Initial commit
This commit is contained in:
Zhongwei Li
12
.claude-plugin/plugin.json
Normal file
12
.claude-plugin/plugin.json
Normal file
@@ -0,0 +1,12 @@
|
|||||||
|
{
|
||||||
|
"name": "cloudflare-troubleshooting",
|
||||||
|
"description": "Investigate and resolve Cloudflare configuration issues using API-driven evidence gathering. Use when troubleshooting ERR_TOO_MANY_REDIRECTS, SSL errors, DNS issues, or any Cloudflare-related problems",
|
||||||
|
"version": "0.0.0-2025.11.28",
|
||||||
|
"author": {
|
||||||
|
"name": "daymade",
|
||||||
|
"email": "daymadev89@gmail.com"
|
||||||
|
},
|
||||||
|
"skills": [
|
||||||
|
"./skills/cloudflare-troubleshooting"
|
||||||
|
]
|
||||||
|
}
|
||||||
3
README.md
Normal file
3
README.md
Normal file
@@ -0,0 +1,3 @@
|
|||||||
|
# cloudflare-troubleshooting
|
||||||
|
|
||||||
|
Investigate and resolve Cloudflare configuration issues using API-driven evidence gathering. Use when troubleshooting ERR_TOO_MANY_REDIRECTS, SSL errors, DNS issues, or any Cloudflare-related problems
|
||||||
64
plugin.lock.json
Normal file
64
plugin.lock.json
Normal file
@@ -0,0 +1,64 @@
|
|||||||
|
{
|
||||||
|
"$schema": "internal://schemas/plugin.lock.v1.json",
|
||||||
|
"pluginId": "gh:daymade/claude-code-skills:cloudflare-troubleshooting",
|
||||||
|
"normalized": {
|
||||||
|
"repo": null,
|
||||||
|
"ref": "refs/tags/v20251128.0",
|
||||||
|
"commit": "f3354e95bdc12cac7c7318d9f9a2474dc7ecfe50",
|
||||||
|
"treeHash": "5b104d7fb8b9902806d947cec1eafa57d44cde501cf9481cc1c7e7f91f4a7047",
|
||||||
|
"generatedAt": "2025-11-28T10:16:14.473354Z",
|
||||||
|
"toolVersion": "publish_plugins.py@0.2.0"
|
||||||
|
},
|
||||||
|
"origin": {
|
||||||
|
"remote": "git@github.com:zhongweili/42plugin-data.git",
|
||||||
|
"branch": "master",
|
||||||
|
"commit": "aa1497ed0949fd50e99e70d6324a29c5b34f9390",
|
||||||
|
"repoRoot": "/Users/zhongweili/projects/openmind/42plugin-data"
|
||||||
|
},
|
||||||
|
"manifest": {
|
||||||
|
"name": "cloudflare-troubleshooting",
|
||||||
|
"description": "Investigate and resolve Cloudflare configuration issues using API-driven evidence gathering. Use when troubleshooting ERR_TOO_MANY_REDIRECTS, SSL errors, DNS issues, or any Cloudflare-related problems"
|
||||||
|
},
|
||||||
|
"content": {
|
||||||
|
"files": [
|
||||||
|
{
|
||||||
|
"path": "README.md",
|
||||||
|
"sha256": "e16bb5d3670b339cedb840b0b74b54341246d21c26c3b6f1f034e780a9dbd365"
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"path": ".claude-plugin/plugin.json",
|
||||||
|
"sha256": "0b532cfe10501cc14f7f6e2b21ca667919444b54003485b0e2df66dc9b987193"
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"path": "skills/cloudflare-troubleshooting/SKILL.md",
|
||||||
|
"sha256": "d9c5b1f38e55067a090c10abe4679ca507bdf69e1998d792869f0e3f0dd41e17"
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"path": "skills/cloudflare-troubleshooting/references/ssl_modes.md",
|
||||||
|
"sha256": "5cf6d9d5c76a903fc9e5cc11469a7b1c16fa6f775c00945feb3f15045ecde392"
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"path": "skills/cloudflare-troubleshooting/references/common_issues.md",
|
||||||
|
"sha256": "6a35f9bec753487a4961a2a9e8b0cf38f329cc1a69b388446aa44ec8d41942b5"
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"path": "skills/cloudflare-troubleshooting/references/api_overview.md",
|
||||||
|
"sha256": "4dbe6aef7402cd26a30a166252335f64a952ee5ec3b307cb105218a0064fe59d"
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"path": "skills/cloudflare-troubleshooting/scripts/fix_ssl_mode.py",
|
||||||
|
"sha256": "e9f48e283189137f0402cde63d826afa560a2566c5ed1707fb47597ddd3024d1"
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"path": "skills/cloudflare-troubleshooting/scripts/check_cloudflare_config.py",
|
||||||
|
"sha256": "af949f88d1db660125ff9a977bf15fb55796a244a92d00f049123b80decd46c6"
|
||||||
|
}
|
||||||
|
],
|
||||||
|
"dirSha256": "5b104d7fb8b9902806d947cec1eafa57d44cde501cf9481cc1c7e7f91f4a7047"
|
||||||
|
},
|
||||||
|
"security": {
|
||||||
|
"scannedAt": null,
|
||||||
|
"scannerVersion": null,
|
||||||
|
"flags": []
|
||||||
|
}
|
||||||
|
}
|
||||||
325
skills/cloudflare-troubleshooting/SKILL.md
Normal file
325
skills/cloudflare-troubleshooting/SKILL.md
Normal file
@@ -0,0 +1,325 @@
|
|||||||
|
---
|
||||||
|
name: cloudflare-troubleshooting
|
||||||
|
description: Investigate and resolve Cloudflare configuration issues using API-driven evidence gathering. Use when troubleshooting ERR_TOO_MANY_REDIRECTS, SSL errors, DNS issues, or any Cloudflare-related problems. Focus on systematic investigation using Cloudflare API to examine actual configuration rather than making assumptions.
|
||||||
|
---
|
||||||
|
|
||||||
|
# Cloudflare Troubleshooting
|
||||||
|
|
||||||
|
## Core Principle
|
||||||
|
|
||||||
|
**Investigate with evidence, not assumptions.** Always query Cloudflare API to examine actual configuration before diagnosing issues. The skill's value is the systematic investigation methodology, not predetermined solutions.
|
||||||
|
|
||||||
|
## Investigation Methodology
|
||||||
|
|
||||||
|
### 1. Gather Credentials
|
||||||
|
|
||||||
|
Request from user:
|
||||||
|
- Domain name
|
||||||
|
- Cloudflare account email
|
||||||
|
- Cloudflare Global API Key (or API Token)
|
||||||
|
|
||||||
|
Global API Key location: Cloudflare Dashboard → My Profile → API Tokens → View Global API Key
|
||||||
|
|
||||||
|
### 2. Get Zone Information
|
||||||
|
|
||||||
|
First step for any Cloudflare troubleshooting - obtain the zone ID:
|
||||||
|
|
||||||
|
```bash
|
||||||
|
curl -s -X GET "https://api.cloudflare.com/client/v4/zones?name=<domain>" \
|
||||||
|
-H "X-Auth-Email: <email>" \
|
||||||
|
-H "X-Auth-Key: <api_key>" | jq '.'
|
||||||
|
```
|
||||||
|
|
||||||
|
Extract `zone_id` from `result[0].id` for subsequent API calls.
|
||||||
|
|
||||||
|
### 3. Investigate Systematically
|
||||||
|
|
||||||
|
For each issue, gather evidence before making conclusions. Use Cloudflare API to inspect:
|
||||||
|
- Current configuration state
|
||||||
|
- Recent changes (if audit log available)
|
||||||
|
- Related settings that might interact
|
||||||
|
|
||||||
|
## Common Investigation Patterns
|
||||||
|
|
||||||
|
### Redirect Loops (ERR_TOO_MANY_REDIRECTS)
|
||||||
|
|
||||||
|
**Evidence gathering sequence:**
|
||||||
|
|
||||||
|
1. **Check SSL/TLS mode:**
|
||||||
|
```bash
|
||||||
|
curl -X GET "https://api.cloudflare.com/client/v4/zones/{zone_id}/settings/ssl" \
|
||||||
|
-H "X-Auth-Email: email" \
|
||||||
|
-H "X-Auth-Key: key"
|
||||||
|
```
|
||||||
|
|
||||||
|
Look for: `result.value` - tells current SSL mode
|
||||||
|
|
||||||
|
2. **Check Always Use HTTPS setting:**
|
||||||
|
```bash
|
||||||
|
curl -X GET "https://api.cloudflare.com/client/v4/zones/{zone_id}/settings/always_use_https" \
|
||||||
|
-H "X-Auth-Email: email" \
|
||||||
|
-H "X-Auth-Key: key"
|
||||||
|
```
|
||||||
|
|
||||||
|
3. **Check Page Rules for redirects:**
|
||||||
|
```bash
|
||||||
|
curl -X GET "https://api.cloudflare.com/client/v4/zones/{zone_id}/pagerules" \
|
||||||
|
-H "X-Auth-Email: email" \
|
||||||
|
-H "X-Auth-Key: key"
|
||||||
|
```
|
||||||
|
|
||||||
|
Look for: `forwarding_url` or `always_use_https` actions
|
||||||
|
|
||||||
|
4. **Test origin server directly (if possible):**
|
||||||
|
```bash
|
||||||
|
curl -I -H "Host: <domain>" https://<origin_ip>
|
||||||
|
```
|
||||||
|
|
||||||
|
**Diagnosis logic:**
|
||||||
|
- SSL mode "flexible" + origin enforces HTTPS = redirect loop
|
||||||
|
- Multiple redirect rules can conflict
|
||||||
|
- Check browser vs curl behavior differences
|
||||||
|
|
||||||
|
**Fix:**
|
||||||
|
```bash
|
||||||
|
curl -X PATCH "https://api.cloudflare.com/client/v4/zones/{zone_id}/settings/ssl" \
|
||||||
|
-H "X-Auth-Email: email" \
|
||||||
|
-H "X-Auth-Key: key" \
|
||||||
|
-H "Content-Type: application/json" \
|
||||||
|
--data '{"value":"full"}'
|
||||||
|
```
|
||||||
|
|
||||||
|
Purge cache after fix:
|
||||||
|
```bash
|
||||||
|
curl -X POST "https://api.cloudflare.com/client/v4/zones/{zone_id}/purge_cache" \
|
||||||
|
-H "X-Auth-Email: email" \
|
||||||
|
-H "X-Auth-Key: key" \
|
||||||
|
-d '{"purge_everything":true}'
|
||||||
|
```
|
||||||
|
|
||||||
|
### DNS Issues
|
||||||
|
|
||||||
|
**Evidence gathering:**
|
||||||
|
|
||||||
|
1. **List DNS records:**
|
||||||
|
```bash
|
||||||
|
curl -X GET "https://api.cloudflare.com/client/v4/zones/{zone_id}/dns_records" \
|
||||||
|
-H "X-Auth-Email: email" \
|
||||||
|
-H "X-Auth-Key: key"
|
||||||
|
```
|
||||||
|
|
||||||
|
2. **Check external DNS resolution:**
|
||||||
|
```bash
|
||||||
|
dig <domain>
|
||||||
|
dig @8.8.8.8 <domain>
|
||||||
|
```
|
||||||
|
|
||||||
|
3. **Check DNSSEC status:**
|
||||||
|
```bash
|
||||||
|
curl -X GET "https://api.cloudflare.com/client/v4/zones/{zone_id}/dnssec" \
|
||||||
|
