Skip to content
SiteSwarm Platform Documentation

Cloudflare Resource Cutover

Cloudflare Platform Resource Cutover & Decommissioning Runbook

1. Executive Summary & Operational Topology

This operational runbook governs the end-to-end execution, empirical validation, secret rotation, and legacy decommissioning for migrating SiteSwarm platform resources from the founder’s personal Cloudflare account (jacobmiller22.com) to the dedicated corporate business account (JP Technology Solutions / Jpsoftwareassociates@gmail.com's Account).

Executing this cutover establishes a clean, enterprise-isolated operational boundary:

  • Corporate Account: 7fba1ed07b005a3c31a890fe6c20cda2
  • Authoritative Platform Zone: jpsoftwareassociates.com (Zone ID 4dfdcba71d71e6a0bbf0af0015c77233)
  • Corporate Workers Subdomain: *.jpsoftwareassociates.workers.dev
  • Plan Entitlements: Workers Paid (Unbound CPU execution, Cloudflare Email Service, Browser Rendering CDP, Queues & Workflows)
  • Stateful Storage: Foundational Cloudflare D1 databases, R2 media storage, and KV namespaces provisioned directly under corporate credentials.

Architectural Invariant (Strict Domain Separation): Technical specifications and runbooks manage platform capability IDs, infrastructure boundaries, and security credentials only. Retail pricing amounts, retainer metrics, and subscription billing details are strictly out of scope.

flowchart TD
    subgraph LegacyAccount["Legacy Personal Account (jacobmiller22.com)"]
        LegacyZone["Personal Zone: jacobmiller22.com\n(Retained strictly for apps/me-portfolio)"]
        LegacyD1["Legacy Personal D1 DBs\n(To be decommissioned)"]
        LegacyWorkers["Legacy Workers Subdomain\n(*.jacobmillerdev.workers.dev - Deprecated)"]
        LegacyToken["Legacy Personal API Tokens\n(To be revoked)"]
    end


    subgraph CorporateAccount["Corporate Account (JP Technology Solutions - 7fba1ed07b005a3c31a890fe6c20cda2)"]
        CorpZone["Authoritative Zone: jpsoftwareassociates.com\n(Zone ID: 4dfdcba71d71e6a0bbf0af0015c77233)"]
        CorpSub["Corporate Subdomain: *.jpsoftwareassociates.workers.dev"]
        CorpD1["Foundational Corporate D1 Databases\n• siteswarm-inquiries-db\n• siteswarm-events-db\n• siteswarm-critique-db\n• siteswarm-cache-purge-db"]
        CorpR2["Corporate R2 Buckets\n• siteswarm-demos\n• client-media"]
        CorpToken["Least-Privilege CI/CD API Token\n(Scoped to Corporate Account & Zones)"]
    end


    subgraph GitHubActions["GitHub Actions Toolchain (.github/workflows)"]
        GHSecret["Secrets Rotation:\n• CLOUDFLARE_ACCOUNT_ID\n• CLOUDFLARE_API_TOKEN\n• R2 S3 Credentials"]
        Workflows["Workflows:\n• preview-deploy.yml\n• staging-deploy.yml\n• production-promote.yml"]
    end


    LegacyAccount -.->|"Phase 1: State Export & DB Provisioning"| CorporateAccount
    CorporateAccount -->|"Phase 2: UUID & Endpoint Registry"| GitHubActions
    GitHubActions -->|"Phase 3: Automated Deployments"| CorporateAccount
    LegacyToken -.->|"Phase 4: Revocation & Decommissioning"| LegacyAccount

2. Resource Cutover Audit & Migration Inventory

An exhaustive audit of platform services and edge applications was conducted to ensure zero unmapped dependencies or orphaned references across the migration seam.

