`README.md`

50 lines
# CF DNS migration

Move the DNS *management* of Steve's actively-used GoDaddy domains to Cloudflare
(domains stay **registered** at GoDaddy) so DNS + email become API-manageable.
GoDaddy retired the write side of its public API for this account, so it can only
be managed by hand in the dashboard today.

## Why
286 domains at GoDaddy, write-blocked API. Phase-0 inventory (`classified.csv`):
- **LIVE+EMAIL 193 · LIVE_SITE 52 · ON_CF 39 · EMAIL_ONLY 2** (nothing fully parked)
- Email: Purelymail 196 · **Google Workspace 5 (EXCLUDE)** · GoDaddy 2
- NS: GoDaddy 243 · Cloudflare 39

`worklist.csv` = the 241 GoDaddy-NS migration candidates (Workspace auto-excluded).

## ⚠️ Hard exclusions (never touch MX — Google Workspace)
`designerwallcoverings.com`, `studentdebtcrisis.com/.org`, `studentdebtcrisiscenter.com/.org`

## The one manual step
The **NS-swap is GoDaddy-dashboard-only** (unlock the domain, set nameservers to the
per-zone pair CF assigns). Everything else is automated. Staging a CF zone is **safe
and dormant** — the domain keeps its GoDaddy nameservers until the swap, so a staged
zone changes nothing live. Cutover is then instant + lossless because the zone is
already a faithful copy.

## Tool — `stage.py`
Reads each domain's LIVE GoDaddy records → ensures a CF zone → replicates records
**idempotently**, DNS-only (grey cloud, mirrors GoDaddy exactly). Structural guards
never create an invalid zone (CNAME-alone rule, DMARC/SPF singletons), so it's safe
to re-run and safe against already-curated zones.

```
python3 stage.py --dry-run homesonspec.com        # preview (no writes) — DEFAULT SAFE
python3 stage.py --from worklist.csv --limit 5     # LIVE-stage first 5 (gated)
python3 stage.py <domain> ...                      # LIVE-stage named domains (gated)
```
Never copies NS/SOA or GoDaddy's proprietary `_domainconnect`. Emits
`staged-nameservers.csv` = the NS-swap worklist (each domain → its CF nameservers).

## Runbook
1. **Phase 0** — done (`classified.csv`, `worklist.csv`).
2. **Phase 1 pilot — homesonspec.com**: zone already fully staged (dry-run = +0). Only
   the GoDaddy NS-swap remains → then `purelymail_add_domain` + `info@` routing rule.
3. **Phase 2** — `stage.py --from worklist.csv` (batches), then bulk NS-swap per batch
   in the GoDaddy dashboard from `staged-nameservers.csv`.
4. **Phase 3** — verify + SSL + a drift canary.

**Gating:** live staging (CF zone/record writes) and every NS-swap are DNS changes →
Steve-approved, run with named domains. Dry-run is always safe.