DNS, SSL & CDN Integrations

AcmeCertificate handles the ACME v2 protocol against Let's Encrypt: each certificate document captures the domains list, ACME account binding, current order state (pending → ready → valid → revoked), challenge type (HTTP-01 for single hostnames, DNS-01 for wildcards), private key reference in Key Vault, issued_at, and not_after; a renewal scheduler exercises the order 30 days before expiry, swaps the live cert atomically once the new one validates, and falls back to the previous cert if validation fails. CloudflareDnsZone wraps a Cloudflare zone — zone_id, name, status (pending, active, paused), nameservers, plan — with CRUD endpoints that proxy to the Cloudflare API and cache the resulting state. CloudflareDnsRecord enumerates A, AAAA, CNAME, MX, TXT, NS, and SRV records under each zone with content, ttl, proxied flag, priority (for MX/SRV), and an idempotent upsert that diff-applies records in batch.

DomainVerification drives custom-domain onboarding for federations and clubs that bring their own hostname: the operator picks TXT or CNAME, the system mints a unique verification token, the user adds the record at their registrar, and a verifier polls until the record resolves correctly before the domain is bound to the CMS site. WildcardCertificate is a specialisation that uses DNS-01 against the Cloudflare zone to issue *.federation.example certs without per-subdomain challenges. CloudflareWorkerDeployment models edge code per tenant — script, routes, KV bindings, secrets, and the deployment lifecycle — so canonical redirects, A/B tests, geo-routing, and custom auth checks can run at Cloudflare's edge instead of round-tripping to the origin.