cloudflare-migration-runbook

2 min read

Runbook — move pragalva.me DNS to Cloudflare (for vault Access)

Decision: going with Cloudflare Access for the vault, which requires Cloudflare to be the authoritative DNS for pragalva.me. Email on pragalva.me is not used, so this is a clean move with no email migration. Baseline + rollback: see dns-baseline-pragalva-me-2026-06-27.md. DNSSEC is OFF, so the flip and any rollback are clean.

Why it is safe: if the apex record is staged in Cloudflare before the nameserver flip, Namecheap and Cloudflare answer the apex identically during propagation, so the blog never blinks.

Phase A — move DNS (this is the part you asked about)

A1. Add the site to Cloudflare

  • Create a free Cloudflare account.
  • Add a site → pragalva.me → choose the Free plan.
  • Cloudflare scans your current DNS and imports what it finds.

A2. Fix the imported record set (compare against the baseline)

  • KEEP: A pragalva.me 76.76.21.21 — set it to DNS only (grey cloud), not proxied. Vercel does its own TLS; proxying it (orange cloud) causes SSL/redirect-loop grief.
  • DELETE: the MX records (eforward1..5.registrar-servers.com) and the TXT SPF (v=spf1 include:spf.efwd.registrar-servers.com ~all). Email is unused and these would be dead.
  • There is no www and no AAAA in the baseline. If Cloudflare added anything not in the baseline, remove it.

A3. Get your assigned nameservers

  • Cloudflare shows two nameservers like xxxx.ns.cloudflare.com. Copy both.

A4. Switch nameservers at Namecheap

  • Namecheap → Domain List → pragalva.me → Manage → Nameservers → Custom DNS.
  • Replace with the two Cloudflare nameservers. Save (wait for the green check).

A5. Activate

  • Back in Cloudflare, click “Done, check nameservers.” Cloudflare emails you when the zone is Active (usually minutes, up to ~24h).

Phase A — verify (do not skip)

  • dig NS pragalva.me → the two Cloudflare nameservers (not registrar-servers.com)
  • dig A pragalva.me → still 76.76.21.21
  • Open https://pragalva.me → blog loads, SSL valid

Rollback

  • Namecheap → Nameservers → Custom DNS → set back to dns1.registrar-servers.com and dns2.registrar-servers.com. Done.

Phase B — later, separate step (the actual gate)

Once DNS is settled on Cloudflare and the blog is verified:

  1. Deploy the vault (~/Desktop/projects/homelab-vault) to Cloudflare Pages.
  2. Add custom domain vault.pragalva.me (Pages creates the proxied record).
  3. Put Cloudflare Access in front of vault.pragalva.me with a login policy.

This is its own runbook when you get there.