Case 04689

Cloudflare

Manage Cloudflare zones, DNS, SSL, tunnels, and settings via the bundled scripts/cf.sh bash script.

Prerequisites

• curl, jq, and openssl must be available on the system
• Set CLOUDFLARE_API_TOKEN environment variable
• Optionally set CLOUDFLARE_ACCOUNT_ID for tunnel operations

CLI: scripts/cf.sh

All operations go through the bundled scripts/cf.sh bash script (included in this skill). No external downloads needed.

# Run from skill directory
./scripts/cf.sh <command> [args...]
# Or reference by absolute path
/path/to/skills/cloudflare/scripts/cf.sh <command> [args...]

Commands

Command	Args	Description
help		Show all commands
verify		Verify API token is valid
zones	[domain]	List zones (optionally filter by domain name)
zone-get	<zone_id>	Get zone details
zone-id	<domain>	Get zone ID from domain name
dns-list	<zone_id> [type] [name]	List DNS records
dns-create	<zone_id> <type> <name> <content> [proxied] [ttl]	Create DNS record
dns-update	<zone_id> <record_id> <type> <name> <content> [proxied] [ttl]	Update DNS record
dns-delete	<zone_id> <record_id>	Delete DNS record
dns-export	<zone_id>	Export all records as JSON
dns-import	<zone_id> <file.json>	Import records from JSON
settings-list	<zone_id>	List all zone settings
setting-get	<zone_id> <setting>	Get specific setting
setting-set	<zone_id> <setting> <value>	Update a setting
ssl-get	<zone_id>	Get current SSL mode
ssl-set	<zone_id> <mode>	Set SSL mode (off/flexible/full/strict)
cache-purge	<zone_id> [url1 url2 ...]	Purge specific URLs or everything
pagerules-list	<zone_id>	List page rules
firewall-list	<zone_id>	List firewall rules
tunnels-list		List Cloudflare Tunnels (needs ACCOUNT_ID)
tunnel-get	<tunnel_id>	Get tunnel details
tunnel-create	<name>	Create a tunnel (needs ACCOUNT_ID)
tunnel-delete	<tunnel_id>	Delete a tunnel (needs ACCOUNT_ID)
analytics	<zone_id> [since_minutes]	Zone analytics (default: last 24h)

Proxied flag

• true — orange cloud, traffic through Cloudflare (CDN, WAF, DDoS)
• false — grey cloud, DNS-only (use for MX, non-HTTP services)

TTL

• 1 = automatic (Cloudflare-managed)
• Set explicit seconds for DNS-only records (e.g., 3600)

Typical workflows

Point domain to server

# Find zone ID
cf zones example.com
# Create A record (proxied)
cf dns-create <zone_id> A example.com 1.2.3.4 true
# Create www CNAME
cf dns-create <zone_id> CNAME www.example.com example.com true

Set up email (MX + SPF)

cf dns-create <zone_id> MX example.com "mx.provider.com" false 1
cf dns-create <zone_id> TXT example.com "v=spf1 include:provider.com ~all" false

Enable strict SSL

cf ssl-set <zone_id> strict

Safety rules

Always confirm with the user before:

• Deleting DNS records (dns-delete)
• Changing SSL mode
• Modifying firewall rules
• Any destructive operation

Safe to do freely:

• Listing/reading zones, records, settings, analytics
• Verifying token

Reference

For DNS record types, SSL modes, and API details: see references/api-guide.md