Shipping a static site to Cloudflare

Part 2 — Deployment playbook

2.0 — Inputs and ground rules

• Shell state does not persist between tool calls — re-export the credentials in every command.
• Never print the token. Read it into a variable with tr -d to strip the trailing newline.
• Verify every step with a real request. Do not report success from an API response alone.

export CLOUDFLARE_API_TOKEN=$(tr -d ' \t\r\n' < ~/.ssh/CF_TOKEN)
export CLOUDFLARE_ACCOUNT_ID=70a939330833ed084613ded7287a7d8d
export DOMAIN=example.com
export PROJECT=example-site

2.1 — Verify the token

npx wrangler whoami

Expect the account name and ID.

2.2 — Unpack the site and isolate what ships

mkdir -p site && unzip -o site.zip -d site
find site -type f | head -50

Establish a public/ directory holding only what should be world-readable. Move the site files there.

Check the HTML uses relative paths (href="styles.css"), not root-absolute ones (href="/styles.css"). Absolute paths work on a server but break when the file is opened directly from disk.

2.3 — Make sure the domain is a zone

List zones first; the domain may already be there.

curl -s -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN" \
  "https://api.cloudflare.com/client/v4/zones?name=$DOMAIN"

If it is absent, create it. This needs Zone Write:

curl -s -X POST \
  -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN" \
  -H "Content-Type: application/json" \
  --data "{\"name\":\"$DOMAIN\",\"account\":{\"id\":\"$CLOUDFLARE_ACCOUNT_ID\"},\"type\":\"full\"}" \
  "https://api.cloudflare.com/client/v4/zones"

The response carries name_servers and original_name_servers. Record both. The first pair is what the user must set at their registrar in Part 3; the second tells you who currently runs their DNS.

2.4 — Preserve existing DNS before anything switches

Check what Cloudflare actually imported:

curl -s -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN" \
  "https://api.cloudflare.com/client/v4/zones/$ZONE_ID/dns_records?per_page=100"

Then query the real records straight from the current authoritative nameserver, taken from original_name_servers:

for t in A AAAA MX TXT CNAME NS; do
  echo "== $t =="
  nslookup -type=$t $DOMAIN ns.theircurrentprovider.com
done
nslookup -type=A www.$DOMAIN ns.theircurrentprovider.com

Recreate anything missing, especially MX and TXT. Replicate faithfully — same values, proxied: false — so the nameserver switch changes nothing:

curl -s -X POST \
  -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN" \
  -H "Content-Type: application/json" \
  --data '{"type":"MX","name":"example.com","content":"mail.host.com","priority":10,"ttl":1,"proxied":false}' \
  "https://api.cloudflare.com/client/v4/zones/$ZONE_ID/dns_records"

2.5 — Create the Pages project and deploy

npx wrangler pages project create $PROJECT --production-branch=main
npx wrangler pages deploy public --project-name=$PROJECT --branch=main --commit-dirty=true

Expect Success! Uploaded N files and a live <project>.pages.dev URL. A fatal: ambiguous argument 'HEAD' line is git complaining about a repository with no commits. Harmless.

2.6 — Attach the custom domains

There is no wrangler pages domain command. Use the API. Needs Pages Write.

for d in $DOMAIN www.$DOMAIN; do
  curl -s -X POST \
    -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN" \
    -H "Content-Type: application/json" \
    --data "{\"name\":\"$d\"}" \
    "https://api.cloudflare.com/client/v4/accounts/$CLOUDFLARE_ACCOUNT_ID/pages/projects/$PROJECT/domains"
done

Each returns status: initializing.

2.7 — Point DNS at the deployment

Only once the site should go live. Needs DNS Write.

for n in $DOMAIN www.$DOMAIN; do
  curl -s -X POST \
    -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN" \
    -H "Content-Type: application/json" \
    --data "{\"type\":\"CNAME\",\"name\":\"$n\",\"content\":\"$PROJECT.pages.dev\",\"ttl\":1,\"proxied\":true}" \
    "https://api.cloudflare.com/client/v4/zones/$ZONE_ID/dns_records"
done

The apex works as a CNAME only because Cloudflare flattens it. proxied: true is required for that.

2.8 — Wait for certificates, then verify properly

curl -s -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN" \
  "https://api.cloudflare.com/client/v4/accounts/$CLOUDFLARE_ACCOUNT_ID/pages/projects/$PROJECT/domains"

Poll until both read status=active. Roughly 90 seconds after DNS resolves. Nothing needs to be done about certificates — Cloudflare issues and renews them itself.

# HTTP status
for u in https://$DOMAIN/ https://www.$DOMAIN/; do
  curl -s -o /dev/null -w "%{http_code} %{content_type}  $u\n" "$u"
done

# HTTP -> HTTPS redirect
curl -s -o /dev/null -w '%{http_code} -> %{redirect_url}\n' http://$DOMAIN/

# certificate
echo | openssl s_client -connect $DOMAIN:443 -servername $DOMAIN 2>/dev/null \
  | openssl x509 -noout -subject -issuer -dates

Finally, open the site in a browser and look at it. A 200 response does not prove the page renders.

2.9 — Report back

Tell the user the live URLs, the certificate issuer and expiry, and — most importantly — the two Cloudflare nameservers from step 2.3, because Part 3 cannot happen without them.