- Monitor dashboard screenshot
- Test alert delivery confirmation

## 7) Sign-Off

- [ ] Cloudflare manual tasks complete
- [ ] UptimeRobot tasks complete
- [ ] TODO items updated to done
- [ ] Changelog entry added for completion batch

Sign-off fields:

- Owner:
- Date:
- Environment (test-lab or production):
- Notes: