141 lines
3.9 KiB
Markdown
141 lines
3.9 KiB
Markdown
# Cloudflare and UptimeRobot Manual Completion Checklist
|
|
|
|
Purpose: execute and record all manual dashboard tasks that cannot be automated from repository workflows.
|
|
|
|
Recommended execution order:
|
|
|
|
1. Bind `media.linearvoid.tv` and confirm the HLS origin is separate from the app origin.
|
|
2. Enable Workers, Tiered Cache, and cache behavior for the media zone.
|
|
3. Apply WAF, bot, rate limiting, HTTPS, and HSTS settings.
|
|
4. Verify monitor targets and alert delivery in UptimeRobot.
|
|
5. Capture evidence and fill in the sign-off block.
|
|
|
|
## Status Legend
|
|
|
|
- [ ] Pending
|
|
- [x] Done
|
|
|
|
## 1) Cloudflare Workers Deploy and Custom Domain
|
|
|
|
- [ ] Create a Cloudflare Worker for the SPA and bind the build output
|
|
- [ ] Build command set to: `cd frontend && npm run build`
|
|
- [ ] Output directory set to: `frontend/dist`
|
|
- [ ] Production domain attached to `linearvoid.tv`
|
|
|
|
Evidence to capture:
|
|
|
|
- Screenshot of Worker deployment settings
|
|
- Deployment URL and latest deployment timestamp
|
|
- Confirmed production build output path in the Worker
|
|
|
|
## 2) Tiered Cache Enablement and Validation
|
|
|
|
- [ ] Smart Tiered Cache enabled for zone
|
|
- [ ] Warm request made to hot HLS segment
|
|
- [ ] Warm request made to live manifest
|
|
- [ ] `Cf-Cache-Status: HIT` observed on repeated requests
|
|
|
|
Validation commands:
|
|
|
|
```bash
|
|
curl -I https://media.linearvoid.tv/hls/playlist.m3u8
|
|
curl -I https://media.linearvoid.tv/hls/<segment>.m4s
|
|
```
|
|
|
|
Evidence to capture:
|
|
|
|
- Headers from first request (expected MISS)
|
|
- Headers from repeated request (expected HIT)
|
|
- Screenshot or export showing Smart Tiered Cache enabled
|
|
|
|
## 3) WAF and Bot Protection
|
|
|
|
- [ ] OWASP Managed Ruleset enabled
|
|
- [ ] Mode set to Simulate
|
|
- [ ] Simulate mode reviewed for 48h
|
|
- [ ] Mode switched to Block after false-positive review
|
|
- [ ] Bot Fight Mode enabled
|
|
|
|
Evidence to capture:
|
|
|
|
- WAF ruleset status screenshot
|
|
- Count of blocked/challenged events after cutover
|
|
- Note on any false positives and the final allow/exception rules applied
|
|
|
|
## 4) Rate Limiting Rules
|
|
|
|
- [ ] Rule created for `/api/admin/login`
|
|
- [ ] Rule created for `/api/admin/*`
|
|
- [ ] Threshold set to `10 requests / 10 seconds / IP`
|
|
- [ ] Action set to Managed Challenge
|
|
- [ ] Rule order validated
|
|
|
|
Validation approach:
|
|
|
|
- Use burst requests from a test client and verify challenge behavior without blocking legitimate admin flow.
|
|
|
|
Evidence to capture:
|
|
|
|
- Rule definitions screenshot
|
|
- Test result notes (challenge seen / no lockout)
|
|
- Keep a copy of the test source IP and timestamps used during validation
|
|
|
|
## 5) HTTPS and WSS Hardening
|
|
|
|
- [ ] Always Use HTTPS enabled
|
|
- [ ] HSTS enabled with max-age 31536000
|
|
- [ ] HSTS includeSubDomains enabled
|
|
- [ ] HSTS preload enabled
|
|
- [ ] Minimum TLS version set to 1.2+
|
|
- [ ] SSL mode verified as Full (strict)
|
|
- [ ] WSS endpoint validated through proxy (`wss://linearvoid.tv/ws`)
|
|
|
|
Validation commands:
|
|
|
|
```bash
|
|
curl -I https://linearvoid.tv
|
|
curl -I https://linearvoid.tv/health
|
|
```
|
|
|
|
Evidence to capture:
|
|
|
|
- Response headers showing HSTS
|
|
- Successful browser WebSocket connect in devtools
|
|
- TLS mode screenshot from Cloudflare showing Full (strict)
|
|
|
|
## 6) UptimeRobot Monitors
|
|
|
|
- [ ] HTTP monitor added for `https://linearvoid.tv/health` (5m)
|
|
- [ ] Keyword monitor added for `https://linearvoid.tv/hls/playlist.m3u8` (keyword `#EXTM3U`, 5m)
|
|
- [ ] Alert trigger set to 2 consecutive failures
|
|
- [ ] Notification channels configured (email + Discord/Slack webhook)
|
|
|
|
Evidence to capture:
|
|
|
|
- Monitor dashboard screenshot
|
|
- Test alert delivery confirmation
|
|
- List of recipients/webhook destinations verified during the alert test
|
|
|
|
## 7) Sign-Off
|
|
|
|
- [ ] Cloudflare manual tasks complete
|
|
- [ ] UptimeRobot tasks complete
|
|
- [ ] TODO items updated to done
|
|
- [ ] Changelog entry added for completion batch
|
|
|
|
Completion summary:
|
|
|
|
- Worker build URL:
|
|
- Cache validation result:
|
|
- WAF/rate-limit status:
|
|
- HTTPS/HSTS status:
|
|
- UptimeRobot monitor status:
|
|
- Evidence folder or note link:
|
|
|
|
Sign-off fields:
|
|
|
|
- Owner:
|
|
- Date:
|
|
- Environment (test-lab or production):
|
|
- Notes:
|