# Cloudflare configuration for YourStories

## DNS

Staging:

```text
A  staging  → CPANEL_ORIGIN_IP
```

Production:

```text
A      @    → CPANEL_ORIGIN_IP
CNAME  www  → yourstories.life
```

## TLS

Use **Full (strict)** only after the cPanel origin certificate is valid for the exact hostname.

## Cache rules

### Rule 1 — bypass private and dynamic routes

Expression concept:

```text
(http.request.uri.path starts_with "/api/") or
(http.request.uri.path starts_with "/q/") or
(http.request.uri.path starts_with "/connect/") or
(http.request.uri.path starts_with "/access/") or
(http.request.uri.path starts_with "/login") or
(http.request.uri.path starts_with "/onboarding") or
(http.request.uri.path starts_with "/dashboard/") or
(http.request.uri.path starts_with "/admin/") or
(http.request.uri.path starts_with "/story/")
```

Action: **Bypass cache**.

### Rule 2 — normal static caching

Allow normal cache behaviour for:

```text
/_next/static/*
/assets/*
```

Do not use a global Cache Everything rule.

## Turnstile

Use exact hostname restrictions and verify tokens server-side. A client-side green tick alone is not sufficient.

## R2

- Private bucket for originals
- Bucket-scoped API token
- CORS exact origins only
- Presigned PUT from browser
- Presigned GET for temporary private display
- No credentials in `NEXT_PUBLIC_*` variables