Zone setup
The padi.com zone is a partial (CNAME) setup in the PADI Worldwide Cloudflare account (Enterprise plan). Public DNS stays in PADI's Route 53, so a new hostname needs a proxied Cloudflare record and a Route 53 CNAME to <host>.cdn.cloudflare.net, which only PADI can add. The zone's rules, Workers and DNS records have been managed in Terraform since 29 October 2026, applied by a pipeline with approval, with a nightly drift check.
| Setting | Value |
|---|---|
| Zone type | Partial (CNAME); DNS authoritative in PADI's Route 53 |
| Certificates | Custom and advanced certificates; Universal SSL off |
| DNSSEC | Not enabled at Route 53 (PADI setting) |
| Tiered cache | Argo tiered cache on |
| Transport | HSTS for 1 year, HTTP to HTTPS redirect |
| DNS records | All proxied |
| Infrastructure as code | 199 resources in Terraform; nightly drift check at 02:00 UTC |
Hostnames and origins
| Hostname | Origin | Notes |
|---|---|---|
| www, shop, marketing, locator, pro-cms | Acquia Cloud shared address: the legacy Drupal 10 site and other PADI Acquia applications | Switch to the new frontend at cutover |
| apex (padi.com) | Legacy Acquia application, reached directly, not through Cloudflare | Redirects to www; moves to Cloudflare at cutover |
| web-dev, web-stage, web-prod | Acquia padifrontend | New Next.js frontend |
| cms-dev, cms-stage, cms-prod | Acquia padicom | New Drupal CMS |
| account-dev, account-stage, account-prod | Acquia padifrontend | Account pages in Next.js |
| account, accounts2 | AWS CloudFront | PADI account app |
| travel, travel.np, travel.dev | PADI Travel | |
| blog, pros-blog, divejobs | WordPress | Blog and Pros blog migrated into Drupal |
| b2b sites, reports, webapps | PADI B2B hosts | |
| locator-dev, locator-stage | AWS non-production hosts | Client-certificate origin pulls |
| locator-api, search-api, search-index | AWS production load balancers | Mutual TLS |
| pagespeed | Netlify | |
| subs | Magazine subscriptions provider |
store.padi.com (commercetools) and club are not in this zone; store redirects use Cloudflare Bulk Redirects.
Edge request path
Edge components (C4 level 3)
Security and cache rules
| Rule set | Count | Content |
|---|---|---|
| Rate limits | 5 | Blogs 300 per minute (challenge); WordPress login 5 per minute; Travel API inventory 300 per minute; AI bots on restricted paths 30 per minute per IP; Travel operator enumeration 300 per 10 minutes |
| Cache rules | 17 active | Next.js static files 1 year; HTML follows the origin's TTL and cache tags; prefetches; optimised images 7 days; Travel API lifetimes from 15 minutes to 6 hours with serve-stale |
| Managed WAF | 1 exception | One false positive on Travel admin |
Outside Terraform: certificates, bot management, health checks, load balancers, waiting rooms, Page Shield, API Shield, Logpush and 24 account-wide IP rules shared by five PADI zones.
Credentials
The edge pipeline and the CMS and frontend purges use a Cloudflare Global API key; the finder uses a user token limited to certificates on padi.com. Scoped, account-owned tokens are an open question for PADI (Q-02).