-H "X-Auth-Email: email" \
|
||||||
|
-H "X-Auth-Key: key"
|
||||||
|
```
|
||||||
|
|
||||||
|
**Look for:**
|
||||||
|
- Missing A/AAAA/CNAME records
|
||||||
|
- Incorrect proxy status (proxied vs DNS-only)
|
||||||
|
- TTL values
|
||||||
|
- Conflicting records
|
||||||
|
|
||||||
|
### SSL Certificate Errors
|
||||||
|
|
||||||
|
**Evidence gathering:**
|
||||||
|
|
||||||
|
1. **Check SSL certificate status:**
|
||||||
|
```bash
|
||||||
|
curl -X GET "https://api.cloudflare.com/client/v4/zones/{zone_id}/ssl/certificate_packs" \
|
||||||
|
-H "X-Auth-Email: email" \
|
||||||
|
-H "X-Auth-Key: key"
|
||||||
|
```
|
||||||
|
|
||||||
|
2. **Check origin certificate (if using Full Strict):**
|
||||||
|
```bash
|
||||||
|
openssl s_client -connect <origin_ip>:443 -servername <domain>
|
||||||
|
```
|
||||||
|
|
||||||
|
3. **Check SSL settings:**
|
||||||
|
- Minimum TLS version
|
||||||
|
- TLS 1.3 status
|
||||||
|
- Opportunistic Encryption
|
||||||
|
|
||||||
|
**Common issues:**
|
||||||
|
- Error 526: SSL mode is "strict" but origin cert invalid
|
||||||
|
- Error 525: SSL handshake failure at origin
|
||||||
|
- Provisioning delay: Wait 15-30 minutes for Universal SSL
|
||||||
|
|
||||||
|
### Origin Server Errors (502/503/504)
|
||||||
|
|
||||||
|
**Evidence gathering:**
|
||||||
|
|
||||||
|
1. **Check if origin is reachable:**
|
||||||
|
```bash
|
||||||
|
curl -I -H "Host: <domain>" https://<origin_ip>
|
||||||
|
```
|
||||||
|
|
||||||
|
2. **Check DNS records point to correct origin:**
|
||||||
|
```bash
|
||||||
|
curl -X GET "https://api.cloudflare.com/client/v4/zones/{zone_id}/dns_records" \
|
||||||
|
-H "X-Auth-Email: email" \
|
||||||
|
-H "X-Auth-Key: key"
|
||||||
|
```
|
||||||
|
|
||||||
|
3. **Review load balancer config (if applicable):**
|
||||||
|
```bash
|
||||||
|
curl -X GET "https://api.cloudflare.com/client/v4/zones/{zone_id}/load_balancers" \
|
||||||
|
-H "X-Auth-Email: email" \
|
||||||
|
-H "X-Auth-Key: key"
|
||||||
|
```
|
||||||
|
|
||||||
|
4. **Check firewall rules:**
|
||||||
|
```bash
|
||||||
|
curl -X GET "https://api.cloudflare.com/client/v4/zones/{zone_id}/firewall/rules" \
|
||||||
|
-H "X-Auth-Email: email" \
|
||||||
|
-H "X-Auth-Key: key"
|
||||||
|
```
|
||||||
|
|
||||||
|
## Learning New APIs
|
||||||
|
|
||||||
|
When encountering issues not covered above, consult Cloudflare API documentation:
|
||||||
|
|
||||||
|
1. **Browse API reference:** https://developers.cloudflare.com/api/
|
||||||
|
2. **Search for relevant endpoints** using issue keywords
|
||||||
|
3. **Check API schema** to understand available operations
|
||||||
|
4. **Test with GET requests** first to understand data structure
|
||||||
|
5. **Make changes with PATCH/POST** after confirming approach
|
||||||
|
|
||||||
|
**Pattern for exploring new APIs:**
|
||||||
|
```bash
|
||||||
|
# List available settings for a zone
|
||||||
|
curl -X GET "https://api.cloudflare.com/client/v4/zones/{zone_id}/settings" \
|
||||||
|
-H "X-Auth-Email: email" \
|
||||||
|
-H "X-Auth-Key: key"
|
||||||
|
```
|
||||||
|
|
||||||
|
## API Reference Overview
|
||||||
|
|
||||||
|
Consult `references/api_overview.md` for:
|
||||||
|
- Common endpoints organized by category
|
||||||
|
- Request/response schemas
|
||||||
|
- Authentication patterns
|
||||||
|
- Rate limits and error handling
|
||||||
|
|
||||||
|
Consult `references/ssl_modes.md` for:
|
||||||
|
- Detailed SSL/TLS mode explanations
|
||||||
|
- Platform compatibility
|
||||||
|
- Security implications
|
||||||
|
|
||||||
|
Consult `references/common_issues.md` for:
|
||||||
|
- Issue patterns and symptoms
|
||||||
|
- Investigation checklists
|
||||||
|
- Platform-specific notes
|
||||||
|
|
||||||
|
## Best Practices
|
||||||
|
|
||||||
|
### Evidence-Based Investigation
|
||||||
|
|
||||||
|
1. **Query before assuming** - Use API to check actual state
|
||||||
|
2. **Gather multiple data points** - Cross-reference settings
|
||||||
|
3. **Check related configurations** - Settings often interact
|
||||||
|
4. **Verify externally** - Use dig/curl to confirm
|
||||||
|
5. **Test incrementally** - One change at a time
|
||||||
|
|
||||||
|
### API Usage
|
||||||
|
|
||||||
|
1. **Parse JSON responses** - Use `jq` or python for readability
|
||||||
|
2. **Check success field** - `"success": true/false` in responses
|
||||||
|
3. **Handle errors gracefully** - Read `errors` array in responses
|
||||||
|
4. **Respect rate limits** - Cloudflare API has limits
|
||||||
|
5. **Use appropriate methods:**
|
||||||
|
- GET: Retrieve information
|
||||||
|
- PATCH: Update settings
|
||||||
|
- POST: Create resources / trigger actions
|
||||||
|
- DELETE: Remove resources
|
||||||
|
|
||||||
|
### Making Changes
|
||||||
|
|
||||||
|
1. **Gather evidence first** - Understand current state
|
||||||
|
2. **Identify root cause** - Don't guess
|
||||||
|
3. **Apply targeted fix** - Change only what's needed
|
||||||
|
4. **Purge cache if needed** - Especially for SSL/redirect changes
|
||||||
|
5. **Verify fix** - Re-query API to confirm
|
||||||
|
6. **Inform user of wait times:**
|
||||||
|
- Edge server propagation: 30-60 seconds
|
||||||
|
- DNS propagation: Up to 48 hours
|
||||||
|
- Browser cache: Requires manual clear
|
||||||
|
|
||||||
|
### Security
|
||||||
|
|
||||||
|
- Never log API keys in output
|
||||||
|
- Warn if user shares credentials in public context
|
||||||
|
- Recommend API Tokens with scoped permissions over Global API Key
|
||||||
|
- Use read-only operations for investigation
|
||||||
|
|
||||||
|
## Workflow Template
|
||||||
|
|
||||||
|
```
|
||||||
|
1. Gather: domain, email, API key
|
||||||
|
2. Get zone_id via zones API
|
||||||
|
3. Investigate:
|
||||||
|
- Query relevant APIs for evidence
|
||||||
|
- Check multiple related settings
|
||||||
|
- Verify with external tools (dig, curl)
|
||||||
|
4. Analyze evidence to determine root cause
|
||||||
|
5. Apply fix via appropriate API endpoint
|
||||||
|
6. Purge cache if configuration change affects delivery
|
||||||
|
7. Verify fix via API query and external testing
|
||||||
|
8. Inform user of resolution and any required actions
|
||||||
|
```
|
||||||
|
|
||||||
|
## Example: Complete Investigation
|
||||||
|
|
||||||
|
When user reports "site shows ERR_TOO_MANY_REDIRECTS":
|
||||||
|
|
||||||
|
```bash
|
||||||
|
# 1. Get zone ID
|
||||||
|
curl -s -X GET "https://api.cloudflare.com/client/v4/zones?name=example.com" \
|
||||||
|
-H "X-Auth-Email: user@example.com" \
|
||||||
|
-H "X-Auth-Key: abc123" | jq '.result[0].id'
|
||||||
|
|
||||||
|
# 2. Check SSL mode (primary suspect for redirect loops)
|
||||||
|
curl -s -X GET "https://api.cloudflare.com/client/v4/zones/ZONE_ID/settings/ssl" \
|
||||||
|
-H "X-Auth-Email: user@example.com" \
|
||||||
|
-H "X-Auth-Key: abc123" | jq '.result.value'
|
||||||
|
|
||||||
|
# If returns "flexible" and origin is GitHub Pages/Netlify/Vercel:
|
||||||
|
|
||||||
|
# 3. Fix by changing to "full"
|
||||||
|
curl -X PATCH "https://api.cloudflare.com/client/v4/zones/ZONE_ID/settings/ssl" \
|
||||||
|
-H "X-Auth-Email: user@example.com" \
|
||||||
|
-H "X-Auth-Key: abc123" \
|
||||||
|
-H "Content-Type: application/json" \
|
||||||
|
--data '{"value":"full"}'
|
||||||
|
|
||||||
|
# 4. Purge cache
|
||||||
|
curl -X POST "https://api.cloudflare.com/client/v4/zones/ZONE_ID/purge_cache" \
|
||||||
|
-H "X-Auth-Email: user@example.com" \
|
||||||
|
-H "X-Auth-Key: abc123" \
|
||||||
|
-d '{"purge_everything":true}'
|
||||||
|
|
||||||
|
# 5. Inform user: Wait 60 seconds, clear browser cache, retry
|
||||||
|
```
|
||||||
|
|
||||||
|
## When Scripts Are Useful
|
||||||
|
|
||||||
|
The bundled scripts (`scripts/check_cloudflare_config.py`, `scripts/fix_ssl_mode.py`) serve as:
|
||||||
|
- **Reference implementations** of investigation patterns
|
||||||
|
- **Quick diagnostic tools** when Python is available
|
||||||
|
- **Examples** of programmatic API usage
|
||||||
|
|
||||||
|
However, **prefer direct API calls via Bash/curl** for flexibility and transparency. Scripts should not limit capability - use them when convenient, but use raw API calls when needed for:
|
||||||
|
- Unfamiliar scenarios
|
||||||
|
- Edge cases
|
||||||
|
- Learning/debugging
|
||||||
|
- Operations not covered by scripts
|
||||||
|
|
||||||
|
The investigation methodology and API knowledge is the core skill, not the scripts.
|
||||||
538
skills/cloudflare-troubleshooting/references/api_overview.md
Normal file
538
skills/cloudflare-troubleshooting/references/api_overview.md
Normal file
@@ -0,0 +1,538 @@
|
|||||||
|
# Cloudflare API Overview
|
||||||
|
|
||||||
|
## Authentication
|
||||||
|
|
||||||
|
### Global API Key (used in examples)
|
||||||
|
```bash
|
||||||
|
curl -X GET "https://api.cloudflare.com/client/v4/..." \
|
||||||
|
-H "X-Auth-Email: user@example.com" \
|
||||||
|
-H "X-Auth-Key: abc123..."
|
||||||
|
```
|
||||||
|
|
||||||
|
### API Token (recommended for production)
|
||||||
|
```bash
|
||||||
|
curl -X GET "https://api.cloudflare.com/client/v4/..." \
|
||||||
|
-H "Authorization: Bearer <token>"
|
||||||
|
```
|
||||||
|
|
||||||
|
## Response Format
|
||||||
|
|
||||||
|
All API responses follow this structure:
|
||||||
|
```json
|
||||||
|
{
|
||||||
|
"success": true/false,
|
||||||
|
"errors": [],
|
||||||
|
"messages": [],
|
||||||
|
"result": { ... },
|
||||||
|
"result_info": { ... }
|
||||||
|
}
|
||||||
|
```
|
||||||
|
|
||||||
|
Always check `success` field before processing `result`.
|
||||||
|
|
||||||
|
## Core Endpoints by Category
|
||||||
|
|
||||||
|
### Zone Management
|
||||||
|
|
||||||
|
**List zones:**
|
||||||
|
```bash
|
||||||
|
GET /zones?name=<domain>
|
||||||
|
```
|
||||||
|
Returns zone information including `id`, `name`, `status`, `name_servers`
|
||||||
|
|
||||||
|
**Get zone details:**
|
||||||
|
```bash
|
||||||
|
GET /zones/{zone_id}
|
||||||
|
```
|
||||||
|
|
||||||
|
**Get all zone settings:**
|
||||||
|
```bash
|
||||||
|
GET /zones/{zone_id}/settings
|
||||||
|
```
|
||||||
|
Returns all configurable settings for the zone
|
||||||
|
|
||||||
|
### SSL/TLS
|
||||||
|
|
||||||
|
**Get SSL mode:**
|
||||||
|
```bash
|
||||||
|
GET /zones/{zone_id}/settings/ssl
|
||||||
|
```
|
||||||
|
Result: `{"value": "flexible"|"full"|"strict"|"off"}`
|
||||||
|
|
||||||
|
**Update SSL mode:**
|
||||||
|
```bash
|
||||||
|
PATCH /zones/{zone_id}/settings/ssl
|
||||||
|
Content-Type: application/json
|
||||||
|
{"value": "full"}
|
||||||
|
```
|
||||||
|
|
||||||
|
**Get Always Use HTTPS:**
|
||||||
|
```bash
|
||||||
|
GET /zones/{zone_id}/settings/always_use_https
|
||||||
|
```
|
||||||
|
|
||||||
|
**Update Always Use HTTPS:**
|
||||||
|
```bash
|
||||||
|
PATCH /zones/{zone_id}/settings/always_use_https
|
||||||
|
{"value": "on"|"off"}
|
||||||
|
```
|
||||||
|
|
||||||
|
**List SSL certificates:**
|
||||||
|
```bash
|
||||||
|
GET /zones/{zone_id}/ssl/certificate_packs
|
||||||
|
```
|
||||||
|
|
||||||
|
**Get SSL verification details:**
|
||||||
|
```bash
|
||||||
|
GET /zones/{zone_id}/ssl/verification
|
||||||
|
```
|
||||||
|
|
||||||
|
**Get SSL settings (universal, dedicated, etc):**
|
||||||
|
```bash
|
||||||
|
GET /zones/{zone_id}/ssl/analyze
|
||||||
|
```
|
||||||
|
|
||||||
|
**TLS 1.3 setting:**
|
||||||
|
```bash
|
||||||
|
GET /zones/{zone_id}/settings/tls_1_3
|
||||||
|
PATCH /zones/{zone_id}/settings/tls_1_3
|
||||||
|
{"value": "on"|"off"|"zrt"}
|
||||||
|
```
|
||||||
|
|
||||||
|
**Minimum TLS version:**
|
||||||
|
```bash
|
||||||
|
GET /zones/{zone_id}/settings/min_tls_version
|
||||||
|
PATCH /zones/{zone_id}/settings/min_tls_version
|
||||||
|
{"value": "1.0"|"1.1"|"1.2"|"1.3"}
|
||||||
|
```
|
||||||
|
|
||||||
|
### DNS Records
|
||||||
|
|
||||||
|
**List DNS records:**
|
||||||
|
```bash
|
||||||
|
GET /zones/{zone_id}/dns_records
|
||||||
|
```
|
||||||
|
Returns array of DNS records with type, name, content, proxied status, TTL
|
||||||
|
|
||||||
|
**Filter by type:**
|
||||||
|
```bash
|
||||||
|
GET /zones/{zone_id}/dns_records?type=A
|
||||||
|
GET /zones/{zone_id}/dns_records?type=CNAME
|
||||||
|
```
|
||||||
|
|
||||||
|
**Get specific record:**
|
||||||
|
```bash
|
||||||
|
GET /zones/{zone_id}/dns_records/{record_id}
|
||||||
|
```
|
||||||
|
|
||||||
|
**Create DNS record:**
|
||||||
|
```bash
|
||||||
|
POST /zones/{zone_id}/dns_records
|
||||||
|
{
|
||||||
|
"type": "A",
|
||||||
|
"name": "example.com",
|
||||||
|
"content": "192.0.2.1",
|
||||||
|
"ttl": 3600,
|
||||||
|
"proxied": true
|
||||||
|
}
|
||||||
|
```
|
||||||
|
|
||||||
|
**Update DNS record:**
|
||||||
|
```bash
|
||||||
|
PATCH /zones/{zone_id}/dns_records/{record_id}
|
||||||
|
{"proxied": true}
|
||||||
|
```
|
||||||
|
|
||||||
|
**Delete DNS record:**
|
||||||
|
```bash
|
||||||
|
DELETE /zones/{zone_id}/dns_records/{record_id}
|
||||||
|
```
|
||||||
|
|
||||||
|
**DNSSEC status:**
|
||||||
|
```bash
|
||||||
|
GET /zones/{zone_id}/dnssec
|
||||||
|
```
|
||||||
|
|
||||||
|
### Page Rules
|
||||||
|
|
||||||
|
**List page rules:**
|
||||||
|
```bash
|
||||||
|
GET /zones/{zone_id}/pagerules
|
||||||
|
```
|
||||||
|
|
||||||
|
**Get specific page rule:**
|
||||||
|
```bash
|
||||||
|
GET /zones/{zone_id}/pagerules/{rule_id}
|
||||||
|
```
|
||||||
|
|
||||||
|
**Create page rule:**
|
||||||
|
```bash
|
||||||
|
POST /zones/{zone_id}/pagerules
|
||||||
|
{
|
||||||
|
"targets": [{"target": "url", "constraint": {"operator": "matches", "value": "*example.com/*"}}],
|
||||||
|
"actions": [{"id": "always_use_https"}],
|
||||||
|
"priority": 1,
|
||||||
|
"status": "active"
|
||||||
|
}
|
||||||
|
```
|
||||||
|
|
||||||
|
**Update page rule:**
|
||||||
|
```bash
|
||||||
|
PATCH /zones/{zone_id}/pagerules/{rule_id}
|
||||||
|
```
|
||||||
|
|
||||||
|
**Delete page rule:**
|
||||||
|
```bash
|
||||||
|
DELETE /zones/{zone_id}/pagerules/{rule_id}
|
||||||
|
```
|
||||||
|
|
||||||
|
### Cache
|
||||||
|
|
||||||
|
**Purge everything:**
|
||||||
|
```bash
|
||||||
|
POST /zones/{zone_id}/purge_cache
|
||||||
|
{"purge_everything": true}
|
||||||
|
```
|
||||||
|
|
||||||
|
**Purge by URL:**
|
||||||
|
```bash
|
||||||
|
POST /zones/{zone_id}/purge_cache
|
||||||
|
{"files": ["https://example.com/style.css", "https://example.com/script.js"]}
|
||||||
|
```
|
||||||
|
|
||||||
|
**Purge by tag:**
|
||||||
|
```bash
|
||||||
|
POST /zones/{zone_id}/purge_cache
|
||||||
|
{"tags": ["tag1", "tag2"]}
|
||||||
|
```
|
||||||
|
|
||||||
|
**Purge by host:**
|
||||||
|
```bash
|
||||||
|
POST /zones/{zone_id}/purge_cache
|
||||||
|
{"hosts": ["example.com", "www.example.com"]}
|
||||||
|
```
|
||||||
|
|
||||||
|
**Cache settings:**
|
||||||
|
```bash
|
||||||
|
GET /zones/{zone_id}/settings/cache_level
|
||||||
|
GET /zones/{zone_id}/settings/browser_cache_ttl
|
||||||
|
GET /zones/{zone_id}/settings/development_mode
|
||||||
|
```
|
||||||
|
|
||||||
|
### Firewall
|
||||||
|
|
||||||
|
**List firewall rules:**
|
||||||
|
```bash
|
||||||
|
GET /zones/{zone_id}/firewall/rules
|
||||||
|
```
|
||||||
|
|
||||||
|
**List WAF rules:**
|
||||||
|
```bash
|
||||||
|
GET /zones/{zone_id}/firewall/waf/packages
|
||||||
|
GET /zones/{zone_id}/firewall/waf/packages/{package_id}/rules
|
||||||
|
```
|
||||||
|
|
||||||
|
**IP Access Rules:**
|
||||||
|
```bash
|
||||||
|
GET /zones/{zone_id}/firewall/access_rules/rules
|
||||||
|
POST /zones/{zone_id}/firewall/access_rules/rules
|
||||||
|
{
|
||||||
|
"mode": "block"|"challenge"|"whitelist",
|
||||||
|
"configuration": {"target": "ip", "value": "192.0.2.1"},
|
||||||
|
"notes": "Blocked malicious IP"
|
||||||
|
}
|
||||||
|
```
|
||||||
|
|
||||||
|
**Rate limiting:**
|
||||||
|
```bash
|
||||||
|
GET /zones/{zone_id}/rate_limits
|
||||||
|
POST /zones/{zone_id}/rate_limits
|
||||||
|
```
|
||||||
|
|
||||||
|
### Analytics
|
||||||
|
|
||||||
|
**Get analytics:**
|
||||||
|
```bash
|
||||||
|
GET /zones/{zone_id}/analytics/dashboard
|
||||||
|
```
|
||||||
|
|
||||||
|
**Traffic analytics:**
|
||||||
|
```bash
|
||||||
|
GET /zones/{zone_id}/analytics/colos
|
||||||
|
```
|
||||||
|
|
||||||
|
**DNS analytics:**
|
||||||
|
```bash
|
||||||
|
GET /zones/{zone_id}/dns_analytics/report
|
||||||
|
```
|
||||||
|
|
||||||
|
### Load Balancers
|
||||||
|
|
||||||
|
**List load balancers:**
|
||||||
|
```bash
|
||||||
|
GET /zones/{zone_id}/load_balancers
|
||||||
|
```
|
||||||
|
|
||||||
|
**Get load balancer details:**
|
||||||
|
```bash
|
||||||
|
GET /zones/{zone_id}/load_balancers/{lb_id}
|
||||||
|
```
|
||||||
|
|
||||||
|
**List pools:**
|
||||||
|
```bash
|
||||||
|
GET /accounts/{account_id}/load_balancers/pools
|
||||||
|
```
|
||||||
|
|
||||||
|
**List monitors:**
|
||||||
|
```bash
|
||||||
|
GET /accounts/{account_id}/load_balancers/monitors
|
||||||
|
```
|
||||||
|
|
||||||
|
### Workers & Routes
|
||||||
|
|
||||||
|
**List worker routes:**
|
||||||
|
```bash
|
||||||
|
GET /zones/{zone_id}/workers/routes
|
||||||
|
```
|
||||||
|
|
||||||
|
**List worker scripts:**
|
||||||
|
```bash
|
||||||
|
GET /accounts/{account_id}/workers/scripts
|
||||||
|
```
|
||||||
|
|
||||||
|
### Settings (Other Common)
|
||||||
|
|
||||||
|
**Development mode:**
|
||||||
|
```bash
|
||||||
|
GET /zones/{zone_id}/settings/development_mode
|
||||||
|
PATCH /zones/{zone_id}/settings/development_mode
|
||||||
|
{"value": "on"|"off"}
|
||||||
|
```
|
||||||
|
|
||||||
|
**Security level:**
|
||||||
|
```bash
|
||||||
|
GET /zones/{zone_id}/settings/security_level
|
||||||
|
PATCH /zones/{zone_id}/settings/security_level
|
||||||
|
{"value": "off"|"essentially_off"|"low"|"medium"|"high"|"under_attack"}
|
||||||
|
```
|
||||||
|
|
||||||
|
**Rocket Loader:**
|
||||||
|
```bash
|
||||||
|
GET /zones/{zone_id}/settings/rocket_loader
|
||||||
|
PATCH /zones/{zone_id}/settings/rocket_loader
|
||||||
|
{"value": "on"|"off"}
|
||||||
|
```
|
||||||
|
|
||||||
|
**Auto minify:**
|
||||||
|
```bash
|
||||||
|
GET /zones/{zone_id}/settings/minify
|
||||||
|
PATCH /zones/{zone_id}/settings/minify
|
||||||
|
{"value": {"css": "on", "html": "on", "js": "on"}}
|
||||||
|
```
|
||||||
|
|
||||||
|
**Brotli compression:**
|
||||||
|
```bash
|
||||||
|
GET /zones/{zone_id}/settings/brotli
|
||||||
|
```
|
||||||
|
|
||||||
|
**HTTP/2:**
|
||||||
|
```bash
|
||||||
|
GET /zones/{zone_id}/settings/http2
|
||||||
|
```
|
||||||
|
|
||||||
|
**HTTP/3 (QUIC):**
|
||||||
|
```bash
|
||||||
|
GET /zones/{zone_id}/settings/http3
|
||||||
|
```
|
||||||
|
|
||||||
|
**IPv6:**
|
||||||
|
```bash
|
||||||
|
GET /zones/{zone_id}/settings/ipv6
|
||||||
|
```
|
||||||
|
|
||||||
|
**Opportunistic Encryption:**
|
||||||
|
```bash
|
||||||
|
GET /zones/{zone_id}/settings/opportunistic_encryption
|
||||||
|
```
|
||||||
|
|
||||||
|
**Automatic HTTPS Rewrites:**
|
||||||
|
```bash
|
||||||
|
GET /zones/{zone_id}/settings/automatic_https_rewrites
|
||||||
|
PATCH /zones/{zone_id}/settings/automatic_https_rewrites
|
||||||
|
{"value": "on"|"off"}
|
||||||
|
```
|
||||||
|
|
||||||
|
## Learning New Endpoints
|
||||||
|
|
||||||
|
### Method 1: List All Settings
|
||||||
|
```bash
|
||||||
|
curl -s -X GET "https://api.cloudflare.com/client/v4/zones/{zone_id}/settings" \
|
||||||
|
-H "X-Auth-Email: email" \
|
||||||
|
-H "X-Auth-Key: key" | jq '.result[] | {id, value}'
|
||||||
|
```
|
||||||
|
|
||||||
|
This returns all available settings with current values. Use setting `id` to construct endpoint:
|
||||||
|
`/zones/{zone_id}/settings/{id}`
|
||||||
|
|
||||||
|
### Method 2: Cloudflare API Docs
|
||||||
|
|
||||||
|
Browse official API reference: https://developers.cloudflare.com/api/
|
||||||
|
|
||||||
|
**Structure:**
|
||||||
|
- Operations organized by product/feature
|
||||||
|
- Each operation shows:
|
||||||
|
- HTTP method and endpoint
|
||||||
|
- Required/optional parameters
|
||||||
|
- Request body schema
|
||||||
|
- Response schema
|
||||||
|
- Example requests
|
||||||
|
|
||||||
|
**Search strategy:**
|
||||||
|
1. Identify feature/product (SSL, DNS, Cache, etc.)
|
||||||
|
2. Find relevant operations (List, Get, Create, Update, Delete)
|
||||||
|
3. Check request schema for required fields
|
||||||
|
4. Test with GET before making changes
|
||||||
|
|
||||||
|
### Method 3: Explore API Interactively
|
||||||
|
|
||||||
|
**Pattern:**
|
||||||
|
1. Start with zone info to understand structure
|
||||||
|
2. List resources: `GET /zones/{zone_id}/{resource_type}`
|
||||||
|
3. Get specific item: `GET /zones/{zone_id}/{resource_type}/{id}`
|
||||||
|
4. Check available operations in docs
|
||||||
|
5. Make changes: `PATCH/POST/DELETE`
|
||||||
|
|
||||||
|
**Example exploration for unknown feature:**
|
||||||
|
```bash
|
||||||
|
# 1. Check if endpoint exists
|
||||||
|
curl -I "https://api.cloudflare.com/client/v4/zones/{zone_id}/feature_name"
|
||||||
|
|
||||||
|
# 2. Try listing (if collection)
|
||||||
|
curl -X GET "https://api.cloudflare.com/client/v4/zones/{zone_id}/feature_name" \
|
||||||
|
-H "X-Auth-Email: email" \
|
||||||
|
-H "X-Auth-Key: key"
|
||||||
|
|
||||||
|
# 3. Examine response structure
|
||||||
|
# 4. Consult docs for modification operations
|
||||||
|
```
|
||||||
|
|
||||||
|
## Error Handling
|
||||||
|
|
||||||
|
Common error codes:
|
||||||
|
- 400: Bad request (check request format)
|
||||||
|
- 401: Unauthorized (check API credentials)
|
||||||
|
- 403: Forbidden (insufficient permissions)
|
||||||
|
- 404: Not found (check zone_id or resource_id)
|
||||||
|
- 429: Rate limit exceeded (wait before retrying)
|
||||||
|
- 500: Server error (Cloudflare issue, retry later)
|
||||||
|
|
||||||
|
**Error response structure:**
|
||||||
|
```json
|
||||||
|
{
|
||||||
|
"success": false,
|
||||||
|
"errors": [
|
||||||
|
{
|
||||||
|
"code": 1234,
|
||||||
|
"message": "Error description"
|
||||||
|
}
|
||||||
|
],
|
||||||
|
"messages": [],
|
||||||
|
"result": null
|
||||||
|
}
|
||||||
|
```
|
||||||
|
|
||||||
|
## Rate Limits
|
||||||
|
|
||||||
|
- Free tier: ~1200 requests per 5 minutes
|
||||||
|
- Paid tiers: Higher limits based on plan
|
||||||
|
- If rate limited (429), back off exponentially
|
||||||
|
|
||||||
|
## Best Practices
|
||||||
|
|
||||||
|
1. **Use jq for readability:**
|
||||||
|
```bash
|
||||||
|
curl ... | jq '.result'
|
||||||
|
```
|
||||||
|
|
||||||
|
2. **Extract specific fields:**
|
||||||
|
```bash
|
||||||
|
curl ... | jq '.result.value'
|
||||||
|
curl ... | jq '.result[] | {id, name, value}'
|
||||||
|
```
|
||||||
|
|
||||||
|
3. **Check success before processing:**
|
||||||
|
```bash
|
||||||
|
response=$(curl ...)
|
||||||
|
success=$(echo "$response" | jq -r '.success')
|
||||||
|
if [ "$success" = "true" ]; then
|
||||||
|
echo "$response" | jq '.result'
|
||||||
|
else
|
||||||
|
echo "$response" | jq '.errors'
|
||||||
|
fi
|
||||||
|
```
|
||||||
|
|
||||||
|
4. **Store zone_id for reuse:**
|
||||||
|
```bash
|
||||||
|
zone_id=$(curl ... | jq -r '.result[0].id')
|
||||||
|
```
|
||||||
|
|
||||||
|
5. **Test with GET first:**
|
||||||
|
Before modifying configuration, always GET to see current state
|
||||||
|
|
||||||
|
## Common Investigation Patterns
|
||||||
|
|
||||||
|
### Pattern 1: Settings Investigation
|
||||||
|
```bash
|
||||||
|
# Get all settings
|
||||||
|
curl -X GET "/zones/{zone_id}/settings" | jq '.result[]'
|
||||||
|
|
||||||
|
# Filter specific settings
|
||||||
|
curl -X GET "/zones/{zone_id}/settings" | jq '.result[] | select(.id | contains("ssl"))'
|
||||||
|
```
|
||||||
|
|
||||||
|
### Pattern 2: Resource Listing + Details
|
||||||
|
```bash
|
||||||
|
# List resources
|
||||||
|
curl -X GET "/zones/{zone_id}/dns_records" | jq '.result[] | {id, name, type}'
|
||||||
|
|
||||||
|
# Get specific resource
|
||||||
|
record_id="..."
|
||||||
|
curl -X GET "/zones/{zone_id}/dns_records/$record_id" | jq '.'
