Cloudflare and high-traffic hosting

DynoStatic works without Cloudflare, Redis, or cron. The baseline contract remains PHP 8.4 and MySQL 8.0 or MariaDB 10.6 on an ordinary host. The options below improve delivery and concurrency without changing that contract.

Start with the live checks

Open Tools → Optimization. The page verifies the application cache, public loader, runtime discovery, Cloudflare proxy headers, trusted visitor-IP resolution, hosting cookies, OPcache, APCu, and database migrations. It makes two requests each to embed.js (the small stable loader) and embed-runtime.php (stateless current-runtime discovery), so an already configured edge cache has an opportunity to report a hit on each surface. Loader and discovery are reported independently with their exact detected conflicts.

DynoStatic downloads the official Cloudflare IPv4 and IPv6 ranges weekly and retains the last valid list. A bundled official list remains available if the refresh fails. CF-Connecting-IP is trusted only when the direct connection came from one of those networks. Additional reverse proxies must be explicitly listed under app.trusted_proxies in dynostatic-config.php.

One-click managed rules

The automatic setup manages only four installation-specific rules:

1. Cache public assets, the stable loader, and revalidated runtime discovery while respecting origin cache headers.
2. Cache only signed, versioned public comment reads.
3. Strip hosting-added cookies only from those cache-safe responses.
4. Disable Rocket Loader for the DynoStatic hostname.

The first rule matches installation-local GET requests to /assets/, embed.js, embed-runtime.php, and integration.php, resolved for root, subfolder, and nested installations. Both queryless discovery (embed-runtime.php) and id-addressed immutable runtime requests (embed-runtime.php?id=<sha256>&v=<version>) match because the expression tests the path while preserving every query parameter in the cache key. Sibling or suffix paths such as embed-runtime.php.bak never match. Discovery must revalidate at the origin (Cache-Control: public, no-cache, must-revalidate with a content-derived ETag); id-addressed runtime bytes are immutable. An edge MISS on either surface is normal for a fresh or revalidated object and is not a failure.

It never changes DNS, SSL mode, WAF, HTTP/3, compression, or websites that embed widgets. It excludes generic widget payloads, bootstrap and private state, tickets, admin, previews, consent state, form submissions, bookings, votes, comments, authentication, and every write request. DynoStatic serializes owner provider operations per installation. Re-running setup reconciles the same exact rule IDs; removal deletes only the recorded IDs after checking their current definitions and ruleset identity. Foreign ruleset version movement is reported separately.

DynoStatic exchanges a short-lived authorization code, performs the selected operation, and revokes the temporary access token immediately. It does not retain a Cloudflare access token. The configuration preview is generated locally and makes no Cloudflare API request. Live drift status is a read-only API observation; it does not establish what the edge serves to visitors.

Create the private OAuth client

In the Cloudflare dashboard, open Manage Account → OAuth clients, select the account containing the DynoStatic zone, and create a client with:

Add these dashboard permissions with Edit access:

• Zone Read (zone.read)
• Cache Rules Edit (cache-settings.write)
• Config Rules Edit (config-settings.write)
• Account Rulesets Edit (account-rulesets.write)
• Account Filter Lists Edit (account-rule-lists.write)

Save the 32-character Client ID and the longer Client Secret in Tools → Optimization. The secret is encrypted using the installation master key. As an alternative, define cloudflare.oauth_client_id and cloudflare.oauth_client_secret in a protected dynostatic-config.php; configuration-file values lock the admin fields.

Managed-rule preview, drift, and rollback

The owner-only Tools → Optimization panel shows a read-only configuration preview of the locally configured rule expressions and actions before authorization. Connecting records the active zone and account, exact Cloudflare rule IDs, ruleset versions, and the previous definitions of only the matching DynoStatic rules. Foreign rules remain in place.

Check live managed-rule drift re-reads the authorized zone and exact managed IDs. Roll back DynoStatic changes restores the protected pre-install definitions or deletes rules created by that installation. It refuses when the protected zone/account, ruleset identity, managed IDs, or managed definitions have changed. A foreign rule can advance a ruleset version; that movement is reported separately and does not block an operation while exact owned rules remain current. A later Cloudflare API observation still does not prove that a rule is active at every edge location. Remove managed rules is a separate owner action and applies the same exact-ID and current-state checks.

