p24-infra Docs

cloudflare-pinbox24-onboarding

4 min read

Playbook: Onboarding pinbox24.com to Cloudflare + Enable AI Labyrinth

Issue: #986 Status: Blocked on human action (NS transfer at registrar) Created: 2026-06-23

What this solves

pinbox24.com is currently hosted on OVH bms-1 (94.23.26.113) with no Cloudflare proxy. Cloudflare’s AI Labyrinth (Bot Fight Mode feature) cannot be enabled until the domain is managed in Cloudflare. This playbook covers the full onboarding sequence.

Prerequisites

  • Access to the pinbox24.com domain registrar (wherever the domain was registered)
  • Cloudflare account: radieu@gmail.com (https://dash.cloudflare.com)
  • SSH to bms-1: ssh root@94.23.26.113 (key: C:\Users\konar\.ssh\id_ed25519)

Phase 1 — Human steps (registrar + Cloudflare dashboard)

1. Add pinbox24.com to Cloudflare

  1. Log in to https://dash.cloudflare.com
  2. Click Add a site → enter pinbox24.com → choose Free plan
  3. Cloudflare scans existing DNS records — review and confirm they match:
    • A @ 94.23.26.113 (root domain → bms-1)
    • A www 94.23.26.113 (www → bms-1)
    • Any other subdomains in use (check bms-1 nginx-proxy containers for virtual hosts)
  4. Cloudflare assigns two nameservers (e.g. xxx.ns.cloudflare.com)

2. Transfer nameservers at the registrar

  1. Log in to the registrar where pinbox24.com was registered
  2. Change the NS records to the two Cloudflare nameservers from step above
  3. Propagation typically takes 5–30 minutes (up to 48h in worst case)

3. Verify NS propagation

# Run on dev workstation — repeat until you see Cloudflare NS
Resolve-DnsName pinbox24.com -Type NS | Select-Object NameHost

Expected: xxx.ns.cloudflare.com, yyy.ns.cloudflare.com

4. Set SSL mode to Full (Strict)

In Cloudflare dashboard: SSL/TLS → Overview → set to Full (Strict)

This requires a valid cert on bms-1 (Let’s Encrypt is fine). Do NOT use Flexible — it allows downgrade attacks.

5. Enable Bot Fight Mode

In Cloudflare dashboard: Security → Bots → enable Bot Fight Mode

6. Enable AI Labyrinth

In Cloudflare dashboard: Security → Bots → enable AI Labyrinth

Phase 2 — Automated steps (after NS propagation confirmed)

Step A — Get the new pinbox24.com zone ID

$env:SOPS_AGE_KEY_FILE = "C:\Users\konar\.age\p24-infra-keys.txt"
$envVars = @{}
(sops --decrypt --input-type dotenv --output-type dotenv "C:\code_2026\p24-infra\secrets\monitoring.env.sops") | ForEach-Object {
    if ($_ -match '^([^#=]+)=(.*)$') { $envVars[$Matches[1].Trim()] = $Matches[2].Trim() }
}
$cfToken = $envVars['CF_API_TOKEN']
$headers = @{ "Authorization" = "Bearer $cfToken"; "Content-Type" = "application/json" }
$zones = Invoke-RestMethod -Uri "https://api.cloudflare.com/client/v4/zones?name=pinbox24.com" -Method GET -Headers $headers
$pinbox24ZoneId = $zones.result[0].id
Write-Host "pinbox24.com zone ID: $pinbox24ZoneId"

Step B — Add CF_ZONE_ID_PINBOX24 to SOPS

# Decrypt, append, re-encrypt monitoring.env.sops
$env:SOPS_AGE_KEY_FILE = "C:\Users\konar\.age\p24-infra-keys.txt"
sops --decrypt --input-type dotenv --output-type dotenv secrets\monitoring.env.sops |
  Out-File secrets\monitoring-edit.env -Encoding utf8
 
# Append the new zone ID (replace ZONE_ID_VALUE with actual value from Step A)
Add-Content secrets\monitoring-edit.env "CF_ZONE_ID_PINBOX24=ZONE_ID_VALUE"
 