2.1 Account & Identity Attributes

Attribute Legacy Personal Account Target Corporate Account Cutover Status
Account Name jacobmiller22.com Jpsoftwareassociates@gmail.com's Account Corporate identity confirmed
Account ID jacobmillerdev personal ID 7fba1ed07b005a3c31a890fe6c20cda2 Provisioned & verified
Workers Subdomain jacobmillerdev.workers.dev jpsoftwareassociates.workers.dev Subdomain registered & live
Rate Plan Workers Free / Legacy Paid workers_paid Unbound CPU & script ceilings active
Primary Domain Zone jacobmiller22.com (personal) jpsoftwareassociates.com (4dfdcba71d71e6a0bbf0af0015c77233) Registrar DNSSEC & Full (strict) TLS active
Platform Fallback Origin fallback.jacobmiller22.com fallback.jpsoftwareassociates.com (100:: discard prefix) Custom hostnames target configured

2.2 Horizontal Platform Services Matrix

All horizontal platform microservices (services/*) bind to corporate D1 databases, corporate queues, and the authoritative jpsoftwareassociates.com zone:

Service Directory Worker Script Name Corporate Production Route Stateful Storage Dependency
services/inquiries siteswarm-service-inquiries inquiries.jpsoftwareassociates.com D1: siteswarm-inquiries-db
Send Email binding
services/critique siteswarm-critique critique.jpsoftwareassociates.com D1: siteswarm-critique-db
services/event-platform siteswarm-service-event-platform Event queues consumer/cron D1: siteswarm-events-db
Event queues
services/cache-purge siteswarm-cache-purge Queue consumer D1: siteswarm-cache-purge-db
KV: siteswarm-purge-kv
services/email-sender siteswarm-email-sender Queue consumer Queue: siteswarm-email-queue
Send Email binding
services/email-router siteswarm-email-router Inbound Email routing Cloudflare Email Service
services/watchdog siteswarm-service-watchdog Scheduled canary probe KV: watchdog-state

2.3 Edge Applications Inventory (apps/*)

All 12 edge applications deploy to the corporate account under dual-route ingress:

  1. apps/marketing: Corporate marketing storefront (jpsoftwareassociates.com, siteswarm.dev)
  2. apps/auto-repair: Client vertical (auto-repair.jpsoftwareassociates.com)
  3. apps/bakery: Client vertical (bakery.jpsoftwareassociates.com)
  4. apps/clk-construction: Commercial client app (clk-construction.jpsoftwareassociates.com)
  5. apps/clk-construction-cms: Client CMS portal (clk-construction-cms.jpsoftwareassociates.com)
  6. apps/command-center: Central administrative console (command-center.jpsoftwareassociates.com)
  7. apps/docs: Architecture & engineering documentation site (docs.jpsoftwareassociates.com)
  8. apps/me-portfolio: Founder portfolio site (retains personal zone binding jacobmiller22.com)
  9. apps/rcc-stjohn: Community organization client app
  10. apps/rcc-stpatrick: Community organization client app
  11. apps/rcc-stpeter: Community organization client app
  12. apps/software-agency: Agency vertical client app

3. Foundational D1 Database UUID Registry

To provide durable multi-tenant persistence under the corporate Cloudflare account, the foundational D1 SQL databases were provisioned in the Eastern North America (ENAM) region using npx wrangler d1 create.

3.1 Corporate D1 Database Registry

Database Name Canonical Database UUID Region Primary Subsystem Binding
siteswarm-inquiries-db 74f5c1c1-209a-4eb3-a579-1d040ac7e799 ENAM services/inquiries (INQUIRIES_DB)
siteswarm-events-db d314e7b5-a9c4-4d09-8d8f-a1e67c88b99a ENAM services/event-platform (EVENT_DB)
siteswarm-critique-db af4ca8e6-b298-407a-8785-d5b3acc66cd5 ENAM services/critique (CRITIQUE_DB)
siteswarm-cache-purge-db c72e53b0-7f80-4578-9daa-688ba123274f ENAM services/cache-purge (DB)

3.2 Wrangler Configuration Binding Snippets

To bind these corporate D1 instances in Worker configurations:

services/inquiries/wrangler.jsonc
"d1_databases": [
  {
    "binding": "INQUIRIES_DB",
    "database_name": "siteswarm-inquiries-db",
    "database_id": "74f5c1c1-209a-4eb3-a579-1d040ac7e799",
    "migrations_dir": "migrations"
  }
]
services/event-platform/wrangler.jsonc
"d1_databases": [
  {
    "binding": "EVENT_DB",
    "database_name": "siteswarm-events-db",
    "database_id": "d314e7b5-a9c4-4d09-8d8f-a1e67c88b99a",
    "migrations_dir": "migrations"
  }
]
services/critique/wrangler.jsonc
"d1_databases": [
  {
    "binding": "CRITIQUE_DB",
    "database_name": "siteswarm-critique-db",
    "database_id": "af4ca8e6-b298-407a-8785-d5b3acc66cd5",
    "migrations_dir": "migrations"
  }
]
services/cache-purge/wrangler.jsonc
"d1_databases": [
  {
    "binding": "DB",
    "database_name": "siteswarm-cache-purge-db",
    "database_id": "c72e53b0-7f80-4578-9daa-688ba123274f",
    "migrations_dir": "migrations"
  }
]

