infra: Cloudflare custom domain for mostly-hallucinations.com

[benpeter]

Summary

• Adds Terraform (OpenTofu) config to manage Cloudflare zone for mostly-hallucinations.com as BYO CDN in front of AEM Edge Delivery Services
• Deploys Adobe's aem-cloudflare-prod-worker with www → apex 301 redirect baked in
• Configures DNS (apex + www CNAME, proxied), SSL (Full mode), TLS 1.2+ with 1.3 ZRT, HTTPS rewrites, and origin-respecting cache TTLs
• Push invalidation registered with Adobe admin API

Infrastructure is already live and verified.

Test URLs

• Site: https://mostly-hallucinations.com/
• www redirect: https://www.mostly-hallucinations.com/ (301 → apex)
• EDS origin: https://main--grounded--benpeter.aem.live/

What's managed by Terraform

Resource	Count
DNS records (apex + www CNAME)	2
Zone settings (SSL, TLS, cache, HTTPS)	6
Worker script + routes	3

What's NOT in Terraform

• Zone creation (one-time dashboard action, then read via data source)
• Nameserver delegation (dd24 registrar)
• Push invalidation registration (Adobe admin API)
• Redirect rule (handled in Worker instead of Cloudflare Ruleset — avoids permission gaps in scoped API tokens)

Test plan

• curl -sI https://mostly-hallucinations.com/ returns 200 with cf-ray header
• curl -sI https://www.mostly-hallucinations.com/ returns 301 to apex
• Second request shows cf-cache-status: HIT
• tofu plan shows no changes (state matches live infra)

🤖 Generated with Claude Code

[aem-code-sync]

Hello, I'm the AEM Code Sync Bot and I will run some actions to deploy your branch and validate page speed.
In case there are problems, just click a checkbox below to rerun the respective action.

• Re-run PSI checks
• Re-sync branch

Commits

• eacf94d ✅ (latest)