Skip to content
SiteSwarm Platform Documentation

Corporate Domain Onboarding

Corporate Domain Onboarding and Baseline Zone Security

Source Issue: #521
Status: distilled (Distilled into living runbook docs/runbooks/CORPORATE_DOMAIN_ONBOARDING.md)

1. Context & Objective

As part of SiteSwarm’s migration from the founder’s personal Cloudflare account (jacobmiller22.com) to the corporate account under JP Technology Solutions (Epic #422 / Issue #417), the primary corporate domain must be acquired, onboarded, and locked down with baseline security policies.

This write-up documents the live empirical verification of the newly registered corporate domain jpsoftwareassociates.com on Cloudflare account 7fba1ed07b005a3c31a890fe6c20cda2.

2. Technical Findings & Empirical Outputs

2.1 Cloudflare Account & Zone Discovery

  • Account: Jpsoftwareassociates@gmail.com's Account (7fba1ed07b005a3c31a890fe6c20cda2)
  • Zone: jpsoftwareassociates.com
  • Zone ID: 4dfdcba71d71e6a0bbf0af0015c77233
  • Nameservers: trace.ns.cloudflare.com, zara.ns.cloudflare.com

2.2 Baseline Zone Security Hardening

Using the Cloudflare v4 REST API with the scoped account API token:

  1. SSL/TLS Encryption Mode: Patched from full to strict (PATCH /zones/4dfdcba71d71e6a0bbf0af0015c77233/settings/ssl).
  2. Always Use HTTPS: Patched from off to on (PATCH /zones/4dfdcba71d71e6a0bbf0af0015c77233/settings/always_use_https).
  3. Universal SSL: Verified active certificate pack covering jpsoftwareassociates.com and *.jpsoftwareassociates.com.
  4. DNSSEC: Initiated activation (PATCH /zones/4dfdcba71d71e6a0bbf0af0015c77233/dnssec -> status: pending).

2.3 Tier 2 Behavioral Runtime Verification

  • Public DNS Resolution (1.1.1.1):
    Terminal window
    $ dig NS jpsoftwareassociates.com +short @1.1.1.1
    trace.ns.cloudflare.com.
    zara.ns.cloudflare.com.
    

    $ dig SOA jpsoftwareassociates.com +short @1.1.1.1
    trace.ns.cloudflare.com. dns.cloudflare.com. 2419842967 10000 2400 604800 1800
    Both queries return exit code 0 with authoritative Cloudflare nameservers matching zone discovery.

3. Canonical Targets Distilled

The findings and operational runbook have been distilled into:

Decisions Intentionally Deferred

  • Platform Ingress Fallback CNAME Binding: Creating the fallback DNS record (fallback.jpsoftwareassociates.com pointing to 100::) and worker route bindings is deferred to Issue #523 when application routes are transitioned.
  • Workers Paid Plan Enrollment: Activating Workers Paid on the corporate account and registering the corporate workers.dev subdomain is deferred to Issue #522.
  • Outbound Email Routing / SMTP: Configuration of MX records and SPF/DKIM for transactional email is deferred to Issue #515.