linearvoid/docs/operations/cloudflare-uptimerobot-checklist.md

Cloudflare and UptimeRobot Manual Completion Checklist

Purpose: execute and record all manual dashboard tasks that cannot be automated from repository workflows.

Status Legend

• Pending
• Done

1) Cloudflare Pages Link and Build

• Connect repo to Cloudflare Pages project
• Build command set to: cd frontend && npm run build
• Output directory set to: frontend/dist
• Production domain attached to linearvoid.tv

Evidence to capture:

• Screenshot of Pages deployment settings
• Deployment URL and latest deployment timestamp

2) Tiered Cache Enablement and Validation

• Smart Tiered Cache enabled for zone
• Warm request made to hot HLS segment
• Warm request made to live manifest
• Cf-Cache-Status: HIT observed on repeated requests

Validation commands:

curl -I https://media.linearvoid.tv/hls/playlist.m3u8
curl -I https://media.linearvoid.tv/hls/<segment>.m4s

Evidence to capture:

• Headers from first request (expected MISS)
• Headers from repeated request (expected HIT)

3) WAF and Bot Protection

• OWASP Managed Ruleset enabled
• Mode set to Simulate
• Simulate mode reviewed for 48h
• Mode switched to Block after false-positive review
• Bot Fight Mode enabled

Evidence to capture:

• WAF ruleset status screenshot
• Count of blocked/challenged events after cutover

4) Rate Limiting Rules

• Rule created for /api/admin/login
• Rule created for /api/admin/*
• Threshold set to 10 requests / 10 seconds / IP
• Action set to Managed Challenge
• Rule order validated

Validation approach:

• Use burst requests from a test client and verify challenge behavior without blocking legitimate admin flow.

Evidence to capture:

• Rule definitions screenshot
• Test result notes (challenge seen / no lockout)

5) HTTPS and WSS Hardening

• Always Use HTTPS enabled
• HSTS enabled with max-age 31536000
• HSTS includeSubDomains enabled
• HSTS preload enabled
• Minimum TLS version set to 1.2+
• SSL mode verified as Full (strict)
• WSS endpoint validated through proxy (wss://linearvoid.tv/ws)

Validation commands:

curl -I https://linearvoid.tv
curl -I https://linearvoid.tv/health

Evidence to capture:

• Response headers showing HSTS
• Successful browser WebSocket connect in devtools

6) UptimeRobot Monitors

• HTTP monitor added for https://linearvoid.tv/health (5m)
• Keyword monitor added for https://linearvoid.tv/hls/playlist.m3u8 (keyword #EXTM3U, 5m)
• Alert trigger set to 2 consecutive failures
• Notification channels configured (email + Discord/Slack webhook)

Evidence to capture:

• Monitor dashboard screenshot
• Test alert delivery confirmation

7) Sign-Off

• Cloudflare manual tasks complete
• UptimeRobot tasks complete
• TODO items updated to done
• Changelog entry added for completion batch

Sign-off fields:

• Owner:
• Date:
• Environment (test-lab or production):
• Notes: