Cloudflare token
Ramphast writes your environments’ DNS records, your clients’ own domains and, for servers without a public IP, their tunnels, in your Cloudflare account. You give it one token in Settings → Domain and DNS, together with the Zone ID of your domain. The Zone ID is under your domain’s Overview → API in Cloudflare; the Account ID beside it is a different string, and with it every call fails.
Create the token as an account token, under Manage account → Account API tokens, rather than as a user token: it keeps working when the person who made it leaves. Give it these policies:
| Policy | Resources | Permissions | Used for |
|---|---|---|---|
| 1 | Specific zone: your domain | DNS · Edit, SSL and Certificates · Edit, Zone · Read | Your environments’ names, and your clients’ own domains |
| 2 | Specific zone: your domain | Email Routing Rules · Edit, Zone Settings · Edit | Incoming mail |
| 3 | Entire Account | Workers Scripts · Edit | Incoming mail: the worker that receives it |
| 4 | Entire Account | Cloudflare Tunnel · Edit | The tunnels of servers without a public IP |
- Policies 1 and 2 can be a single policy. Policies 3 and 4 must cover the entire account: a permission on the account inside a policy limited to the zone is refused.
- Without incoming mail you need neither 2 nor 3, and without servers behind NAT you do not need 4.
- Editing a token in Cloudflare does not change its value, so after adding a permission you do not need to enter it again in Ramphast.