Infrastructure: Cloudflare and VPS

Two places: Settings → Infrastructure is where you connect an account, and the Infrastructure pane is where the work happens. Open the pane from the command palette (Open Infrastructure) or the button in that settings tab.

Connect

Create a scoped API token at dash.cloudflare.com/profile/api-tokens, paste it into Settings → Infrastructure, and press Test connection. The token is written to the same .env file as every other credential in Mastery HQ — the app forwards it and never stores it anywhere else.

Testing the connection also fills in your account id, which domains and Pages need because they’re account-scoped rather than per-site. It’s an identifier, not a secret, so it’s the one value kept in app preferences.

DNS

Pick a zone at the top of the pane. The table lists every record; the row above it adds one.

Records are checked before they’re sent, because Cloudflare will accept a syntactically valid record that takes your site down. An A record pointed at a hostname, a CNAME pointed at an IP address, an MX with no priority, or a proxy toggle on a record type that can’t be proxied are all caught before they reach the wire.

The ⛅ proxy toggle puts traffic through Cloudflare — hiding the origin IP and enabling caching and the WAF. Only A, AAAA and CNAME records can carry it.

Deleting asks first. There’s no undo on the Cloudflare side.

TLS and security

The settings most worth getting right, each with what it actually does:

• SSL mode — how Cloudflare talks to your origin. Full (strict) is what you want. Flexible encrypts the browser-to-Cloudflare hop and then talks to your server over plain HTTP: it shows a padlock and is not actually secure end to end. The pane says so next to the control.
• Always use HTTPS — redirects plain HTTP requests.
• Minimum TLS — refuses older TLS versions.
• Security level — how aggressively suspicious visitors are challenged. Under Attack shows an interstitial to everyone; it stops an active flood and wrecks normal traffic, so turn it off once the attack passes.

Hosting

Lists the Cloudflare Pages sites on the account with their domains and the status of the last deploy.

Domains

Search a name, and Cloudflare returns real-time availability and pricing. Prices come from Cloudflare’s own check rather than an estimate, and the total accounts for the registration length you picked — year one at the registration price, later years at the renewal price.

Pressing Buy opens a confirm card showing the exact total, the renewal price, whether WHOIS is redacted, and whether auto-renew is on. Nothing is charged until you press the button on that card.

Two deliberate choices worth knowing:

• Auto-renew is off by default. Turning it on by default would opt you into a recurring charge you never chose.
• No price means no purchase. If Cloudflare doesn’t return a price for a domain — premium names sometimes don’t — the Buy button stays disabled instead of showing a reassuring-looking zero.

VPS

If you have a Hostinger VPS, add a HOSTINGER_API_TOKEN in the same settings tab. The pane can then list your boxes and show the IP you’d point a DNS A record at, which is the usual reason you’re in both places at once.