|
||||||
|
```
|
||||||
|
|
||||||
|
### Pattern 3: Multi-Setting Check
|
||||||
|
```bash
|
||||||
|
# Check related settings in parallel
|
||||||
|
curl ... /settings/ssl &
|
||||||
|
curl ... /settings/always_use_https &
|
||||||
|
curl ... /pagerules &
|
||||||
|
wait
|
||||||
|
```
|
||||||
|
|
||||||
|
### Pattern 4: Change + Verify
|
||||||
|
```bash
|
||||||
|
# Make change
|
||||||
|
curl -X PATCH "/zones/{zone_id}/settings/ssl" -d '{"value":"full"}'
|
||||||
|
|
||||||
|
# Verify change applied
|
||||||
|
curl -X GET "/zones/{zone_id}/settings/ssl" | jq '.result.value'
|
||||||
|
```
|
||||||
|
|
||||||
|
## Account-Level vs Zone-Level
|
||||||
|
|
||||||
|
Some resources are account-level, not zone-level:
|
||||||
|
|
||||||
|
**Account-level:**
|
||||||
|
- Load balancer pools/monitors: `/accounts/{account_id}/load_balancers/...`
|
||||||
|
- Workers scripts: `/accounts/{account_id}/workers/...`
|
||||||
|
- Access policies: `/accounts/{account_id}/access/...`
|
||||||
|
|
||||||
|
**Zone-level:**
|
||||||
|
- DNS records: `/zones/{zone_id}/dns_records`
|
||||||
|
- SSL settings: `/zones/{zone_id}/settings/ssl`
|
||||||
|
- Page rules: `/zones/{zone_id}/pagerules`
|
||||||
|
|
||||||
|
Get account_id from zone info:
|
||||||
|
```bash
|
||||||
|
curl -X GET "/zones?name=example.com" | jq '.result[0].account.id'
|
||||||
|
```
|
||||||
261
skills/cloudflare-troubleshooting/references/common_issues.md
Normal file
261
skills/cloudflare-troubleshooting/references/common_issues.md
Normal file
@@ -0,0 +1,261 @@
|
|||||||
|
# Common Cloudflare Issues and Solutions
|
||||||
|
|
||||||
|
## Redirect Loop Errors (ERR_TOO_MANY_REDIRECTS)
|
||||||
|
|
||||||
|
### Symptom
|
||||||
|
Browser displays "This page isn't working" or "ERR_TOO_MANY_REDIRECTS"
|
||||||
|
|
||||||
|
### Common Causes
|
||||||
|
|
||||||
|
#### 1. SSL Mode Mismatch (Most Common)
|
||||||
|
**Scenario:** Origin server enforces HTTPS, but Cloudflare SSL mode is "Flexible"
|
||||||
|
|
||||||
|
**Explanation:**
|
||||||
|
- Browser → HTTPS → Cloudflare
|
||||||
|
- Cloudflare → HTTP → Origin Server (because of Flexible mode)
|
||||||
|
- Origin Server → Redirects to HTTPS (because it enforces HTTPS)
|
||||||
|
- Infinite loop
|
||||||
|
|
||||||
|
**Affected Platforms:**
|
||||||
|
- GitHub Pages
|
||||||
|
- Netlify
|
||||||
|
- Vercel
|
||||||
|
- Heroku
|
||||||
|
- Most modern hosting platforms
|
||||||
|
|
||||||
|
**Solution:**
|
||||||
|
Change SSL mode from "Flexible" to "Full" or "Full (strict)"
|
||||||
|
|
||||||
|
```bash
|
||||||
|
# Diagnose
|
||||||
|
python scripts/check_cloudflare_config.py example.com user@example.com API_KEY
|
||||||
|
|
||||||
|
# Fix
|
||||||
|
python scripts/fix_ssl_mode.py example.com user@example.com API_KEY full --purge-cache
|
||||||
|
```
|
||||||
|
|
||||||
|
#### 2. Conflicting Page Rules
|
||||||
|
**Scenario:** Multiple redirect rules that conflict with each other
|
||||||
|
|
||||||
|
**Solution:**
|
||||||
|
- Review Page Rules in Cloudflare Dashboard
|
||||||
|
- Remove conflicting "Always Use HTTPS" or "Forwarding URL" rules
|
||||||
|
- Ensure redirect rules don't create loops
|
||||||
|
|
||||||
|
#### 3. Origin Server Misconfiguration
|
||||||
|
**Scenario:** Origin server has incorrect redirect rules in .htaccess or nginx config
|
||||||
|
|
||||||
|
**Solution:**
|
||||||
|
- Check origin server configuration
|
||||||
|
- Verify redirects don't conflict with Cloudflare settings
|
||||||
|
- Test direct origin access (bypass Cloudflare)
|
||||||
|
|
||||||
|
### Resolution Steps
|
||||||
|
|
||||||
|
1. **Check SSL mode:**
|
||||||
|
```bash
|
||||||
|
curl -X GET "https://api.cloudflare.com/client/v4/zones/ZONE_ID/settings/ssl" \
|
||||||
|
-H "X-Auth-Email: email" \
|
||||||
|
-H "X-Auth-Key: key"
|
||||||
|
```
|
||||||
|
|
||||||
|
2. **Fix SSL mode if needed:**
|
||||||
|
```bash
|
||||||
|
python scripts/fix_ssl_mode.py domain.com email API_KEY full
|
||||||
|
```
|
||||||
|
|
||||||
|
3. **Purge cache:**
|
||||||
|
```bash
|
||||||
|
curl -X POST "https://api.cloudflare.com/client/v4/zones/ZONE_ID/purge_cache" \
|
||||||
|
-H "X-Auth-Email: email" \
|
||||||
|
-H "X-Auth-Key: key" \
|
||||||
|
-d '{"purge_everything":true}'
|
||||||
|
```
|
||||||
|
|
||||||
|
4. **Clear browser cache or use incognito mode**
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
## DNS Resolution Issues
|
||||||
|
|
||||||
|
### Symptom
|
||||||
|
Website not accessible or showing old content
|
||||||
|
|
||||||
|
### Common Causes
|
||||||
|
|
||||||
|
#### 1. DNS Not Propagated
|
||||||
|
**Solution:** Wait 24-48 hours for full DNS propagation
|
||||||
|
|
||||||
|
Check propagation:
|
||||||
|
```bash
|
||||||
|
dig domain.com
|
||||||
|
nslookup domain.com
|
||||||
|
```
|
||||||
|
|
||||||
|
#### 2. Incorrect DNS Records
|
||||||
|
**Solution:**
|
||||||
|
- Verify A/AAAA/CNAME records point to correct IPs
|
||||||
|
- For GitHub Pages: Use A records to GitHub IPs or CNAME to username.github.io
|
||||||
|
- Ensure "Proxied" status matches requirements
|
||||||
|
|
||||||
|
#### 3. DNSSEC Issues
|
||||||
|
**Solution:**
|
||||||
|
- Check DNSSEC status in Cloudflare Dashboard
|
||||||
|
- Verify DS records at registrar match Cloudflare's DNSSEC settings
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
## SSL/TLS Certificate Errors
|
||||||
|
|
||||||
|
### Symptom
|
||||||
|
"Your connection is not private" or "NET::ERR_CERT_COMMON_NAME_INVALID"
|
||||||
|
|
||||||
|
### Common Causes
|
||||||
|
|
||||||
|
#### 1. Universal SSL Certificate Provisioning Delay
|
||||||
|
**Solution:** Wait 15-30 minutes for Cloudflare to provision certificate
|
||||||
|
|
||||||
|
#### 2. CAA Records Blocking Certificate Issuance
|
||||||
|
**Solution:**
|
||||||
|
- Check CAA records
|
||||||
|
- Ensure CAA allows Let's Encrypt: `letsencrypt.org` or Cloudflare CAs
|
||||||
|
|
||||||
|
#### 3. Full (Strict) Mode with Invalid Origin Certificate
|
||||||
|
**Solution:**
|
||||||
|
- Use "Full" mode instead of "Full (strict)" if origin cert is self-signed
|
||||||
|
- Or install valid certificate on origin server
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
## Performance Issues
|
||||||
|
|
||||||
|
### Symptom
|
||||||
|
Slow page load times despite using Cloudflare
|
||||||
|
|
||||||
|
### Common Causes
|
||||||
|
|
||||||
|
#### 1. Cache Not Configured
|
||||||
|
**Solution:**
|
||||||
|
- Enable Auto Minify (JS, CSS, HTML)
|
||||||
|
- Set up Page Rules for cache levels
|
||||||
|
- Configure Browser Cache TTL
|
||||||
|
|
||||||
|
#### 2. Large Assets Not Optimized
|
||||||
|
**Solution:**
|
||||||
|
- Enable Cloudflare Image Optimization
|
||||||
|
- Use WebP format
|
||||||
|
- Implement lazy loading
|
||||||
|
|
||||||
|
#### 3. Too Many Uncached Requests
|
||||||
|
**Solution:**
|
||||||
|
- Review cache analytics
|
||||||
|
- Add cache rules for static assets
|
||||||
|
- Use Cloudflare Workers for dynamic caching
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
## Access Denied / 403 Errors
|
||||||
|
|
||||||
|
### Symptom
|
||||||
|
"Error 1020: Access Denied" or generic 403
|
||||||
|
|
||||||
|
### Common Causes
|
||||||
|
|
||||||
|
#### 1. Firewall Rules Blocking Traffic
|
||||||
|
**Solution:**
|
||||||
|
- Review Firewall Rules in Security → WAF
|
||||||
|
- Check IP Access Rules
|
||||||
|
- Verify Managed Rulesets aren't too strict
|
||||||
|
|
||||||
|
#### 2. Rate Limiting
|
||||||
|
**Solution:**
|
||||||
|
- Check Rate Limiting rules
|
||||||
|
- Adjust thresholds if legitimate traffic is blocked
|
||||||
|
|
||||||
|
#### 3. Browser Integrity Check
|
||||||
|
**Solution:**
|
||||||
|
- Disable "Browser Integrity Check" if needed
|
||||||
|
- Found in: Security → Settings
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
## Origin Server Errors (502/503/504)
|
||||||
|
|
||||||
|
### Symptom
|
||||||
|
"502 Bad Gateway" or "504 Gateway Timeout"
|
||||||
|
|
||||||
|
### Common Causes
|
||||||
|
|
||||||
|
#### 1. Origin Server Down
|
||||||
|
**Solution:**
|
||||||
|
- Verify origin server is running
|
||||||
|
- Check origin server logs
|
||||||
|
- Test direct IP access
|
||||||
|
|
||||||
|
#### 2. Origin SSL Certificate Invalid (Full Strict mode)
|
||||||
|
**Solution:**
|
||||||
|
- Switch to "Full" mode temporarily
|
||||||
|
- Fix origin certificate
|
||||||
|
- Or use Cloudflare Origin Certificate
|
||||||
|
|
||||||
|
#### 3. Timeout Issues
|
||||||
|
**Solution:**
|
||||||
|
- Increase origin server timeout settings
|
||||||
|
- Optimize slow queries/code
|
||||||
|
- Consider using Cloudflare Workers for timeouts
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
## Page Rules Not Working
|
||||||
|
|
||||||
|
### Symptom
|
||||||
|
Page Rules don't seem to apply
|
||||||
|
|
||||||
|
### Common Causes
|
||||||
|
|
||||||
|
#### 1. Rule Order
|
||||||
|
**Solution:** Page Rules are executed top-to-bottom; reorder if needed
|
||||||
|
|
||||||
|
#### 2. Pattern Matching Issues
|
||||||
|
**Solution:**
|
||||||
|
- Use `*` for wildcards correctly
|
||||||
|
- Test patterns: `example.com/*` vs `*example.com/*`
|
||||||
|
|
||||||
|
#### 3. Cache Already Set
|
||||||
|
**Solution:** Purge cache after creating/modifying Page Rules
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
## Troubleshooting Workflow
|
||||||
|
|
||||||
|
### Step 1: Identify the Issue
|
||||||
|
- Collect error messages and codes
|
||||||
|
- Note when issue started
|
||||||
|
- Check if issue is intermittent or consistent
|
||||||
|
|
||||||
|
### Step 2: Check Cloudflare Status
|
||||||
|
- Visit https://www.cloudflarestatus.com
|
||||||
|
- Verify no ongoing incidents
|
||||||
|
|
||||||
|
### Step 3: Run Diagnostics
|
||||||
|
```bash
|
||||||
|
python scripts/check_cloudflare_config.py domain.com email API_KEY
|
||||||
|
```
|
||||||
|
|
||||||
|
### Step 4: Review Recent Changes
|
||||||
|
- Check Cloudflare Audit Log
|
||||||
|
- Review recent DNS/SSL/Page Rule changes
|
||||||
|
|
||||||
|
### Step 5: Test Bypass
|
||||||
|
- Temporarily set DNS to "DNS Only" (grey cloud)
|
||||||
|
- Test if issue persists without Cloudflare
|
||||||
|
|
||||||
|
### Step 6: Apply Fixes
|
||||||
|
- Implement specific solutions based on diagnosis
|
||||||
|
- Purge cache after changes
|
||||||
|
- Test in incognito/private mode
|
||||||
|
|
||||||
|
### Step 7: Monitor
|
||||||
|
- Verify fix works consistently
|
||||||
|
- Check analytics for any anomalies
|
||||||
|
- Document solution for future reference
|
||||||
246
skills/cloudflare-troubleshooting/references/ssl_modes.md
Normal file
246
skills/cloudflare-troubleshooting/references/ssl_modes.md
Normal file
@@ -0,0 +1,246 @@
|
|||||||
|
# Cloudflare SSL/TLS Modes Explained
|
||||||
|
|
||||||
|
## Overview
|
||||||
|
|
||||||
|
Cloudflare offers four SSL/TLS encryption modes that determine how traffic is encrypted between visitors, Cloudflare, and your origin server.