$enc = sops --encrypt --input-type dotenv --output-type dotenv secrets\monitoring-edit.env
[System.IO.File]::WriteAllText("$PWD\secrets\monitoring.env.sops", ($enc -join "`n") + "`n",
  [System.Text.UTF8Encoding]::new($false))
Remove-Item secrets\monitoring-edit.env -Force

Step C — Enable Bot Fight Mode via API

# Run AFTER pinbox24.com is active in Cloudflare
$headers = @{ "Authorization" = "Bearer $cfToken"; "Content-Type" = "application/json" }
 
# Enable Bot Fight Mode (super_bot_fight_mode_definitely_not_a_bot)
$body = '{"id":"bic","value":"on"}' | ConvertFrom-Json | ConvertTo-Json
Invoke-RestMethod -Uri "https://api.cloudflare.com/client/v4/zones/$pinbox24ZoneId/settings/bot_fight_mode" `
  -Method PATCH -Headers $headers `
  -Body '{"value":"on"}'

Note: AI Labyrinth is enabled via the dashboard toggle (Security → Bots → AI Labyrinth). As of 2026-06-23, there is no dedicated API endpoint for the AI Labyrinth sub-toggle separate from Bot Fight Mode — it is toggled via the Cloudflare dashboard only.

Step D — Fix bms-1 nginx real-IP for Cloudflare ranges

SSH to bms-1 and add real IP restoration for Cloudflare IP ranges to nginx config.

# SSH to bms-1
ssh root@94.23.26.113
 
# Create Cloudflare real-IP config file
cat > /etc/nginx/conf.d/cloudflare-realip.conf << 'EOF'
# Cloudflare real IP restoration
# IPv4 ranges from https://www.cloudflare.com/ips-v4/
set_real_ip_from 173.245.48.0/20;
set_real_ip_from 103.21.244.0/22;
set_real_ip_from 103.22.200.0/22;
set_real_ip_from 103.31.4.0/22;
set_real_ip_from 141.101.64.0/18;
set_real_ip_from 108.162.192.0/18;
set_real_ip_from 190.93.240.0/20;
set_real_ip_from 188.114.96.0/20;
set_real_ip_from 197.234.240.0/22;
set_real_ip_from 198.41.128.0/17;
set_real_ip_from 162.158.0.0/15;
set_real_ip_from 104.16.0.0/13;
set_real_ip_from 104.24.0.0/14;
set_real_ip_from 172.64.0.0/13;
set_real_ip_from 131.0.72.0/22;
# IPv6 ranges
set_real_ip_from 2400:cb00::/32;
set_real_ip_from 2606:4700::/32;
set_real_ip_from 2803:f800::/32;
set_real_ip_from 2405:b500::/32;
set_real_ip_from 2405:8100::/32;
set_real_ip_from 2a06:98c0::/29;
set_real_ip_from 2c0f:f248::/32;
real_ip_header CF-Connecting-IP;
EOF
 
# Test and reload nginx
nginx -t && nginx -s reload

Verification

After all steps:

# Verify Bot Fight Mode is ON
$response = Invoke-RestMethod -Uri "https://api.cloudflare.com/client/v4/zones/$pinbox24ZoneId/settings/bot_fight_mode" `
  -Method GET -Headers $headers
Write-Host "Bot Fight Mode: $($response.result.value)"
 
# Verify AI Labyrinth — check via dashboard Security > Bots

Escalation path

If NS transfer causes downtime:

  1. Check nginx on bms-1 is still serving directly: curl -H "Host: pinbox24.com" http://94.23.26.113
  2. Temporarily disable Cloudflare proxy (grey cloud) while troubleshooting
  3. Check Cloudflare dashboard for SSL errors → switch to Full (not Strict) temporarily

Prevention note

  • Keep Cloudflare IP ranges updated — they change periodically. Subscribe to https://www.cloudflare.com/ips/ RSS feed or set a calendar reminder to check quarterly.
  • After enabling Cloudflare proxy, monitor bms-1 error logs for 24h: tail -f /var/log/nginx/error.log (adjust path for docker nginx-proxy)

Graph View

Backlinks