dns(zoo.ngo): proxy web3.zoo.ngo surfaces through CloudFlare (#4)

* dns(zoo.ngo): proxy web3.zoo.ngo surfaces through CloudFlare

web3.zoo.ngo, api.web3.zoo.ngo and ws.web3.zoo.ngo are the API and web
hosts behind the zoo.cloud brand surface (zoo.cloud's www CNAME targets
web3.zoo.ngo). They were unproxied A records pointing straight at the
hanzo-k8s LB (134.199.136.205), exposing the origin and skipping
CloudFlare's edge TLS, caching and DDoS protection.

Set proxied: true to match the now-live CloudFlare state. sync.sh skips
proxied records, so this records source-of-truth; the flip was applied
via the CF API. Zone SSL mode is full and the origin serves a valid
Let's Encrypt cert — verified api/v1/chains=200 and api/v1/auth/me=401
through the proxy.

* dns(zoo.ngo): keep api.web3/ws.web3 unproxied — Universal SSL gap

CloudFlare Universal SSL on zoo.ngo covers zoo.ngo + *.zoo.ngo but NOT
the second-level *.web3.zoo.ngo. Proxying api.web3.zoo.ngo and
ws.web3.zoo.ngo breaks the edge TLS handshake because CF has no edge
cert for those names.

Only the apex web3.zoo.ngo (matched by *.zoo.ngo) stays proxied. api.web3
and ws.web3 serve direct from the hanzo-k8s LB with their valid Let's
Encrypt origin cert. Re-proxying requires an Advanced Certificate (ACM)
for *.web3.zoo.ngo, not entitled on this zone (CF error 1450).

---------

Co-authored-by: zeekay <[email protected]>

k8s/cf-zones/zoo-ngo.yaml

@@ -30,6 +30,10 @@ records:
   - type: A
     name: api.web3
     content: "134.199.136.205"
+    # NOT proxied: CloudFlare Universal SSL covers *.zoo.ngo but not the
+    # second-level *.web3.zoo.ngo, so proxying api.web3 breaks TLS until an
+    # Advanced Certificate (ACM) for *.web3.zoo.ngo is provisioned. Served
+    # direct from the hanzo-k8s LB with a valid Let's Encrypt cert.
     proxied: false
     ttl: 300
 
@@ -96,12 +100,13 @@ records:
   - type: A
     name: web3
     content: "134.199.136.205"
-    proxied: false
+    proxied: true
     ttl: 300
 
   - type: A
     name: ws.web3
     content: "134.199.136.205"
+    # NOT proxied: same *.web3.zoo.ngo Universal-SSL gap as api.web3.
     proxied: false
     ttl: 300