linearvoid/docs/operations/cloudflare-uptimerobot-checklist.md

Cloudflare and UptimeRobot Manual Completion Checklist

Purpose: execute and record all manual dashboard tasks that cannot be automated from repository workflows.

Recommended execution order:

1. Bind media.linearvoid.tv and confirm the HLS origin is separate from the app origin.
2. Enable Workers, Tiered Cache, and cache behavior for the media zone.
3. Apply WAF, bot, rate limiting, HTTPS, and HSTS settings.
4. Verify monitor targets and alert delivery in UptimeRobot.
5. Capture evidence and fill in the sign-off block.

Status Legend

• Pending
• Done

1) Cloudflare Workers Deploy and Custom Domain

• Create a Cloudflare Worker for the SPA and bind the build output
• Build command set to: cd frontend && npm run build
• Output directory set to: frontend/dist
• Production domain attached to linearvoid.tv

Evidence to capture:

• Screenshot of Worker deployment settings
• Deployment URL and latest deployment timestamp
• Confirmed production build output path in the Worker

2) Tiered Cache Enablement and Validation

• Smart Tiered Cache enabled for zone
• Warm request made to hot HLS segment
• Warm request made to live manifest
• Cf-Cache-Status: HIT observed on repeated requests

Validation commands:

curl -I https://media.linearvoid.tv/hls/playlist.m3u8
curl -I https://media.linearvoid.tv/hls/<segment>.m4s

Evidence to capture:

• Headers from first request (expected MISS)
• Headers from repeated request (expected HIT)
• Screenshot or export showing Smart Tiered Cache enabled

3) WAF and Bot Protection

• OWASP Managed Ruleset enabled
• Mode set to Simulate
• Simulate mode reviewed for 48h
• Mode switched to Block after false-positive review
• Bot Fight Mode enabled

Evidence to capture:

• WAF ruleset status screenshot
• Count of blocked/challenged events after cutover
• Note on any false positives and the final allow/exception rules applied

4) Rate Limiting Rules

• Rule created for /api/admin/login
• Rule created for /api/admin/*
• Threshold set to 10 requests / 10 seconds / IP
• Action set to Managed Challenge
• Rule order validated

Validation approach:

• Use burst requests from a test client and verify challenge behavior without blocking legitimate admin flow.

Evidence to capture:

• Rule definitions screenshot
• Test result notes (challenge seen / no lockout)
• Keep a copy of the test source IP and timestamps used during validation

5) HTTPS and WSS Hardening

• Always Use HTTPS enabled
• HSTS enabled with max-age 31536000
• HSTS includeSubDomains enabled
• HSTS preload enabled
• Minimum TLS version set to 1.2+
• SSL mode verified as Full (strict)
• WSS endpoint validated through proxy (wss://linearvoid.tv/ws)

Validation commands:

curl -I https://linearvoid.tv
curl -I https://linearvoid.tv/health

Evidence to capture:

• Response headers showing HSTS
• Successful browser WebSocket connect in devtools
• TLS mode screenshot from Cloudflare showing Full (strict)

6) UptimeRobot Monitors

• HTTP monitor added for https://linearvoid.tv/health (5m)
• Keyword monitor added for https://linearvoid.tv/hls/playlist.m3u8 (keyword #EXTM3U, 5m)
• Alert trigger set to 2 consecutive failures
• Notification channels configured (email + Discord/Slack webhook)

Evidence to capture:

• Monitor dashboard screenshot
• Test alert delivery confirmation
• List of recipients/webhook destinations verified during the alert test

7) Sign-Off

• Cloudflare manual tasks complete
• UptimeRobot tasks complete
• TODO items updated to done
• Changelog entry added for completion batch

Completion summary:

• Worker build URL:
• Cache validation result:
• WAF/rate-limit status:
• HTTPS/HSTS status:
• UptimeRobot monitor status:
• Evidence folder or note link:

Sign-off fields:

• Owner:
• Date:
• Environment (test-lab or production):
• Notes: