Raxx · internal docs

internal · gated ↑ index

Incident RCA — getraxx.com 403 (2026-05-08 UTC)

Status: Resolved (pending PR #1369 merge + first deploy) Severity: High — marketing front door unserved since at least 2026-04-22 Reported: #1368 Fixed by: #1369


Timeline

Time (UTC) Event
2026-04-22 getraxx.com zone created on Cloudflare. DNS CNAME getraxx.comgetraxx.pages.dev added. No CF Pages project created. 403 begins.
2026-04-23 Commit a837db0 (feature/brand-tokens-getraxx-landing) builds landing page components inside frontend/trademaster_ui/src/pages/getraxx/. Branch never merged; no deploy workflow authored.
2026-05-08 Operator notices https://getraxx.com/ returns HTTP 403 with Cloudflare server header. Filed as #1368.
2026-05-08 SRE investigation confirms: CNAME points to getraxx.pages.dev, but no CF Pages project named getraxx exists on the account. Cloudflare returns 403 for unresolvable custom hostname.
2026-05-08 Feature-developer PR #1369 opens: standalone frontend/getraxx-landing/ project + deploy-getraxx.yml workflow.

Root cause

Two independent failures compounded:

  1. No CF Pages project created. The DNS CNAME for getraxx.com pointed to getraxx.pages.dev but no CF Pages project with that name was ever provisioned. Cloudflare returns HTTP 403 when a custom hostname routes to a non-existent Pages project.

  2. Landing source not standalone. The React landing page (built in commit a837db0) was embedded inside the Antlers CRA app at frontend/trademaster_ui/src/pages/getraxx/ with its own Antlers-shell dependencies. There was no standalone deployable, no deploy-getraxx.yml, and the branch was never merged to main.


Fix

PR #1369:


Operator prerequisite (not yet done)

The CLOUDFLARE_EDIT_DNS token currently covers the raxx.app zone only. The DNS bootstrap step in deploy-getraxx.yml requires DNS:Edit scope on the getraxx.com zone (Zone ID 0bdcee38d1da2d021eb6166f0bd6204f).

Since the DNS CNAME already exists (it was set when the zone was created), the bootstrap step is a safety idempotency check that will be a no-op. The Pages deploy step does not require the DNS token and will succeed without it.

Action: Extend CLOUDFLARE_EDIT_DNS to cover the getraxx.com zone in the Cloudflare dashboard or via vault update. Low urgency — the site will serve after PR merge regardless.


Contributing factors


Action items

Action Owner Issue
Merge PR #1369 (landing + deploy workflow) Kristerpher #1369
Extend CLOUDFLARE_EDIT_DNS to cover getraxx.com zone Operator #1369 (prerequisite note)
Add probe alert: non-200 from getraxx.com → Slack alert SRE (future)