3.3 Database Health Attestation Probes

Execute the following commands to verify that all 4 corporate D1 databases are active, reachable, and responding to SQL queries:

Terminal window
# Verify database enumeration
npx wrangler d1 list


# Execute remote liveness query against all foundational databases
npx wrangler d1 execute siteswarm-inquiries-db --remote --command "SELECT 1 as alive;"
npx wrangler d1 execute siteswarm-events-db --remote --command "SELECT 1 as alive;"
npx wrangler d1 execute siteswarm-critique-db --remote --command "SELECT 1 as alive;"
npx wrangler d1 execute siteswarm-cache-purge-db --remote --command "SELECT 1 as alive;"

Empirical Verification Result:

🚣 Executed 1 command in 0.50ms
┌───────┐
│ alive │
├───────┤
│ 1     │
└───────┘

All 4 databases returned status 1 with 0 errors.

4. GitHub Actions Secret Rotation & Dual-Tier Credential Guide

To prevent credential leaks, privilege escalation, and cross-account blast radius, SiteSwarm enforces a strict separation between interactive developer sessions and automated CI/CD pipeline execution.

4.1 Required Repository Secrets

Secret Name Target Account Value / Format Purpose
CLOUDFLARE_ACCOUNT_ID Corporate 7fba1ed07b005a3c31a890fe6c20cda2 Root account destination for all deployments
CLOUDFLARE_API_TOKEN Corporate Dedicated least-privilege token (Workers Scripts:Edit, etc.) Deployment, D1 migrations, KV management
R2_ACCESS_KEY_ID Corporate 32-character S3 API Access Key R2 object uploads & private presigned URLs
R2_SECRET_ACCESS_KEY Corporate 64-character S3 API Secret Key AWS SigV4 presigning in CI pipelines
R2_ENDPOINT Corporate https://7fba1ed07b005a3c31a890fe6c20cda2.r2.cloudflarestorage.com S3-compatible R2 storage endpoint
CF_WORKERS_DOMAIN Corporate jpsoftwareassociates.workers.dev Subdomain suffix for preview deployments

4.2 CI/CD Least-Privilege API Token Configuration

In the Cloudflare Dashboard (Manage Account > API Tokens > Create Token):

  1. Token Name: SiteSwarm-CICD-Pipeline
  2. Permissions Matrix:
    • Account > Workers Scripts > Edit
    • Account > Workers KV Storage > Edit
    • Account > D1 > Edit
    • Account > Workers R2 Storage > Edit
    • Account > Workers Tail > Read
    • Account > Browser Rendering > Edit
    • Account > Account Settings > Read
    • Zone > Workers Routes > Edit
    • Zone > Zone Settings > Read
    • Zone > Custom Hostnames > Edit (for Cloudflare for Platforms SaaS ingress)
  3. Explicitly Denied Permissions (Zero-Trust Guardrail):
    • ❌ Billing: Read / Edit (Forbidden)
    • ❌ Account Members: Read / Edit (Forbidden)
    • ❌ DNS: Edit (Zone DNS changes must be reviewed manually)
    • ❌ Zone: Delete / Purge Cache All (Forbidden)
  4. Account Resources: Include Jpsoftwareassociates@gmail.com's Account
  5. Zone Resources: Include All zones under account or specific zones (jpsoftwareassociates.com, siteswarm.dev).