|
||||||
|
|
||||||
|
```
|
||||||
|
Visitor ←→ Cloudflare ←→ Origin Server
|
||||||
|
[A] [B] [C]
|
||||||
|
|
||||||
|
[A] Visitor to Cloudflare: Always HTTPS (handled by Cloudflare Universal SSL)
|
||||||
|
[B] Cloudflare to Origin: Depends on SSL mode setting
|
||||||
|
```
|
||||||
|
|
||||||
|
## The Four SSL Modes
|
||||||
|
|
||||||
|
### 1. Off (Not Recommended)
|
||||||
|
|
||||||
|
**Encryption:**
|
||||||
|
- Visitor → Cloudflare: HTTP (unencrypted)
|
||||||
|
- Cloudflare → Origin: HTTP (unencrypted)
|
||||||
|
|
||||||
|
**When to use:** Never. This disables HTTPS entirely.
|
||||||
|
|
||||||
|
**Issues:**
|
||||||
|
- Browser shows "Not Secure" warning
|
||||||
|
- No encryption between visitor and Cloudflare
|
||||||
|
- Vulnerable to man-in-the-middle attacks
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
### 2. Flexible
|
||||||
|
|
||||||
|
**Encryption:**
|
||||||
|
- Visitor → Cloudflare: HTTPS (encrypted)
|
||||||
|
- Cloudflare → Origin: HTTP (unencrypted)
|
||||||
|
|
||||||
|
**When to use:**
|
||||||
|
- Origin server doesn't support HTTPS
|
||||||
|
- Legacy systems without SSL certificates
|
||||||
|
- Temporary solution during certificate setup
|
||||||
|
|
||||||
|
**Issues:**
|
||||||
|
- ⚠️ **CAUSES REDIRECT LOOPS** with origins that enforce HTTPS
|
||||||
|
- Traffic between Cloudflare and origin is unencrypted
|
||||||
|
- Not recommended for sensitive data
|
||||||
|
|
||||||
|
**Common redirect loop scenario:**
|
||||||
|
```
|
||||||
|
1. Browser requests https://example.com
|
||||||
|
2. Cloudflare receives HTTPS request
|
||||||
|
3. Cloudflare forwards HTTP request to origin (because mode is Flexible)
|
||||||
|
4. Origin server enforces HTTPS → redirects to https://example.com
|
||||||
|
5. Back to step 1 → INFINITE LOOP
|
||||||
|
```
|
||||||
|
|
||||||
|
**Affected platforms:**
|
||||||
|
- GitHub Pages
|
||||||
|
- Netlify
|
||||||
|
- Vercel
|
||||||
|
- Heroku
|
||||||
|
- Any platform that enforces HTTPS
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
### 3. Full (Recommended for Most Cases)
|
||||||
|
|
||||||
|
**Encryption:**
|
||||||
|
- Visitor → Cloudflare: HTTPS (encrypted)
|
||||||
|
- Cloudflare → Origin: HTTPS (encrypted)
|
||||||
|
|
||||||
|
**When to use:**
|
||||||
|
- Origin server supports HTTPS (most modern hosting)
|
||||||
|
- Self-signed certificates on origin
|
||||||
|
- Default choice for GitHub Pages, Netlify, Vercel, etc.
|
||||||
|
|
||||||
|
**Benefits:**
|
||||||
|
- End-to-end encryption
|
||||||
|
- No redirect loops with HTTPS-enforcing origins
|
||||||
|
- Compatible with self-signed certificates
|
||||||
|
|
||||||
|
**Important:**
|
||||||
|
- Cloudflare does NOT validate origin certificate
|
||||||
|
- Origin can use self-signed or expired certificates
|
||||||
|
- Still provides encryption, just doesn't verify origin identity
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
### 4. Full (Strict) (Most Secure)
|
||||||
|
|
||||||
|
**Encryption:**
|
||||||
|
- Visitor → Cloudflare: HTTPS (encrypted)
|
||||||
|
- Cloudflare → Origin: HTTPS (encrypted + validated)
|
||||||
|
|
||||||
|
**When to use:**
|
||||||
|
- Origin has valid SSL certificate from trusted CA
|
||||||
|
- Maximum security requirements
|
||||||
|
- Production environments with proper certificates
|
||||||
|
|
||||||
|
**Requirements:**
|
||||||
|
- Origin must have valid certificate from trusted CA
|
||||||
|
- Certificate must not be expired
|
||||||
|
- Certificate must match the domain
|
||||||
|
|
||||||
|
**Benefits:**
|
||||||
|
- Maximum security
|
||||||
|
- Validates origin server identity
|
||||||
|
- Prevents man-in-the-middle attacks between Cloudflare and origin
|
||||||
|
|
||||||
|
**Issues if misconfigured:**
|
||||||
|
- 526 error if origin certificate is invalid
|
||||||
|
- 525 error if SSL handshake fails
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
## Decision Matrix
|
||||||
|
|
||||||
|
| Origin Supports HTTPS? | Origin Certificate Valid? | Recommended Mode | Why |
|
||||||
|
|------------------------|---------------------------|------------------|-----|
|
||||||
|
| No | N/A | Flexible | Only option (but upgrade origin ASAP) |
|
||||||
|
| Yes | Self-signed/Invalid | Full | Encrypts traffic, doesn't validate cert |
|
||||||
|
| Yes | Valid from trusted CA | Full (Strict) | Maximum security |
|
||||||
|
| Yes (enforced) | Any | Full or Full (Strict) | Prevents redirect loops |
|
||||||
|
|
||||||
|
## Common Platforms and Recommended Modes
|
||||||
|
|
||||||
|
| Platform | Enforces HTTPS? | Recommended Mode | Notes |
|
||||||
|
|----------|-----------------|------------------|-------|
|
||||||
|
| GitHub Pages | Yes | Full or Full (Strict) | Full (Strict) preferred |
|
||||||
|
| Netlify | Yes | Full or Full (Strict) | Has valid certificates |
|
||||||
|
| Vercel | Yes | Full or Full (Strict) | Has valid certificates |
|
||||||
|
| Heroku | Yes | Full or Full (Strict) | Has valid certificates |
|
||||||
|
| Custom VPS | Depends | Full (Strict) if possible | Install Let's Encrypt cert |
|
||||||
|
| Shared Hosting | Varies | Check with host | Usually Full |
|
||||||
|
| AWS CloudFront | Configurable | Full (Strict) | Use ACM certificates |
|
||||||
|
|
||||||
|
## Troubleshooting SSL Mode Issues
|
||||||
|
|
||||||
|
### Redirect Loop (ERR_TOO_MANY_REDIRECTS)
|
||||||
|
|
||||||
|
**Cause:** SSL mode is "Flexible" but origin enforces HTTPS
|
||||||
|
|
||||||
|
**Solution:**
|
||||||
|
```bash
|
||||||
|
# Check current mode
|
||||||
|
curl -X GET "https://api.cloudflare.com/client/v4/zones/ZONE_ID/settings/ssl" \
|
||||||
|
-H "X-Auth-Email: email" \
|
||||||
|
-H "X-Auth-Key: key"
|
||||||
|
|
||||||
|
# Change to Full
|
||||||
|
python scripts/fix_ssl_mode.py domain.com email API_KEY full --purge-cache
|
||||||
|
```
|
||||||
|
|
||||||
|
### Error 526 (Invalid SSL Certificate)
|
||||||
|
|
||||||
|
**Cause:** Mode is "Full (Strict)" but origin certificate is invalid
|
||||||
|
|
||||||
|
**Solutions:**
|
||||||
|
1. Install valid certificate on origin (recommended)
|
||||||
|
2. Switch to "Full" mode temporarily:
|
||||||
|
```bash
|
||||||
|
python scripts/fix_ssl_mode.py domain.com email API_KEY full
|
||||||
|
```
|
||||||
|
3. Use Cloudflare Origin Certificate (free, only trusted by Cloudflare)
|
||||||
|
|
||||||
|
### Error 525 (SSL Handshake Failed)
|
||||||
|
|
||||||
|
**Cause:** Origin server SSL/TLS configuration issue
|
||||||
|
|
||||||
|
**Solutions:**
|
||||||
|
1. Check origin server SSL logs
|
||||||
|
2. Verify origin supports TLS 1.2 or higher
|
||||||
|
3. Ensure origin port 443 is open
|
||||||
|
4. Check cipher suite compatibility
|
||||||
|
|
||||||
|
## Best Practices
|
||||||
|
|
||||||
|
### 1. Start with Full Mode
|
||||||
|
When in doubt, use "Full" mode for origins that support HTTPS
|
||||||
|
|
||||||
|
### 2. Upgrade to Full (Strict) When Possible
|
||||||
|
Install proper certificates and use Full (Strict) for production
|
||||||
|
|
||||||
|
### 3. Never Use Flexible for New Sites
|
||||||
|
Flexible should only be used for legacy systems during migration
|
||||||
|
|
||||||
|
### 4. Use Cloudflare Origin Certificates
|
||||||
|
For custom origin servers, install Cloudflare Origin Certificates:
|
||||||
|
- Free
|
||||||
|
- Valid for 15 years
|
||||||
|
- Trusted by Cloudflare (enables Full Strict mode)
|
||||||
|
- Generate at: SSL/TLS → Origin Server → Create Certificate
|
||||||
|
|
||||||
|
### 5. Monitor SSL Errors
|
||||||
|
Set up alerts for SSL-related errors (525, 526) in Cloudflare Analytics
|
||||||
|
|
||||||
|
### 6. Test After Changes
|
||||||
|
- Clear browser cache
|
||||||
|
- Test in incognito mode
|
||||||
|
- Purge Cloudflare cache
|
||||||
|
- Wait 30-60 seconds for edge server updates
|
||||||
|
|
||||||
|
## Additional Security Settings
|
||||||
|
|
||||||
|
### Always Use HTTPS
|
||||||
|
- Redirects all HTTP requests to HTTPS
|
||||||
|
- Located: SSL/TLS → Edge Certificates
|
||||||
|
- Usually enabled by default
|
||||||
|
- Can cause loops if misconfigured with Page Rules
|
||||||
|
|
||||||
|
### HTTP Strict Transport Security (HSTS)
|
||||||
|
- Forces browsers to always use HTTPS
|
||||||
|
- Can't easily revert (browsers cache for months)
|
||||||
|
- Enable only when HTTPS is stable
|
||||||
|
- Located: SSL/TLS → Edge Certificates
|
||||||
|
|
||||||
|
### Minimum TLS Version
|
||||||
|
- Set to TLS 1.2 minimum (recommended)
|
||||||
|
- TLS 1.3 for maximum security
|
||||||
|
- Located: SSL/TLS → Edge Certificates
|
||||||
|
|
||||||
|
### Opportunistic Encryption
|
||||||
|
- Encrypts traffic when possible
|
||||||
|
- Good for mixed content
|
||||||
|
- Located: SSL/TLS → Edge Certificates
|
||||||
|
|
||||||
|
## API Reference
|
||||||
|
|
||||||
|
### Get SSL Mode
|
||||||
|
```bash
|
||||||
|
curl -X GET "https://api.cloudflare.com/client/v4/zones/{zone_id}/settings/ssl" \
|
||||||
|
-H "X-Auth-Email: user@example.com" \
|
||||||
|
-H "X-Auth-Key: api_key" \
|
||||||
|
-H "Content-Type: application/json"
|
||||||
|
```
|
||||||
|
|
||||||
|
### Change SSL Mode
|
||||||
|
```bash
|
||||||
|
curl -X PATCH "https://api.cloudflare.com/client/v4/zones/{zone_id}/settings/ssl" \
|
||||||
|
-H "X-Auth-Email: user@example.com" \
|
||||||
|
-H "X-Auth-Key: api_key" \
|
||||||
|
-H "Content-Type: application/json" \
|
||||||
|
--data '{"value":"full"}'
|
||||||
|
```
|
||||||
|
|
||||||
|
Valid values: `off`, `flexible`, `full`, `strict`
|
||||||
@@ -0,0 +1,293 @@
|
|||||||
|
#!/usr/bin/env python3
|
||||||
|
"""
|
||||||
|
Comprehensive Cloudflare configuration checker.
