{"slug":"architecture/ROUND_2_DNS_REMEDIATION","title":"Round 2 — DNS Remediation Checklist","section":"architecture","sectionLabel":"Architecture","status":"unclassified","type":"document","path":"architecture/ROUND_2_DNS_REMEDIATION.mdx","bytes":5649,"description":null,"updated":null,"source":"integratewise/Integratewise-docs-wiki","content":"\n**Date:** 2026-07-29  \n**Status:** Action required — manual Cloudflare DNS records needed\n\n---\n\n## Current DNS State\n\n| Domain                         | Resolves | IP                           | Cloudflare | Status      |\n| ------------------------------ | -------- | ---------------------------- | ---------- | ----------- |\n| `integratewise.ai`             | ✅       | 104.21.25.123, 172.67.134.57 | Proxied    | Live        |\n| `auth.integratewise.ai`        | ✅       | 104.21.25.123, 172.67.134.57 | Proxied    | Live        |\n| `gateway.integratewise.ai`     | ❌       | —                            | —          | **Missing** |\n| `api.integratewise.ai`         | ❌       | —                            | —          | **Missing** |\n| `workbench.integratewise.ai`   | ❌       | —                            | —          | **Missing** |\n| `marketplace.integratewise.ai` | ❌       | —                            | —          | **Missing** |\n| `status.integratewise.ai`      | ❌       | —                            | —          | **Missing** |\n\n---\n\n## Required Actions (Cloudflare Dashboard)\n\n### Step 1: Create DNS records\n\nFor each missing subdomain, add a CNAME or A record in Cloudflare DNS:\n\n| Domain                         | Type  | Target                                                  | Proxy   | Notes                                    |\n| ------------------------------ | ----- | ------------------------------------------------------- | ------- | ---------------------------------------- |\n| `gateway.integratewise.ai`     | CNAME | `integratewise-prod.<account>.workers.dev`              | Proxied | Gateway Worker                           |\n| `api.integratewise.ai`         | CNAME | `integratewise-prod.<account>.workers.dev`              | Proxied | Same Gateway Worker (path-based routing) |\n| `workbench.integratewise.ai`   | CNAME | `integratewise-web.pages.dev` or custom                 | Proxied | Next.js frontend                         |\n| `marketplace.integratewise.ai` | CNAME | `integratewise-web.pages.dev` or custom                 | Proxied | Same frontend (path-based)               |\n| `status.integratewise.ai`      | CNAME | `integratewise-status.pages.dev` or status page service | Proxied | Uptime/status page                       |\n\n### Step 2: Create Cloudflare Workers routes\n\nAfter DNS records propagate, create Worker routes in Cloudflare Dashboard:\n\n```\ngateway.integratewise.ai/api/* → integratewise-prod\ngateway.integratewise.ai/v1/*  → integratewise-prod\napi.integratewise.ai/*         → integratewise-prod\n```\n\n### Step 3: Configure Cloudflare Pages\n\nFor `workbench.integratewise.ai` and `marketplace.integratewise.ai`:\n\n1. Connect `apps/web` repo to Cloudflare Pages\n2. Set build command: `pnpm --filter @integratewise/web build`\n3. Set output directory: `.next`\n4. Add custom domains in Pages settings\n\n### Step 4: Configure status page\n\nFor `status.integratewise.ai`:\n\n- Option A: Use Cloudflare Status Page (if available on plan)\n- Option B: Deploy a static status page to Pages\n- Option C: Use external status service (Instatus, Betterstack, etc.)\n\n### Step 5: SSL/TLS settings\n\nIn Cloudflare Dashboard for each domain:\n\n- SSL/TLS mode: **Full (strict)**\n- Always Use HTTPS: **On**\n- Minimum TLS version: **1.2**\n- HSTS: **Enable** (after confirming all subdomains resolve)\n\n### Step 6: Verify propagation\n\n```bash\n# After creating records, verify:\nfor d in gateway api workbench marketplace status; do\n  echo -n \"$d.integratewise.ai → \"\n  dig +short \"$d.integratewise.ai\" A | head -1\ndone\n```\n\nExpected: all resolve to Cloudflare IPs (104.21.x.x / 172.67.x.x)\n\n---\n\n## Customer Zero Specific DNS\n\nFor Customer Zero isolation, consider:\n\n| Domain                           | Purpose                      | Required                                        |\n| -------------------------------- | ---------------------------- | ----------------------------------------------- |\n| `customer-zero.integratewise.ai` | Dedicated Customer Zero host | Optional — can use header-based routing instead |\n| `gateway.integratewise.ai`       | Shared Gateway               | ✅ Required                                     |\n\n**Recommendation:** Use header-based tenant routing (`x-tenant-id: iw-customer-zero`) rather than a dedicated domain. Simpler DNS, same isolation via Gateway auth.\n\n---\n\n## Verification After DNS Is Live\n\nOnce all DNS records are created and propagated:\n\n1. `curl -I https://gateway.integratewise.ai/health` → should return 200\n2. `curl -I https://api.integratewise.ai/health` → should return 200\n3. `curl -I https://workbench.integratewise.ai` → should return 200\n4. `curl -I https://auth.integratewise.ai/.well-known/oauth-authorization-server` → should return Clerk metadata\n5. Verify Clerk JWKS endpoint: `curl https://auth.integratewise.ai/clerk/.well-known/jwks.json`\n\n---\n\n## Blocking Status\n\n| Item                  | Blocks                                                                |\n| --------------------- | --------------------------------------------------------------------- |\n| DNS records           | All deployment, Customer Zero activation, external product activation |\n| Clerk production keys | Auth node, Gateway auth middleware, MCP Connector auth                |\n| Cloudflare Pages      | Frontend deployment                                                   |\n| Worker routes         | Gateway API routing                                                   |\n\n**None of these block code development.** They block deployment and live verification only.\n"}