Cloudflare Migration — Personal → MQA Organization

Executive Summary

In brief: Move DNS and storage to MQA Cloudflare org.

Why it matters: Team access and billing not tied to one person.

Cost: R2 done; DNS has no extra fee.

Status: R2 ✅; DNS pending.

Decision needed: Approve DNS cutover; revoke old R2 keys after T+7

Executive Overview — all summaries for decision-makers.

Status: R2 migrated ✅ · DNS migration open · Priority: High

Why

• DNS for mqa.group is on a personal account → no team access
• R2 bucket mqa-media + API keys belong organizationally to MQA
• Billing, audit, offboarding not NGO-compliant

Scope

Asset	Current	Target
Zone mqa.group	Personal	MQA Cloudflare org
R2 bucket mqa-media	Personal	MQA org (EU)
DNS records	portal, api, …	Copy 1:1
R2 API keys in Render	Personal account	Regenerate in MQA

DNS Records (Production)

Export before migration (Cloudflare Dashboard → DNS → Export):

Type	Name	Target	Proxy
CNAME	portal	Render frontend URL	DNS only (grey) recommended
CNAME	api	Render backend URL	DNS only (grey)
CNAME	governance	Legacy / redirect	verify

Important: Copy proxy status (orange vs grey) exactly — Render SSL breaks with wrong proxy configuration.

Migration Steps

1. Preparation (T-7 days)

• [ ] Create MQA Cloudflare account + team
• [ ] Lower TTL to 300s
• [ ] DNS export from personal account
• [ ] R2: document bucket inventory

2. Create MQA zone (T-0)

• [ ] Add zone mqa.group in MQA account
• [ ] Do not switch nameservers at domain registrar yet (test in parallel)
• [ ] Import all records
• [ ] Prepare staging subdomains (optional)

3. R2 Migration ✅ (2026-08-04)

Result:

Metric	Value
Bucket (MQA org, EU)	mqa-media
Account ID	441f30afc2a4a53d635f9fd3450f75e2
Objects copied	4 (~404 MiB)
Public URL (new)	https://pub-e40a213d0a4e48019e8d0debf3cfd6a3.r2.dev
Public URL (old, personal)	https://pub-82f40ef04199453c80f3c9316b0c272c.r2.dev

Keys in DB (MediaFile.r2Key) unchanged — objects copied with identical keys.

Upload: 3 PDFs via wrangler r2 object put; large video (401 MiB) via rclone (Wrangler limit 300 MiB).

Render: Prod + staging backend — R2_*, CF_API_TOKEN set to MQA values, redeploy triggered.

Open after R2

• [ ] Media Hub smoke test (upload + PUBLIC/INTERNAL download) on prod
• [ ] Revoke old R2 keys in personal account (T+7 days)
• [ ] Optional: custom domain media.mqa.group instead of pub-….r2.dev

Reference script (archive): backend/scripts/migrate-r2-to-mqa.mjs

4. DNS Cutover

• [ ] Switch nameservers to MQA Cloudflare or point records at registrar to MQA
• [ ] Verify propagation: dig portal.mqa.group
• [ ] Smoke tests → DEPLOYMENT-CHECKLIST

5. Cleanup (T+7 days)

• [ ] Remove old zone from personal account
• [ ] Revoke old R2 keys
• [ ] Update ENV-INVENTORY
• [ ] Check off OPS-ROADMAP Phase 1 → OPS-ROADMAP

Rollback

Switch nameservers back to personal account (keep DNS export).

Responsible Parties

Role	Task
MQA IT	Account, nameservers, team access
Developer	R2 sync, Render env, tests