Initial skills documentation — 25 categories, all SKILL.md + references + scripts

2026-07-15 17:42:20 -04:00
commit 1b4fcd4427
976 changed files with 188344 additions and 0 deletions
@@ -0,0 +1,62 @@
+# Cloudflare Portal Integration
+
+## API Token Setup
+
+The portal uses Cloudflare's v4 API for DNS management and (optionally) domain registration.
+
+### Minimum token: DNS Edit Only
+
+| Permission | Level | Why |
+|---|---|---|
+| Zone → DNS → Edit | All zones | View and manage DNS records |
+| Account → Account Settings → Read | All accounts | List zones, verify token |
+| TTL | Never expire | No unexpected lockouts |
+
+### Extended token: Add Registrar access
+
+To view domain expiry dates and purchase/transfer domains:
+
+| Additional Permission | Level | Why |
+|---|---|---|
+| Account → Domain Registration → Read | All accounts | View expiry, auto-renew status |
+| Account → Domain Registration → Edit | All accounts | Register new domains, toggle auto-renew |
+
+### Turnstile (public form protection)
+
+Turnstile is a separate widget key, NOT an API token. Generate at `dash.cloudflare.com → Turnstile → Add Widget`.
+
+## Portal Pages
+
+### DNS Zones page
+- Lists all zones with status, plan, record count
+- Links zones to portal customers by domain match
+- Record editor: view/edit/delete DNS records by type, name, content, TTL, proxy status
+
+### Registered Domains tab
+- Shows all domains registered through Cloudflare Registrar
+- Columns: domain, expiry date, auto-renew status, days left, linked customer
+- Color coding: green (90+ days), amber (<90 days), red (<30 days or expired)
+- Actions: Renew Now, Details, Register New Domain, Transfer Domain
+
+## API Usage
+
+```bash
+# Verify token
+curl -s https://api.cloudflare.com/client/v4/user/tokens/verify
+
+# List zones
+curl -s https://api.cloudflare.com/client/v4/zones -H "Authorization: Bearer $TOKEN"
+
+# List DNS records for a zone
+curl -s "https://api.cloudflare.com/client/v4/zones/$ZONE_ID/dns_records" -H "Authorization: Bearer $TOKEN"
+
+# List registered domains (needs registrar permission)
+curl -s "https://api.cloudflare.com/client/v4/accounts/$ACCOUNT_ID/registrar/domains" -H "Authorization: Bearer $TOKEN"
+```
+
+## Token Security
+
+- Store in `~/.hermes/.env` as `CLOUDFLARE_API_TOKEN=cfut_...`
+- Add to Wasabi backup scope (it's in .env which is in the live sync)
+- If registrar token is created as a separate token, store as `CLOUDFLARE_REGISTRAR_TOKEN=`
+- Turnstile site key and secret key stored in `.env` as `TURNSTILE_SITE_KEY` and `TURNSTILE_SECRET_KEY`