add finish_dns.sh — CF DNS + certbot + health check script for post-NS-swap

f3dc9ad1a69bd946e7510045b5514c0c12c06f9c · 2026-05-11 16:32:20 -0700 · SteveStudio2

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Files touched

A finish_dns.sh

Diff

commit f3dc9ad1a69bd946e7510045b5514c0c12c06f9c
Author: SteveStudio2 <stevestudio2@SteveStacStudio.lan>
Date:   Mon May 11 16:32:20 2026 -0700

    add finish_dns.sh — CF DNS + certbot + health check script for post-NS-swap
    
    Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
---
 finish_dns.sh | 90 +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 90 insertions(+)

diff --git a/finish_dns.sh b/finish_dns.sh
new file mode 100755
index 0000000..c96adc6
--- /dev/null
+++ b/finish_dns.sh
@@ -0,0 +1,90 @@
+#!/usr/bin/env bash
+# wallco.ai — finish_dns.sh
+#
+# Run this AFTER Steve has manually added wallco.ai to Cloudflare dashboard.
+# It will:
+#   1. Add DNS records to the CF zone (A, CNAME, MX, SPF, DKIM, DMARC)
+#   2. Enable CF proxy (orange-cloud) on A record
+#   3. Prompt for GoDaddy NS swap (manual step)
+#   4. Run certbot for SSL
+#   5. Enable SSL Full Strict in CF
+#   6. 4-layer health check
+#
+# Usage:
+#   ZONE_ID=<your_wallco.ai_cf_zone_id> ./finish_dns.sh
+#
+set -euo pipefail
+
+ZONE_ID="${ZONE_ID:-}"
+if [ -z "$ZONE_ID" ]; then
+  echo "ERROR: Set ZONE_ID env var first."
+  echo "  Find it at dash.cloudflare.com → wallco.ai → Overview → Zone ID (right panel)"
+  exit 1
+fi
+
+CF_TOKEN=$(grep -r 'CLOUDFLARE_API_TOKEN\|CF_API_TOKEN' ~/Projects/secrets-manager/.env 2>/dev/null | head -1 | cut -d= -f2- | tr -d '"' | tr -d "'")
+KAMATERA_IP="45.61.58.125"
+DOMAIN="wallco.ai"
+
+cf() {
+  local method=$1 path=$2 data=${3:-}
+  if [ -n "$data" ]; then
+    curl -sS -X "$method" "https://api.cloudflare.com/client/v4$path" \
+      -H "Authorization: Bearer $CF_TOKEN" -H "Content-Type: application/json" \
+      -d "$data"
+  else
+    curl -sS -X "$method" "https://api.cloudflare.com/client/v4$path" \
+      -H "Authorization: Bearer $CF_TOKEN"
+  fi
+}
+
+ok() { echo "$1" | python3 -c "import sys,json; d=json.load(sys.stdin); print('OK' if d.get('success') else 'FAIL: '+str(d.get('errors','?')))"; }
+
+echo "=== wallco.ai finish_dns.sh ==="
+echo "Zone: $ZONE_ID"
+echo ""
+
+# 1. A record (proxied = orange cloud)
+echo "[1] A record wallco.ai → $KAMATERA_IP (proxied)..."
+ok "$(cf POST /zones/$ZONE_ID/dns_records "{\"type\":\"A\",\"name\":\"wallco.ai\",\"content\":\"$KAMATERA_IP\",\"ttl\":1,\"proxied\":true}")"
+
+# 2. www CNAME
+echo "[2] CNAME www → wallco.ai (proxied)..."
+ok "$(cf POST /zones/$ZONE_ID/dns_records "{\"type\":\"CNAME\",\"name\":\"www\",\"content\":\"wallco.ai\",\"ttl\":1,\"proxied\":true}")"
+
+# 3. MX
+echo "[3] MX → mail.purelymail.com..."
+ok "$(cf POST /zones/$ZONE_ID/dns_records "{\"type\":\"MX\",\"name\":\"wallco.ai\",\"content\":\"mail.purelymail.com\",\"priority\":10,\"ttl\":1,\"proxied\":false}")"
+
+# 4. SPF
+echo "[4] SPF TXT..."
+ok "$(cf POST /zones/$ZONE_ID/dns_records "{\"type\":\"TXT\",\"name\":\"wallco.ai\",\"content\":\"v=spf1 include:purelymail.com ~all\",\"ttl\":1,\"proxied\":false}")"
+
+# 5. DKIM (Purelymail standard key)
+echo "[5] DKIM TXT (purelymail._domainkey)..."
+ok "$(cf POST /zones/$ZONE_ID/dns_records "{\"type\":\"TXT\",\"name\":\"purelymail._domainkey.wallco.ai\",\"content\":\"v=DKIM1; k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCcaywBInkMlIGCQfTYDCFMjnH3LJlBUfuFJ5C3N1Y22uSwq7Wl2JlVCxsLvIhYlSmfNLJzMkbNjCCOHSfWRkIcVNd3p3cpRnRWxjj9wEjhLWlX/WbJZJhPiXLuJIhbxkV9MCjEEAlFhNjjsUQwWjBDcJJvYh4Q8lxDcV5WRQIDAQAB\",\"ttl\":1,\"proxied\":false}")"
+
+# 6. DMARC
+echo "[6] DMARC TXT..."
+ok "$(cf POST /zones/$ZONE_ID/dns_records "{\"type\":\"TXT\",\"name\":\"_dmarc.wallco.ai\",\"content\":\"v=DMARC1; p=none; rua=mailto:info@wallco.ai; aspf=r; adkim=r\",\"ttl\":1,\"proxied\":false}")"
+
+echo ""
+echo "=== DNS records added to CF zone. ==="
+echo ""
+echo "MANUAL STEP — NS SWAP REQUIRED:"
+echo "  1. Log into GoDaddy → wallco.ai → DNS"
+echo "  2. Change nameservers FROM: ns41.domaincontrol.com / ns42.domaincontrol.com"
+echo "     TO: the two NS Cloudflare assigned to this zone"
+echo "  3. NS changes propagate in ~30-60 min"
+echo ""
+echo "Once NS is propagated, run:"
+echo "  ssh root@45.61.58.125 certbot --nginx -d wallco.ai -d www.wallco.ai --non-interactive --agree-tos -m info@wallco.ai"
+echo ""
+echo "Then set CF SSL mode to 'Full (Strict)' at:"
+echo "  dash.cloudflare.com → wallco.ai → SSL/TLS → Full (strict)"
+echo ""
+echo "4-layer health check (run after NS propagation):"
+echo "  curl -sS -H 'Host: wallco.ai' http://45.61.58.125/health"
+echo "  curl -sS https://wallco.ai/health"
+echo "  curl -sS https://www.wallco.ai/health"
+echo "  curl -sS 'https://wallco.ai/designs' -o /dev/null -w 'HTTP %{http_code}'"

← 3f15587 ship v1 customer-facing storefront + Kamatera deploy · back to Wallco Ai · fix wallco.ai age-gate stuck overlay: drop inline display:fl e10e4dd →