Edge & DNS tooling
Cloudflare CLI
A coding agent changes DNS, tunnels, Access and zone settings on three domains from its shell, and puts a private app behind its login before the app gets a DNS record.
- 3domains on one account
- 6tunnels, one per group of apps
- 10hostnames, 4 of them behind Access
- 1command tells a revoked token from a blocked IP
What it adds to flarectl
- Zone settings
flarectlRead only
cf.shRead and write
- Tunnels and Access
flarectlNo commands
cf.shAny v4 path the token permits, with cf.sh api
- A refused call
flarectlDoesn't say if the token or the IP filter refused it
cf.shcf.sh check says which one, and prints the fix
For agents and scripts
-
Runs without a shell profile
It reads its own key file, so cron, systemd and agent tool calls work without the key in the command.
-
Exits non-zero on a Cloudflare error
When
successis nottrue, cf.sh exits non-zero with Cloudflare's code and message instead of an empty result. -
Keeps a list of past failures
The skill records past failures, such as a renamed service that answers 502 until its tunnel route is edited too.
Access before DNS
The skill sets this order, so a new private hostname has its login before it has a DNS record.
-
Route the tunnel
Read the stack's tunnel config, add the hostname, write the whole list back.
-
Put Access in front
Create the Access app and check that its policy list is not empty.
-
Add the DNS record
Only then add the proxied CNAME to the tunnel.
-
Check with DNS over HTTPS
Use
curl --doh-url: a local resolver may still hold an earlier 'not found' answer.
Under the hood
- Needs
- bash,
curlandjqagainst the v4 REST API. No SDK. - Commands
check,zones,id,get,set,api- Key file
~/.config/cloudflare/env, mode 600, read when the key is not already set- Auth check
/user/tokens/verify, which IP filters never block, then a real/zonescall to compare- Agent skill
cloudflare, with commands, ordering rules and known failures- Domains
- jonasfoyn.com, hannahelle.com, phemten.com