petal-power/wiki-vault
3
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
282651e756
wiki-vault/Sources/Dev/cloudflare-cache-strategy.md
Travis Herbranson 34a268d8dc migration: copy 62 notes from pbs-projects and homelab-projects 
Two-layer structure: Sources (raw notes) + Wiki (compile output)
Four domains: Dev (40), Venture (3), Homelab (23), Reference (0)
Includes CLAUDE.md spec, index pages at all levels, compile log

Co-Authored-By: Lovebug <lovebug@herbylab.dev>
2026-05-08 17:21:13 -04:00

3.4 KiB
Raw Blame History

created path project status tags type updated
2026-03-30 Sources/Dev cloudflare-cache-strategy active
pbs
cloudflare
caching
n8n
automation
production
project-plan 2026-03-30

Cloudflare Cache Strategy - Cookie Bypass + Auto-Purge

Problem

After the production server migration (clone → update → promote), Cloudflare caching broke backend tools (n8n, Gitea) and WordPress admin functionality. The existing IP-based cache bypass rule failed — Jenny saved post edits that reverted on reload due to stale cached pages being served.

The IP-based approach is inherently fragile: ISP IP changes, rule ordering conflicts with new exception rules, and doesn't scale.

Decision

Replace IP-based bypass with a hybrid approach: custom cookie bypass for admin users + n8n-driven auto-purge on content publish/update.

Plan

Phase 1: Cookie Bypass

  • Define custom cookie name (pbs_admin_bypass) and generate a random secret value
  • Test manually: set cookie in browser DevTools, verify Cloudflare serves CF-Cache-Status: BYPASS
  • Add WPCode Lite PHP snippet that sets the cookie automatically on admin-role login
  • Replace Cloudflare "Bypass Cache - Admin IPs" rule with new rule:
    • Rule name: Bypass Cache - PBS Admins
    • Match: Cookie contains pbs_admin_bypass
    • Action: Bypass cache
  • Ensure rule is ordered above "Cache Everything" rule
  • Delete old IP-based bypass rule
  • Verify Jenny's workflow: edit post → save → reload → changes persist

Phase 2: Cloudflare API Token

  • Create scoped Cloudflare API token with only Zone.Cache Purge permission
  • Store token securely (n8n credentials store)
  • Note Zone ID for API calls

Phase 3: n8n Auto-Purge Workflow

  • Configure WordPress webhook(s) to fire on:
    • Post publish/update
    • Page publish/update
    • WooCommerce product update
    • WPRM recipe update
  • Build n8n workflow:
    • Webhook node receives WordPress payload (includes post/page URL)
    • HTTP Request node calls Cloudflare purge API for the specific URL
    • (Optional) Also purge homepage URL — decision pending
  • Test: publish a post → verify cached version updates within seconds
  • Add Google Chat notification on purge (optional)

Current Cloudflare Cache Rules (Target State)

  1. Bypass Cache - WP Admin Paths (/wp-admin, /wp-login.php)
  2. Bypass Cache - PBS Admins (cookie: pbs_admin_bypass)
  3. Bypass Cache - n8n/Gitea (existing exception rules)
  4. Cache Everything (2hr Edge TTL, 1 day Browser TTL, serve stale while revalidating)

Key Technical Notes

  • Cloudflare purge API endpoint: POST /client/v4/zones/{ZONE_ID}/purge_cache
  • Targeted purge supports up to 30 URLs per call
  • n8n and Gitea subdomains have Cloudflare proxy disabled (separate fix)
  • Cookie approach avoids Ultimate Member conflict — site members won't have the custom cookie
  • If Ultimate Member membership activates later, this approach still works (unlike wordpress_logged_in cookie)

Open Questions

  • Whether to auto-purge homepage on every content update
  • Whether to add a private URL endpoint as a fallback cookie-setting method

Cloudflare API Purge Example

curl -X POST "
https://api.cloudflare.com/client/v4/zones/YOUR_ZONE_ID/purge_cache" \
  -H "Authorization: Bearer YOUR_API_TOKEN" \
  -H "Content-Type: application/json" \
  --data '{"files":["https://plantbasedsoutherner.com/updated-post-slug/"]}'

...sent from Jenny & Travis