|
||||||
|
|
||||||
|
This script diagnoses common Cloudflare issues including:
|
||||||
|
- SSL/TLS mode mismatches
|
||||||
|
- DNS configuration problems
|
||||||
|
- Cache settings
|
||||||
|
- Page rules and redirect loops
|
||||||
|
|
||||||
|
Requires:
|
||||||
|
- requests library
|
||||||
|
- Cloudflare API credentials (email + Global API Key OR API Token)
|
||||||
|
"""
|
||||||
|
|
||||||
|
import json
|
||||||
|
import sys
|
||||||
|
from typing import Dict, List, Optional, Tuple
|
||||||
|
|
||||||
|
|
||||||
|
def check_ssl_configuration(
|
||||||
|
zone_id: str, email: str, api_key: str
|
||||||
|
) -> Tuple[bool, List[str]]:
|
||||||
|
"""
|
||||||
|
Check SSL/TLS configuration for common issues.
|
||||||
|
|
||||||
|
Returns: (has_issues, issues_list)
|
||||||
|
"""
|
||||||
|
try:
|
||||||
|
import requests
|
||||||
|
except ImportError:
|
||||||
|
return True, ["Error: 'requests' library not installed. Install with: pip install requests"]
|
||||||
|
|
||||||
|
issues = []
|
||||||
|
|
||||||
|
# Get SSL mode
|
||||||
|
try:
|
||||||
|
response = requests.get(
|
||||||
|
f"https://api.cloudflare.com/client/v4/zones/{zone_id}/settings/ssl",
|
||||||
|
headers={"X-Auth-Email": email, "X-Auth-Key": api_key},
|
||||||
|
timeout=30
|
||||||
|
)
|
||||||
|
|
||||||
|
if not response.ok:
|
||||||
|
return True, [f"API Error: {response.status_code} - {response.text}"]
|
||||||
|
|
||||||
|
data = response.json()
|
||||||
|
if not data.get("success"):
|
||||||
|
return True, [f"API Error: {data.get('errors', 'Unknown error')}"]
|
||||||
|
|
||||||
|
ssl_mode = data["result"]["value"]
|
||||||
|
|
||||||
|
# Check Always Use HTTPS setting
|
||||||
|
https_response = requests.get(
|
||||||
|
f"https://api.cloudflare.com/client/v4/zones/{zone_id}/settings/always_use_https",
|
||||||
|
headers={"X-Auth-Email": email, "X-Auth-Key": api_key},
|
||||||
|
timeout=30
|
||||||
|
)
|
||||||
|
|
||||||
|
always_https = "off"
|
||||||
|
if https_response.ok:
|
||||||
|
https_data = https_response.json()
|
||||||
|
if https_data.get("success"):
|
||||||
|
always_https = https_data["result"]["value"]
|
||||||
|
|
||||||
|
# Analyze configuration
|
||||||
|
if ssl_mode == "flexible":
|
||||||
|
issues.append(
|
||||||
|
f"⚠️ SSL Mode is 'flexible' - this can cause redirect loops if your origin "
|
||||||
|
f"server enforces HTTPS (common with GitHub Pages, Netlify, Vercel, etc.)"
|
||||||
|
)
|
||||||
|
issues.append(
|
||||||
|
" Recommendation: Change SSL mode to 'full' or 'full (strict)' if your "
|
||||||
|
"origin supports HTTPS"
|
||||||
|
)
|
||||||
|
|
||||||
|
if ssl_mode == "off":
|
||||||
|
issues.append("⚠️ SSL is disabled - visitors will see 'Not Secure' warnings")
|
||||||
|
|
||||||
|
# Report current configuration
|
||||||
|
if not issues:
|
||||||
|
issues.append(f"✅ SSL Mode: {ssl_mode} - Configuration looks good")
|
||||||
|
issues.append(f" Always Use HTTPS: {always_https}")
|
||||||
|
|
||||||
|
return len([i for i in issues if i.startswith("⚠️")]) > 0, issues
|
||||||
|
|
||||||
|
except requests.RequestException as e:
|
||||||
|
return True, [f"Network Error: {str(e)}"]
|
||||||
|
except Exception as e:
|
||||||
|
return True, [f"Unexpected Error: {str(e)}"]
|
||||||
|
|
||||||
|
|
||||||
|
def check_dns_records(
|
||||||
|
zone_id: str, domain: str, email: str, api_key: str
|
||||||
|
) -> Tuple[bool, List[str]]:
|
||||||
|
"""
|
||||||
|
Check DNS configuration for common issues.
|
||||||
|
|
||||||
|
Returns: (has_issues, issues_list)
|
||||||
|
"""
|
||||||
|
try:
|
||||||
|
import requests
|
||||||
|
except ImportError:
|
||||||
|
return True, ["Error: 'requests' library not installed"]
|
||||||
|
|
||||||
|
issues = []
|
||||||
|
|
||||||
|
try:
|
||||||
|
response = requests.get(
|
||||||
|
f"https://api.cloudflare.com/client/v4/zones/{zone_id}/dns_records",
|
||||||
|
headers={"X-Auth-Email": email, "X-Auth-Key": api_key},
|
||||||
|
timeout=30
|
||||||
|
)
|
||||||
|
|
||||||
|
if not response.ok:
|
||||||
|
return True, [f"API Error: {response.status_code}"]
|
||||||
|
|
||||||
|
data = response.json()
|
||||||
|
if not data.get("success"):
|
||||||
|
return True, [f"API Error: {data.get('errors')}"]
|
||||||
|
|
||||||
|
records = data["result"]
|
||||||
|
|
||||||
|
# Check for root domain records
|
||||||
|
root_records = [r for r in records if r["name"] == domain]
|
||||||
|
if not root_records:
|
||||||
|
issues.append(f"⚠️ No DNS records found for root domain '{domain}'")
|
||||||
|
|
||||||
|
# Check proxy status
|
||||||
|
proxied_records = [r for r in records if r.get("proxied")]
|
||||||
|
if proxied_records:
|
||||||
|
issues.append(f"✅ Found {len(proxied_records)} proxied record(s) (Cloudflare CDN enabled)")
|
||||||
|
|
||||||
|
unproxied_important = [
|
||||||
|
r for r in records
|
||||||
|
if not r.get("proxied") and r["type"] in ["A", "AAAA", "CNAME"]
|
||||||
|
]
|
||||||
|
if unproxied_important:
|
||||||
|
issues.append(
|
||||||
|
f"ℹ️ Found {len(unproxied_important)} non-proxied record(s) - "
|
||||||
|
"these bypass Cloudflare's CDN and security features"
|
||||||
|
)
|
||||||
|
|
||||||
|
return len([i for i in issues if i.startswith("⚠️")]) > 0, issues
|
||||||
|
|
||||||
|
except Exception as e:
|
||||||
|
return True, [f"Error checking DNS: {str(e)}"]
|
||||||
|
|
||||||
|
|
||||||
|
def check_page_rules(
|
||||||
|
zone_id: str, email: str, api_key: str
|
||||||
|
) -> Tuple[bool, List[str]]:
|
||||||
|
"""
|
||||||
|
Check Page Rules for potential redirect loops.
|
||||||
|
|
||||||
|
Returns: (has_issues, issues_list)
|
||||||
|
"""
|
||||||
|
try:
|
||||||
|
import requests
|
||||||
|
except ImportError:
|
||||||
|
return True, ["Error: 'requests' library not installed"]
|
||||||
|
|
||||||
|
issues = []
|
||||||
|
|
||||||
|
try:
|
||||||
|
response = requests.get(
|
||||||
|
f"https://api.cloudflare.com/client/v4/zones/{zone_id}/pagerules",
|
||||||
|
headers={"X-Auth-Email": email, "X-Auth-Key": api_key},
|
||||||
|
timeout=30
|
||||||
|
)
|
||||||
|
|
||||||
|
if not response.ok:
|
||||||
|
return True, [f"API Error: {response.status_code}"]
|
||||||
|
|
||||||
|
data = response.json()
|
||||||
|
if not data.get("success"):
|
||||||
|
return True, [f"API Error: {data.get('errors')}"]
|
||||||
|
|
||||||
|
rules = data["result"]
|
||||||
|
|
||||||
|
if not rules:
|
||||||
|
issues.append("✅ No Page Rules configured")
|
||||||
|
return False, issues
|
||||||
|
|
||||||
|
# Check for redirect rules
|
||||||
|
redirect_rules = []
|
||||||
|
for rule in rules:
|
||||||
|
actions = rule.get("actions", [])
|
||||||
|
for action in actions:
|
||||||
|
if action.get("id") in ["forwarding_url", "always_use_https"]:
|
||||||
|
redirect_rules.append({
|
||||||
|
"url": rule.get("targets", [{}])[0].get("constraint", {}).get("value"),
|
||||||
|
"action": action.get("id"),
|
||||||
|
"status": rule.get("status")
|
||||||
|
})
|
||||||
|
|
||||||
|
if redirect_rules:
|
||||||
|
issues.append(f"ℹ️ Found {len(redirect_rules)} redirect Page Rule(s):")
|
||||||
|
for r in redirect_rules:
|
||||||
|
issues.append(f" - {r['url']}: {r['action']} (status: {r['status']})")
|
||||||
|
issues.append(
|
||||||
|
" Note: Conflicting redirect rules can cause redirect loops"
|
||||||
|
)
|
||||||
|
else:
|
||||||
|
issues.append("✅ No redirect Page Rules found")
|
||||||
|
|
||||||
|
return False, issues
|
||||||
|
|
||||||
|
except Exception as e:
|
||||||
|
return True, [f"Error checking Page Rules: {str(e)}"]
|
||||||
|
|
||||||
|
|
||||||
|
def main():
|
||||||
|
"""Main diagnostic function."""
|
||||||
|
if len(sys.argv) < 4:
|
||||||
|
print("Usage: python check_cloudflare_config.py <domain> <email> <api_key>")
|
||||||
|
print("\nExample:")
|
||||||
|
print(" python check_cloudflare_config.py typeof.tech user@example.com abc123...")
