---
id: w1/m19.1/t006
title: External cutover — Cloudflare DNS → 49.12.20.236 (user) + serve verification; sync m19
worker: worker1
status: done
estimate: 15m
depends_on: [w1/m19.1/t005]
---

## Objective

Point the world at the new cluster and verify it serves: the user updates the Cloudflare records (no CF API token available to the agent), then verify end-to-end, and write the completion back into m19's ledger.

## Context

- Records → new Traefik LB `49.12.20.236`: `dashboard.bex.co`, `api.bex.co`, `auth.bex.co`, `oauth.bex.co`, `schemas.bex.co` (proxied) + `*.onbex.co` wildcard + the DNS-only TCP/SNI passthroughs `*.db.bex.co` / `*.kv.bex.co`.
- Cut only after t005's certs are Ready (proxied hosts on Cloudflare Full TLS need a valid origin cert).
- m19 sync: t007 closes in m19 (done by t002/t004 here); m19 t008 shrinks to CI-secret rotation; m19 t006 op log gets the rescue entries.

## Steps

1. Hand the user the record list + target IP; wait for cutover confirmation.
2. Verify: `dashboard.bex.co` serves with a valid LE cert; one tenant app URL under `*.onbex.co` serves 200.
3. Sync the m19 board (t007 → done/, t008 rescoped, op log updated).

## Files

- .pm/w1/m19/ (board sync)
- DNS provider (operational, user)

## Acceptance criteria

- [ ] `curl -sI https://dashboard.bex.co` 200/302 with valid cert from the new cluster.
- [ ] One `*.onbex.co` app URL serves.
- [ ] m19 board reflects t007 done + t008 rescoped.

## Out of scope

- CI secret rotation (m19 t008 remainder); quota-raise reverts (m19).