4.3 CLI Secret Rotation Procedure

Run using the GitHub CLI (gh) to update repository secrets:

Terminal window
# Update Corporate Account ID
gh secret set CLOUDFLARE_ACCOUNT_ID --body "7fba1ed07b005a3c31a890fe6c20cda2"


# Update Corporate CI/CD API Token
gh secret set CLOUDFLARE_API_TOKEN --body "<NEW_CORPORATE_CI_TOKEN>"


# Update R2 Storage S3 Credentials
gh secret set R2_ACCESS_KEY_ID --body "<NEW_CORPORATE_R2_KEY_ID>"
gh secret set R2_SECRET_ACCESS_KEY --body "<NEW_CORPORATE_R2_SECRET_KEY>"
gh secret set R2_ENDPOINT --body "https://7fba1ed07b005a3c31a890fe6c20cda2.r2.cloudflarestorage.com"
gh secret set CF_WORKERS_DOMAIN --body "jpsoftwareassociates.workers.dev"

5. Decommissioning & Teardown Checklist

Following verified cutover of all platform services to the corporate account, the legacy personal account (jacobmiller22.com) must be cleanly decommissioned to prevent orphaned resources or security drift.

sequenceDiagram
    autonumber
    participant Legacy as Legacy Personal Account
    participant Corp as Corporate Account
    participant CI as GitHub Actions CI/CD
    participant Admin as Platform Administrator


    Admin->>Corp: Provision D1 DBs & Verify Health
    Admin->>CI: Rotate CLOUDFLARE_ACCOUNT_ID & API Tokens
    CI->>Corp: Deploy Staging & Production Services
    Admin->>Corp: Verify 100% Endpoints Live on Corporate Domain
    Note over Legacy,Corp: 72-Hour Observation Window (Dual-Run Standby)
    Admin->>Legacy: Revoke Personal CI/CD API Tokens
    Admin->>Legacy: Delete Migrated Personal D1 Databases
    Admin->>Legacy: Delete Migrated Personal Worker Scripts
    Admin->>Legacy: Confirm jacobmiller22.com Retains Portfolio Only

5.1 Decommissioning Phases

Phase 1: Pre-Cutover Verification & State Freeze

  • Corporate D1 databases created and remote liveness attested (SELECT 1;).
  • Corporate Workers Paid subscription and jpsoftwareassociates.workers.dev subdomain active.
  • Authoritative zone jpsoftwareassociates.com verified with SSL/TLS Full (strict).
  • Export existing legacy D1 database tables (wrangler d1 export siteswarm-inquiries-db --output inquiries-backup.sql) and apply to corporate database.

Phase 2: Dual-Run Observation Window (72 Hours)

  • Rotate GitHub Actions secrets to corporate account.
  • Trigger staging and production CI deployments against corporate account.
  • Verify HTTP 200 responses across all corporate edge routes:
    • https://jpsoftwareassociates.com
    • https://inquiries.jpsoftwareassociates.com/health
    • https://critique.jpsoftwareassociates.com/health
  • Monitor error logs in Cloudflare Tail and Watchdog for 72 hours. Retain legacy personal Worker routes in standby during this window.

Phase 3: Token Revocation & Traffic Verification

  • In the legacy personal Cloudflare account, revoke legacy API tokens that were shared with GitHub Actions.
  • Verify that CI/CD pipelines and production applications continue operating normally without token error alerts.
  • Verify that zero traffic arrives at *.jacobmillerdev.workers.dev.

Phase 4: Legacy Resource Teardown

  • Delete legacy personal D1 database instances:
    • siteswarm-inquiries-db (legacy personal instance)
    • siteswarm-inquiries-staging-db (legacy personal instance)
    • clk-construction-cms-prod-d1 (legacy personal instance)
  • Delete legacy personal Worker scripts from jacobmillerdev.workers.dev:
    • siteswarm-service-inquiries
    • siteswarm-critique
    • siteswarm-service-event-platform
    • siteswarm-cache-purge
    • siteswarm-email-sender
  • Confirm the legacy personal zone (jacobmiller22.com) contains only DNS and routing for the founder portfolio application (apps/me-portfolio).

6. Decisions Intentionally Deferred

  1. Client Registrar DNS Delegation: Modifying external third-party domain registrars for active commercial clients is executed progressively per client contract and onboarding schedule.
  2. Multi-Account Terraform State Backend: Wrangler and GitHub Actions declarative manifests provide Minimal Viable Abstraction (MVA); multi-account remote Terraform state locking is deferred until multi-region enterprise tenant isolation is required.
  3. Advanced Certificate Manager (ACM) Multi-Level Wildcards: Standard Universal SSL covers single-level subdomains (*.jpsoftwareassociates.com), satisfying all current platform routing requirements.