|
||||||
|
print("\nGet your Global API Key from:")
|
||||||
|
print(" https://dash.cloudflare.com/profile/api-tokens")
|
||||||
|
sys.exit(1)
|
||||||
|
|
||||||
|
domain = sys.argv[1]
|
||||||
|
email = sys.argv[2]
|
||||||
|
api_key = sys.argv[3]
|
||||||
|
|
||||||
|
try:
|
||||||
|
import requests
|
||||||
|
except ImportError:
|
||||||
|
print("Error: 'requests' library not found")
|
||||||
|
print("Install with: pip install requests")
|
||||||
|
sys.exit(1)
|
||||||
|
|
||||||
|
print(f"\n🔍 Checking Cloudflare configuration for: {domain}\n")
|
||||||
|
print("=" * 60)
|
||||||
|
|
||||||
|
# Get zone ID
|
||||||
|
try:
|
||||||
|
response = requests.get(
|
||||||
|
f"https://api.cloudflare.com/client/v4/zones?name={domain}",
|
||||||
|
headers={"X-Auth-Email": email, "X-Auth-Key": api_key},
|
||||||
|
timeout=30
|
||||||
|
)
|
||||||
|
|
||||||
|
if not response.ok:
|
||||||
|
print(f"❌ API Error: {response.status_code}")
|
||||||
|
sys.exit(1)
|
||||||
|
|
||||||
|
data = response.json()
|
||||||
|
if not data.get("success") or not data.get("result"):
|
||||||
|
print(f"❌ Domain '{domain}' not found in your Cloudflare account")
|
||||||
|
sys.exit(1)
|
||||||
|
|
||||||
|
zone_id = data["result"][0]["id"]
|
||||||
|
print(f"✅ Found zone: {domain} (ID: {zone_id})\n")
|
||||||
|
|
||||||
|
except requests.RequestException as e:
|
||||||
|
print(f"❌ Network error: {e}")
|
||||||
|
sys.exit(1)
|
||||||
|
|
||||||
|
# Run all checks
|
||||||
|
all_issues = []
|
||||||
|
|
||||||
|
print("\n📋 SSL/TLS Configuration:")
|
||||||
|
print("-" * 60)
|
||||||
|
has_ssl_issues, ssl_issues = check_ssl_configuration(zone_id, email, api_key)
|
||||||
|
for issue in ssl_issues:
|
||||||
|
print(issue)
|
||||||
|
|
||||||
|
print("\n📋 DNS Configuration:")
|
||||||
|
print("-" * 60)
|
||||||
|
has_dns_issues, dns_issues = check_dns_records(zone_id, domain, email, api_key)
|
||||||
|
for issue in dns_issues:
|
||||||
|
print(issue)
|
||||||
|
|
||||||
|
print("\n📋 Page Rules:")
|
||||||
|
print("-" * 60)
|
||||||
|
has_rules_issues, rules_issues = check_page_rules(zone_id, email, api_key)
|
||||||
|
for issue in rules_issues:
|
||||||
|
print(issue)
|
||||||
|
|
||||||
|
# Summary
|
||||||
|
print("\n" + "=" * 60)
|
||||||
|
if has_ssl_issues or has_dns_issues or has_rules_issues:
|
||||||
|
print("⚠️ Issues found - review the warnings above")
|
||||||
|
sys.exit(1)
|
||||||
|
else:
|
||||||
|
print("✅ No critical issues detected!")
|
||||||
|
sys.exit(0)
|
||||||
|
|
||||||
|
|
||||||
|
if __name__ == "__main__":
|
||||||
|
main()
|
||||||
186
skills/cloudflare-troubleshooting/scripts/fix_ssl_mode.py
Normal file
186
skills/cloudflare-troubleshooting/scripts/fix_ssl_mode.py
Normal file
@@ -0,0 +1,186 @@
|
|||||||
|
#!/usr/bin/env python3
|
||||||
|
"""
|
||||||
|
Fix Cloudflare SSL/TLS mode to resolve redirect loops.
|
||||||
|
|
||||||
|
This script changes the SSL mode to resolve common redirect loop issues
|
||||||
|
caused by SSL mode mismatches between Cloudflare and origin servers.
|
||||||
|
|
||||||
|
Common scenarios:
|
||||||
|
- GitHub Pages + Flexible mode → Change to Full
|
||||||
|
- Netlify/Vercel + Flexible mode → Change to Full
|
||||||
|
- Any HTTPS-enforcing origin + Flexible mode → Change to Full
|
||||||
|
|
||||||
|
Requires:
|
||||||
|
- requests library
|
||||||
|
- Cloudflare API credentials
|
||||||
|
"""
|
||||||
|
|
||||||
|
import sys
|
||||||
|
|
||||||
|
|
||||||
|
def fix_ssl_mode(zone_id: str, target_mode: str, email: str, api_key: str) -> bool:
|
||||||
|
"""
|
||||||
|
Change SSL mode for a zone.
|
||||||
|
|
||||||
|
Args:
|
||||||
|
zone_id: Cloudflare zone ID
|
||||||
|
target_mode: Target SSL mode ('flexible', 'full', 'full_strict', 'off')
|
||||||
|
email: Cloudflare account email
|
||||||
|
api_key: Cloudflare Global API Key
|
||||||
|
|
||||||
|
Returns:
|
||||||
|
True if successful, False otherwise
|
||||||
|
"""
|
||||||
|
try:
|
||||||
|
import requests
|
||||||
|
except ImportError:
|
||||||
|
print("Error: 'requests' library not installed")
|
||||||
|
print("Install with: pip install requests")
|
||||||
|
return False
|
||||||
|
|
||||||
|
# Validate mode
|
||||||
|
valid_modes = ["flexible", "full", "strict", "off"]
|
||||||
|
if target_mode not in valid_modes:
|
||||||
|
print(f"Error: Invalid SSL mode '{target_mode}'")
|
||||||
|
print(f"Valid modes: {', '.join(valid_modes)}")
|
||||||
|
return False
|
||||||
|
|
||||||
|
# Note: API uses 'strict' but documentation calls it 'full (strict)'
|
||||||
|
api_mode = target_mode
|
||||||
|
|
||||||
|
try:
|
||||||
|
response = requests.patch(
|
||||||
|
f"https://api.cloudflare.com/client/v4/zones/{zone_id}/settings/ssl",
|
||||||
|
headers={
|
||||||
|
"X-Auth-Email": email,
|
||||||
|
"X-Auth-Key": api_key,
|
||||||
|
"Content-Type": "application/json"
|
||||||
|
},
|
||||||
|
json={"value": api_mode},
|
||||||
|
timeout=30
|
||||||
|
)
|
||||||
|
|
||||||
|
if not response.ok:
|
||||||
|
print(f"❌ API Error: {response.status_code}")
|
||||||
|
print(f"Response: {response.text}")
|
||||||
|
return False
|
||||||
|
|
||||||
|
data = response.json()
|
||||||
|
|
||||||
|
if not data.get("success"):
|
||||||
|
print(f"❌ Failed to update SSL mode")
|
||||||
|
print(f"Errors: {data.get('errors', 'Unknown error')}")
|
||||||
|
return False
|
||||||
|
|
||||||
|
new_mode = data["result"]["value"]
|
||||||
|
print(f"✅ SSL mode successfully changed to: {new_mode}")
|
||||||
|
print(f"\n⏳ Cloudflare is updating edge servers (typically takes 10-30 seconds)")
|
||||||
|
print(f"💡 Recommendation: Clear your browser cache or use incognito mode to test")
|
||||||
|
|
||||||
|
return True
|
||||||
|
|
||||||
|
except Exception as e:
|
||||||
|
print(f"❌ Error: {str(e)}")
|
||||||
|
return False
|
||||||
|
|
||||||
|
|
||||||
|
def purge_cache(zone_id: str, email: str, api_key: str) -> bool:
|
||||||
|
"""Purge all Cloudflare cache for the zone."""
|
||||||
|
try:
|
||||||
|
import requests
|
||||||
|
except ImportError:
|
||||||
|
return False
|
||||||
|
|
||||||
|
try:
|
||||||
|
response = requests.post(
|
||||||
|
f"https://api.cloudflare.com/client/v4/zones/{zone_id}/purge_cache",
|
||||||
|
headers={
|
||||||
|
"X-Auth-Email": email,
|
||||||
|
"X-Auth-Key": api_key,
|
||||||
|
"Content-Type": "application/json"
|
||||||
|
},
|
||||||
|
json={"purge_everything": True},
|
||||||
|
timeout=30
|
||||||
|
)
|
||||||
|
|
||||||
|
if response.ok and response.json().get("success"):
|
||||||
|
print("✅ Cache purged successfully")
|
||||||
|
return True
|
||||||
|
|
||||||
|
return False
|
||||||
|
|
||||||
|
except Exception:
|
||||||
|
return False
|
||||||
|
|
||||||
|
|
||||||
|
def main():
|
||||||
|
"""Main function."""
|
||||||
|
if len(sys.argv) < 5:
|
||||||
|
print("Usage: python fix_ssl_mode.py <domain> <email> <api_key> <mode> [--purge-cache]")
|
||||||
|
print("\nSSL Modes:")
|
||||||
|
print(" flexible - Cloudflare → Origin uses HTTP (can cause loops with HTTPS origins)")
|
||||||
|
print(" full - Cloudflare → Origin uses HTTPS (recommended for most origins)")
|
||||||
|
print(" strict - Full + validates origin certificate (most secure)")
|
||||||
|
print(" off - No encryption (not recommended)")
|
||||||
|
print("\nExamples:")
|
||||||
|
print(" # Fix redirect loop for GitHub Pages")
|
||||||
|
print(" python fix_ssl_mode.py typeof.tech user@example.com abc123... full --purge-cache")
|
||||||
|
print("\n # Switch to strict mode")
|
||||||
|
print(" python fix_ssl_mode.py example.com user@example.com abc123... strict")
|
||||||
|
sys.exit(1)
|
||||||
|
|
||||||
|
domain = sys.argv[1]
|
||||||
|
email = sys.argv[2]
|
||||||
|
api_key = sys.argv[3]
|
||||||
|
target_mode = sys.argv[4]
|
||||||
|
should_purge = "--purge-cache" in sys.argv
|
||||||
|
|
||||||
|
try:
|
||||||
|
import requests
|
||||||
|
except ImportError:
|
||||||
|
print("Error: 'requests' library not found")
|
||||||
|
print("Install with: pip install requests")
|
||||||
|
sys.exit(1)
|
||||||
|
|
||||||
|
print(f"\n🔧 Fixing SSL configuration for: {domain}")
|
||||||
|
print("=" * 60)
|
||||||
|
|
||||||
|
# Get zone ID
|
||||||
|
try:
|
||||||
|
response = requests.get(
|
||||||
|
f"https://api.cloudflare.com/client/v4/zones?name={domain}",
|
||||||
|
headers={"X-Auth-Email": email, "X-Auth-Key": api_key},
|
||||||
|
timeout=30
|
||||||
|
)
|
||||||
|
|
||||||
|
if not response.ok:
|
||||||
|
print(f"❌ API Error: {response.status_code}")
|
||||||
|
sys.exit(1)
|
||||||
|
|
||||||
|
data = response.json()
|
||||||
|
if not data.get("success") or not data.get("result"):
|
||||||
|
print(f"❌ Domain '{domain}' not found in your Cloudflare account")
|
||||||
|
sys.exit(1)
|
||||||
|
|
||||||
|
zone_id = data["result"][0]["id"]
|
||||||
|
print(f"✅ Found zone: {domain}\n")
|
||||||
|
|
||||||
|
except requests.RequestException as e:
|
||||||
|
print(f"❌ Network error: {e}")
|
||||||
|
sys.exit(1)
|
||||||
|
|
||||||
|
# Fix SSL mode
|
||||||
|
if not fix_ssl_mode(zone_id, target_mode, email, api_key):
|
||||||
|
sys.exit(1)
|
||||||
|
|
||||||
|
# Optionally purge cache
|
||||||
|
if should_purge:
|
||||||
|
print(f"\n🗑️ Purging cache...")
|
||||||
|
purge_cache(zone_id, email, api_key)
|
||||||
|
|
||||||
|
print("\n✅ Done! Test your site after 30 seconds.")
|
||||||
|
sys.exit(0)
|
||||||
|
|
||||||
|
|
||||||
|
if __name__ == "__main__":
|
||||||
|
main()
|
||||||
Reference in New Issue
Block a user