Insights
Engineering write-ups on firewalls, cloud networks, edge security, and access. Every article names its sources, shows the date it was checked against vendor documentation, and carries a checklist or decision table you can reuse.
Latest articles
12 articles
FeaturedCloudflareMigration stage
Migrate hundreds of domains to Cloudflare without downtime
Move DNS first and proxy second: the wave model, a cutover checklist, DNSSEC and certificate gates, and a per-hostname rollback, checked against the docs.
Short answer
Move DNS first and proxy second. Import every record as DNS-only, change the nameservers, and wait for the zone to go active and for edge certificates to issue. Allow Cloudflare’s addresses at the origin, then switch records to proxied in waves ordered by risk. Rolling back then means switching one hostname to DNS-only, not reversing a nameserver change.
Zero TrustOnboarding stage
Replace your VPN with Cloudflare Zero Trust, in phases
A phased plan to replace a remote-access VPN with Cloudflare Zero Trust: inventory, Tunnel, Access and Gateway policies, client rollout, and a pilot ladder.
CloudflareArchitecture stage
Cloudflare account audit checklist and severity model
A Cloudflare account audit checklist across six areas, with a severity and effort model that ranks findings so the cheap, high-impact fixes ship first.
CloudflareSupport stage
Protect the origin behind Cloudflare
Allow-list, Authenticated Origin Pulls, or Cloudflare Tunnel: what each proves and costs, plus the nginx settings and rollout order to check first.
Zero TrustArchitecture stage
Cloudflare One, Zero Trust, WARP and WAN names
What Cloudflare One, Zero Trust, the Cloudflare One Client (formerly WARP), Mesh and Cloudflare WAN (formerly Magic WAN) mean in 2026, with a name map.
Network securityMigration stage
Firewall migration checklist: audit, convert, cut over
A vendor-neutral firewall migration checklist: audit rules by hit count, map features, check which conversion tools are still supported, test flows, cut over.
Zero TrustArchitecture stage
ZTNA vs VPN: a decision guide for access design
ZTNA grants access to named applications after identity and device checks; a VPN extends a network. Definitions from NIST SP 800-207 and a decision table.
Zero TrustArchitecture stage
Is Zero Trust required by NIS2?
NIS2 does not name Zero Trust in its Articles. What recital 89 and Article 21(2) say, where the 2024 implementing rules go further, and Bulgaria's status.
AutomationOnboarding stage
Import Cloudflare into Terraform with cf-terraforming
Generate Terraform configuration and import blocks from a live Cloudflare account with cf-terraforming, then review, pin the provider, and apply a baseline.
Multi-cloudArchitecture stage
Centralized inspection on AWS with Transit Gateway
Three ways to inspect traffic centrally on Transit Gateway: an inspection VPC, the Network Firewall attachment, or Gateway Load Balancer, with failure modes.
Multi-cloudArchitecture stage
Azure hub-and-spoke or Virtual WAN, and AWS links
When to choose Azure hub-and-spoke or Virtual WAN, and how to connect either to AWS Transit Gateway over IPsec VPN with BGP: a decision table and checklist.
CloudflareOnboarding stage
Roll out Cloudflare WAF and bot rules without outages
Deploy Cloudflare WAF and bot rules in observe, challenge, then block order: which actions each plan has, how to write exceptions, and how to roll back.
How the articles are checked
Each article is checked against the vendor documentation, standards, or legal texts it cites, and shows the date of that check. Where a statement is our own practice rather than vendor guidance, the article says so. Products change, so articles are re-checked when the behavior they describe changes, and the date moves only when the content does.