From d67e68c957e5fbaa76ca3e01f3464634b5a872ae Mon Sep 17 00:00:00 2001 From: Gitead Date: Tue, 6 Oct 2026 22:33:21 -0400 Subject: [PATCH] =?UTF-8?q?docs:=20LAN=20HTTPS=20Step=204=20=E2=80=94=20pa?= =?UTF-8?q?ste=20the=20existing=20Cloudflare=20token;=20creating=20a=20new?= =?UTF-8?q?=20one=20is=20the=20fallback?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Co-Authored-By: Claude Opus 5.5 --- README.md | 45 ++++++++++++++++++++------------------------- 1 file changed, 20 insertions(+), 25 deletions(-) diff --git a/README.md b/README.md index aa94d3e3..35bbb7ac 100644 --- a/README.md +++ b/README.md @@ -812,30 +812,16 @@ sudo apt update sudo apt install -y certbot python3-certbot-dns-cloudflare ``` -### Step 4 — Create a scoped Cloudflare API token +### Step 4 — Add the Cloudflare API token -**4a. Create the token (in a browser):** - -1. Go to `dash.cloudflare.com` → profile icon (top right) → **My Profile** → **API Tokens** → **Create Token** -2. Use the **Edit zone DNS** template -3. Under **Zone Resources**, choose **Specific zone** → `mydentalofficemanagement.com` -4. Click **Continue to summary** → **Create Token**, then copy the token. It's only shown once. - -**4b. Check the token works** (replace `YOUR_TOKEN`): - -```sh -curl -s -H "Authorization: Bearer YOUR_TOKEN" https://api.cloudflare.com/client/v4/user/tokens/verify -# should include: "status":"active" -``` - -**4c. Save it in a root-only credentials file:** +Use the existing Cloudflare API token (the same one works for every office PC). Open the credentials file: ```sh sudo mkdir -p /etc/letsencrypt sudo nano /etc/letsencrypt/cloudflare.ini ``` -Make the file exactly this one line, with your token pasted after `= ` (paste in the terminal with `Ctrl+Shift+V`; clear old lines with `Ctrl+K`): +Paste this one line, with the token after `= ` (paste in the terminal with `Ctrl+Shift+V`): ```ini dns_cloudflare_api_token = @@ -848,15 +834,24 @@ sudo chmod 600 /etc/letsencrypt/cloudflare.ini ``` > **If certbot fails with `Error determining zone_id: 6003 Invalid request headers`,** the token in -> this file is malformed: the `` placeholder was left in, there are extra -> characters or quotes, or the token ID / Global API Key was copied instead of the token itself. -> Check it with `sudo cat /etc/letsencrypt/cloudflare.ini`, re-test with 4b, fix the file, and run -> Step 5 again. (The yellow `PendingDeprecationWarning` box certbot prints about the `cloudflare` -> Python package is harmless.) +> this file is wrong: the `` placeholder was left in, there are extra characters +> or quotes, or the token ID / Global API Key was copied instead of the token itself. Check it with +> `sudo cat /etc/letsencrypt/cloudflare.ini`, fix the file, and run Step 5 again. To test a token +> on its own: +> ```sh +> curl -s -H "Authorization: Bearer YOUR_TOKEN" https://api.cloudflare.com/client/v4/user/tokens/verify +> # should include: "status":"active" +> ``` +> (The yellow `PendingDeprecationWarning` box certbot prints about the `cloudflare` Python package +> is harmless.) -> The same token can be reused across offices (Cloudflare tokens are scoped to the whole zone, -> not a single subdomain) — but issuing one token per server makes it easy to revoke just one if -> a machine is ever decommissioned. +#### Only if you don't have a token yet (or it was revoked) + +1. Go to `dash.cloudflare.com` → profile icon (top right) → **My Profile** → **API Tokens** → **Create Token** +2. Use the **Edit zone DNS** template +3. Under **Zone Resources**, choose **Specific zone** → `mydentalofficemanagement.com` +4. Click **Continue to summary** → **Create Token**, then copy the token. It's only shown once, so + save it in a password manager for the next PC. ### Step 5 — Issue the certificate