The local default installation-origin header is Content-Signal: ai-train=no, search=no, ai-input=no. Override it with the installation config key ai.content_signal, using all three directives (ai-train, search, and ai-input) with yes or no. Invalid values fall back to the conservative default. DynoStatic adds this installation-wide signal to public HTML responses served by this installation, including public HTML error responses, so Cloudflare Markdown conversion preserves the origin's choice instead of adding its permissive default. It does not govern separate static sites or replace their per-website search, inference, and training selections in SitePublicationPolicy; generated publication archives retain their own policy and media types.

DynoStatic's generated site bundles contain separate Markdown artifact paths alongside HTML documents. When a host serves those files as text/markdown, Cloudflare's HTML conversion is not eligible; conversion is eligible only for an HTML response when that feature is enabled at the edge. The URLs and media types remain distinct. If a future route negotiates HTML and Markdown at one URL, the origin must return Vary: Accept; the managed cache rule bypasses response variants named by Vary unless an explicit header policy is configured. Cloudflare conversion settings and cache behavior remain unverified until checked against the live account and deployed hostname.

Cloudflare settings that remain manual

• Proxy the DynoStatic DNS record (orange cloud).
• Use Full (strict) SSL/TLS, never Flexible.
• Enable HTTP/3 and compression.
• Do not serve interstitial WAF or bot challenges on /api/ or OPTIONS; embedded JavaScript receives the challenge HTML as a network failure.
• Restrict origin ports 80/443 to Cloudflare networks or use Authenticated Origin Pulls when the host supports it.
• Never enable Cache Everything for the full hostname.
• Preserve all query parameters in cache keys.
• Add narrowly scoped edge rate limits for admin login and write methods if needed, but exclude OPTIONS.

PHP and application caching

Enable OPcache. APCu is an optional automatic near-cache. Filesystem cache is appropriate for one ordinary server; local Redis is preferable under sustained concurrency, and shared Redis is appropriate when several PHP servers serve one installation.

Redis authentication and TLS are supported:

'cache' => [
    'driver' => 'redis',
    'redis' => [
        'host' => '127.0.0.1',
        'port' => 6379,
        'database' => 0,
        'username' => '',
        'password' => 'redis-password',
        'tls' => false,
        // Or: 'url' => 'rediss://user:password@host:6380/0',
    ],
],

The primary cache is resilient and falls back rather than taking widgets offline. Use the live read/write/delete probe after changing the configuration.

Worker and server tuning

For predictable email, webhooks, cleanup, blocklist refreshes, and search indexing, schedule this every minute using the PHP 8.4 CLI binary:

php /path/to/dynostatic/bin/dynostatic cron --budget=50

Opportunistic web execution keeps cron optional. For higher traffic, monitor PHP-FPM queueing and memory, keep the InnoDB buffer pool large enough for active data and indexes, apply all database migrations, and enable the database slow-query log before changing query or server settings. Raise PHP and web-server upload limits together for large imports and encrypted restores.

Useful diagnostics include Cache-Control, ETag, X-DynoStatic-Cache, and CF-Cache-Status. Plan-specific Cloudflare body-size and timeout limits still apply to large synchronous operations.

Local checks, bundled fixtures, and expression matrices verify the shipped policy shapes; they do not prove a live Cloudflare configuration. Only the Tools → Optimization live probes against the deployed hostname, and the Cloudflare dashboard rule review, establish what the edge actually serves.

Cloudflare references: Create an OAuth client, integrate OAuth, Cache Rules, Vary and cache variants, Rulesets API and dry-run validation, ruleset version views, updating a rule (PATCH creates a version), and Markdown for Agents Content-Signal behavior.

DynoStatic rename note

Managed Cloudflare rule names now use the DynoStatic product identity. Rules created under the former Panel Solution name are no longer recognized as managed by this installation and should be removed manually from the Cloudflare dashboard once.