Last updated: 2026-05-08 UTC — getraxx landing project (#1369) + internal-docs split (#1367).
| CF Pages project | Custom domain | Audience | CF Access gate | Deploy workflow |
|---|---|---|---|---|
getraxx |
getraxx.com + www.getraxx.com |
Public (marketing) | None — public | deploy-getraxx.yml |
raxx-docs |
docs.raxx.app |
Public (customers) | None — public | deploy-customer-docs.yml |
raxx-internal-docs |
internal-docs.raxx.app |
Operator only | Email allowlist (kris@moosequest.net) |
deploy-internal-docs.yml |
raxx-mockups |
raxx-mockups.pages.dev (no custom domain) |
Operator only | CF Access (pages.dev gate) | deploy-mockups.yml |
raxx-antlers |
app.raxx.app |
Public (customers) | None — public | deploy-antlers.yml |
raxx-console |
console.raxx.app |
Operator only | CF Access | deploy-console.yml |
raxx-console-shim |
console-staging.raxx.app |
Operator only | CF Access | deploy-console-shim.yml |
raxx-status |
status.raxx.app |
Public | None | deploy-status-page.yml |
internal-docs.raxx.app was attached to the raxx-mockups project as a custom
domain. The mockups build script (mockups-site/build.sh) was extended to also
build dist/internal-docs/ by running scripts/build-internal-docs.py. CF Pages
_redirects rules rewrote internal-docs.raxx.app/* to /internal-docs/:splat
so that visiting the docs domain did not land on the mockups root index.
The cohabitation approach caused user-facing confusion: internal-docs.raxx.app/
showed the mockups gallery, not the docs, whenever CF Pages served the project
root instead of applying the redirect. The fix:
raxx-internal-docs created for internal docs only.deploy-internal-docs.yml updated to deploy dist/internal-docs/ (not
dist/) to raxx-internal-docs.deploy-mockups.yml created to own dist/ → raxx-mockups deploys.internal-docs.raxx.app updated from raxx-mockups.pages.dev to
raxx-internal-docs.pages.dev (idempotent via CF API in the workflow).raxx-internal-docs matching the existing
email-allowlist policy (kris@moosequest.net)._redirects rules in mockups-site/_redirects that rewrote
internal-docs.raxx.app/* requests are no longer needed; the file is
retained with the rules removed.Resolved the 403 reported in #1368 (RCA: CF Pages project named getraxx did not
exist; DNS CNAME pointed to getraxx.pages.dev with no matching project).
frontend/getraxx-landing/ extracted from
feature/brand-tokens-getraxx-landing commit a837db0. Uses Vite + React,
not the Antlers CRA shell.getraxx created on first workflow run.getraxx.com (apex, canonical) and www.getraxx.com both attached.www.getraxx.com → getraxx.com 301 redirect via _redirects rule.CLOUDFLARE_EDIT_DNS token must cover the getraxx.com zone
(Zone ID 0bdcee38d1da2d021eb6166f0bd6204f) — operator prerequisite for
the DNS bootstrap step.| Token (vault key) | Scope | Used for |
|---|---|---|
CF_PAGES_DEPLOY_TOKEN |
Pages:Edit | wrangler pages deploy, project create, custom domain attach |
CLOUDFLARE_EDIT_DNS |
DNS:Edit on raxx.app zone and getraxx.com zone (pending operator action) |
DNS CNAME bootstrap steps in deploy workflows |
CLOUDFLARE_ACCESS_MGMT_TOKEN |
Zero Trust Access:Edit | CF Access app create/lookup |
The CLOUDFLARE_RAXX_AUTOMATION_API_TOKEN token is NOT used for DNS edits.
See reference_cloudflare_tokens.md for the full scope breakdown.
raxx.app zone: f12dbb5cac57d5591a5058874498a6d1
getraxx.com zone: 0bdcee38d1da2d021eb6166f0bd6204f