Skip to content
SiteSwarm Platform Documentation

Corporate Domain Onboarding

Corporate Domain Onboarding & Baseline Zone Security Runbook

1. Executive Summary & Purpose

This operational runbook governs the onboarding, baseline security configuration, and operational verification of the primary corporate domain on the dedicated corporate Cloudflare account (JP Technology Solutions).

Onboarding the corporate domain establishes the authoritative production edge zone for SiteSwarm’s corporate marketing storefront, platform service subdomains, and customer ingress routing, directly decoupling corporate infrastructure from the founder’s legacy personal account (jacobmiller22.com).

flowchart TD
    Registrar["Cloudflare Registrar / DNS\n(jpsoftwareassociates.com)"] --> EdgeZone["Authoritative Cloudflare Zone\n(Zone ID: 4dfdcba71d71e6a0bbf0af0015c77233)"]
    EdgeZone --> SecBase["Baseline Security Profile\n• Full (strict) TLS\n• Universal SSL (*.jpsoftwareassociates.com)\n• Always Use HTTPS (301 Redirect)\n• DNSSEC Enabled"]
    SecBase --> RoutingTarget["Platform Routing & Services\n• Corporate Storefront: apps/marketing\n• Email Service: services/email-router (#515)\n• Client Ingress Target: *-ingress.jpsoftwareassociates.com (#422)"]

2. Cloudflare Account & Zone Topology

Resource Value / Identifier Source / Verification Seam
Account Name Jpsoftwareassociates@gmail.com's Account Cloudflare Dashboard / wrangler whoami
Account ID 7fba1ed07b005a3c31a890fe6c20cda2 CLOUDFLARE_ACCOUNT_ID
Primary Corporate Domain jpsoftwareassociates.com Registered via Cloudflare Registrar
Zone Identifier 4dfdcba71d71e6a0bbf0af0015c77233 Cloudflare API (/client/v4/zones)
Zone Status active Cloudflare API
Authoritative Nameservers trace.ns.cloudflare.com, zara.ns.cloudflare.com Public DNS / 1.1.1.1
DNSSEC Status active / pending Cloudflare API (/zones/:id/dnssec)

3. Baseline Zone Security Profile

All platform zones in SiteSwarm must satisfy the following baseline security profile:

3.1 Strict TLS Encryption (Full (strict))

  • Setting: ssl: "strict"
  • Requirement: Cloudflare enforces end-to-end TLS encryption with valid, trusted origin certificates. Self-signed or unencrypted origin connections are strictly rejected.

3.2 Universal SSL & Hostname Validation

  • Setting: Universal SSL Certificate Pack Active
  • Covered Hostnames:
    • jpsoftwareassociates.com (Zone apex)
    • *.jpsoftwareassociates.com (Single-level wildcard)
  • Invariant: Standard Universal SSL (RFC 6125) covers only single-level wildcards. Nested multi-level subdomains (such as sub.preview.jpsoftwareassociates.com) are prohibited without purchasing an Advanced Certificate Manager add-on; hyphenated single-level subdomains (such as sub-preview.jpsoftwareassociates.com) must be used instead.

3.3 Enforced HTTPS Redirection

  • Setting: always_use_https: "on"
  • Requirement: All plain HTTP requests on port 80 receive an immediate, edge-generated 301 Moved Permanently or 308 Permanent Redirect response redirecting to the secure https:// protocol before any worker or application logic executes.

3.4 Domain Name System Security Extensions (DNSSEC)

  • Setting: dnssec: "active"
  • Requirement: Protects against DNS spoofing, cache poisoning, and man-in-the-middle attacks by cryptographically signing zone records with Cloudflare-managed key-signing and zone-signing keys (KSK/ZSK).

4. Verification & Health Attestation Commands

Execute the following commands to attest public DNS and edge certificate health:

4.1 Public Nameserver & SOA Attestation

Terminal window
# Verify authoritative nameservers resolve from public resolvers
dig NS jpsoftwareassociates.com +short @1.1.1.1


# Expected Output:
# trace.ns.cloudflare.com.
# zara.ns.cloudflare.com.


# Verify SOA serial and refresh timers
dig SOA jpsoftwareassociates.com +short @1.1.1.1

4.2 Cloudflare API Baseline Verification

Terminal window
TOKEN="$(grep '^CLOUDFLARE_API_TOKEN=' .env | cut -d '=' -f2-)"
ZONE_ID="4dfdcba71d71e6a0bbf0af0015c77233"


# Verify SSL Mode
curl -s -X GET "https://api.cloudflare.com/client/v4/zones/$ZONE_ID/settings/ssl" \
  -H "Authorization: Bearer $TOKEN" | jq -r '.result.value'
# Output: strict


# Verify Always Use HTTPS
curl -s -X GET "https://api.cloudflare.com/client/v4/zones/$ZONE_ID/settings/always_use_https" \
  -H "Authorization: Bearer $TOKEN" | jq -r '.result.value'
# Output: on


# Verify Universal SSL status
curl -s -X GET "https://api.cloudflare.com/client/v4/zones/$ZONE_ID/ssl/certificate_packs" \
  -H "Authorization: Bearer $TOKEN" | jq -r '.result[] | {type: .type, status: .status, hosts: .hosts}'

5. Downstream Integration & Unblocked Stories

The successful onboarding of jpsoftwareassociates.com unblocks the following platform milestones:

  1. Issue #522 (feat(infra): enroll corporate Cloudflare account in Workers Paid plan):
    • Provisioning the corporate workers.dev subdomain and enrolling in Workers Paid to unlock production script limits, D1 database quotas, and outbound Authenticated SMTP.
  2. Issue #515 (feat(email): Cloudflare Email Service and Authenticated SMTP routing):
    • Configuring custom domain MX and SPF/DKIM records under jpsoftwareassociates.com for transactional and outbound notification dispatch.
  3. Issue #523 (feat(infra): transition SiteSwarm platform resources):
    • Updating apps/marketing/wrangler.jsonc and platform.config.ts to bind custom domain routes to jpsoftwareassociates.com.