Repository navigation
docs(compute): explain domain verification and Cloudflare proxying - #8581
Merged
sorenbs merged 3 commits intoOct 24, 2026
Merged
Conversation
Contributor
|
No actionable comments were generated in the recent review.
 |
| Layer / File(s) | Summary |
|---|---|
Ownership verification and DNS setup apps/docs/content/docs/compute/domains.mdx |
The guide describes workspace TXT proof for new attachments, CNAME routing, Console verification, and the error returned when ownership proof is missing. |
Cloudflare setup and domain provisioning apps/docs/content/docs/compute/domains.mdx |
The guide describes Cloudflare DNS-only settings and ACME validation considerations. It requires both DNS records to propagate before connection. |
Domain removal and attachment limits apps/docs/content/docs/compute/domains.mdx |
The guide updates the removal command and confirmation option. It explains reconnection proof requirements and states that new attachments require TXT proof alongside CNAME routing. |
Priority:
Estimated code review effort: 2 (Simple) | ~10 minutes
Change: Other
Suggested reviewers: amanvarshney01, wmadden-electric
Merge Risk: 
6d60c
-
No confirmed issue blocks merging the guide. Publish it only after the stated domain-verification and CLI rollout prerequisites are in place.
Pre-merge checks: 
-
Check name Status Explanation Description Check Check skipped - CodeRabbit’s high-level summary is enabled. Title check The title clearly and concisely describes the main documentation changes: domain verification and Cloudflare proxying. Docstring Coverage No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0… Linked Issues check Check skipped because no linked issues were found for this pull request. Out of Scope Changes check Check skipped because no linked issues were found for this pull request. Full details: Docstring Coverage
-
Explanation
No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0 files. (1 skipped: 1 unsupported.)
-
Finishing Touches
-
🧪 Generate unit tests (beta)
-
- Commit to this branch
- Create a new PR
-
- Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts
Comment @coderabbitai help to get the list of available commands.
Contributor
🍈 Lychee Link Check Report11 links: ✅ All links are working!Full Statistics Table
|
sorenbs
changed the title
sorenbs
marked this pull request as ready for review
October 24, 2026 07:57
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
sorenbs
added a commit
to prisma/prisma-cli
that referenced
this pull request
Oct 24, 2026
## Purpose of change Show TXT ownership instructions, Cloudflare proxy recovery, and a safe retry command when a custom domain cannot connect. ## What's changed and why - Recognize `domain-ownership-required` as `SERVICE.DOMAIN_OWNERSHIP_REQUIRED`, with the exact DNS instructions from the API. - Keep the selected project, service, and shell-quoted branch in **Verify and connect** recovery. Do not suggest deploying the service to fix missing ownership proof. - Recognize `domain-cloudflare-proxy` as `SERVICE.DOMAIN_CLOUDFLARE_PROXY`. Explain DNS only during setup, then Proxied after Active with Full (strict) TLS and an accessible ACME challenge path. Preserve the same project, service, and branch when retrying. - Update command help and product/error docs. The CLI stays compatible with the current API and needs no SDK change. Stacked on #354 for branch-domain support. Companions: [platform #5785](prisma/pdp-control-plane#5785) and [docs #8581](prisma/web#8581). Merge and release that PR first. Release this change before the platform TXT enforcement for clear recovery guidance; publish the companion public docs only after the platform deploy and CLI release. <!-- cli-domain-verification-terminal-examples:start --> ## Terminal examples Captured from this PR's head (`231634ad916894ce495d57afaa24afc7ea11382f`) using the in-process CLI harness and synthetic API responses. ANSI colors are removed. These are actual CLI-rendered errors, not live DNS or certificate tests. `workspace-proof` is a fixture value: use the exact TXT value provided for your workspace. ### Missing workspace TXT proof The CLI shows the API's exact TXT instructions. The recovery command keeps the selected project, service, and shell-quoted branch; it does not suggest deploying the app to fix missing proof. ```console $ prisma service domain add staging.example.com --project acme-app --service hello-world --branch 'feature/domain fix' ✘ [SERVICE.DOMAIN_OWNERSHIP_REQUIRED] Verify ownership of staging.example.com why: DNS does not contain the TXT proof for this workspace. → Add a TXT record named _prisma-verification.staging.example.com with value prisma-verification=workspace-proof. Keep this record to reconnect domains in this workspace, then retry the same command. → Verify and connect: prisma service domain add staging.example.com --service svc_staging --project proj_1 --branch 'feature/domain fix' ``` Exit status: `2`. JSON mode reports `SERVICE.DOMAIN_OWNERSHIP_REQUIRED` and the same **Verify and connect** next action. ### Cloudflare proxy recovery Connect with **DNS only**, wait for **Active**, then restore **Proxied** with **Full (strict)** TLS. The instructions also cover the ACME challenge path for certificate renewal. ```console $ prisma service domain add staging.example.com --project acme-app --service hello-world --branch 'feature/domain fix' ✘ [SERVICE.DOMAIN_CLOUDFLARE_PROXY] Turn off Cloudflare's proxy to connect staging.example.com why: Failed to add custom domain: This hostname appears to use Cloudflare's proxy. Set this record to DNS only (gray cloud). Once the domain is Active, turn Proxied back on with Full (strict) SSL/TLS and keep /.well-known/acme-challenge/* accessible. → Set this record to DNS only (gray cloud). Once the domain is Active, turn Proxied back on with Full (strict) SSL/TLS and keep /.well-known/acme-challenge/* accessible. → Verify and connect: prisma service domain add staging.example.com --service svc_staging --project proj_1 --branch 'feature/domain fix' ``` Exit status: `2`. JSON mode reports `SERVICE.DOMAIN_CLOUDFLARE_PROXY`. Both captured recovery commands keep `--project proj_1`, `--service svc_staging`, and `--branch 'feature/domain fix'`. <!-- cli-domain-verification-terminal-examples:end --> ## Testing notes / Before-after Before: the ownership error would be mistaken for a missing deployment. After: the CLI shows the workspace TXT instructions or Cloudflare-specific recovery and retries the same branch app. Passed: root format, type checks (nine tasks), lint, error-reference completeness (132 codes), full CLI package suite (1,050 passed, one existing skip), and local end-to-end tests (seven passed). The 48 live API tests skip without a service token. No live DNS or TLS changes were made.
This branch was successfully deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Purpose of change
Explain workspace TXT verification and how to connect a Cloudflare hostname, then enable proxying for its CDN.
What's changed and why
Stacked on #8514. Companions: platform #5785 and CLI #370. Publish after its branch-domain rollout prerequisites and after the TXT platform change is deployed to both Console and Management API and the companion CLI is released. Do not publish these instructions before enforcement and recovery are available.
Testing notes / Before-after
Fumadocs MDX generation and the docs link check pass: 721 current files, zero errors. Only the Domains guide changes; generated REST and CLI references stay untouched.
Summary by CodeRabbit