From 0aafad396c2a530c4a2834d4db2f0a184e3db4ed Mon Sep 17 00:00:00 2001
From: DroidAgent <154886644+echobt@users.noreply.github.com>
Date: Tue, 15 Sep 2026 06:50:46 +0000
Subject: [PATCH] docs(dns): require Direct CNAME for custom domains (no
 orange-cloud)

A Proxied (orange-cloud) CNAME to another Cloudflare customer's hostname
triggers Cloudflare Cross-User Banned (Error 1014). Spell out Direct
CNAME (DNS only) for docs.cortex.foundation (Mintlify),
status.cortex.foundation, the FernDesk Connect domain, and the
software./releases. R2 custom domains owned by CortexLM/backend.

Co-authored-by: factory-droid[bot] <138933559+factory-droid[bot]@users.noreply.github.com>
---
 README.md           | 13 +++++++++++++
 scripts/FERNDESK.md |  5 +++++
 2 files changed, 18 insertions(+)

diff --git a/README.md b/README.md
index aade607..f0540a1 100644
--- a/README.md
+++ b/README.md
@@ -23,6 +23,19 @@ Requires Node 20.17+. The site is intended to publish at
 step in the Mintlify dashboard. Connect `CortexLM/docs`, branch `main`, with
 the content directory set to the repository root (not `apps/docs`).
 
+### Custom-domain DNS
+
+Every Cortex custom domain that CNAMEs to a third-party hostname is a
+**Direct CNAME (DNS only)** — `docs.cortex.foundation` (Mintlify),
+`status.cortex.foundation` (status page), the FernDesk **Connect domain**, and
+the `software.cortex.foundation` / `releases.cortex.foundation` R2 custom
+domains owned by
+[`CortexLM/backend`](https://github.com/CortexLM/backend)
+(`docs/software-cdn.md`).
+
+> **Use a Direct CNAME (DNS only). Do not enable orange-cloud Proxied** — that
+> causes Cloudflare **Cross-User Banned** (Error 1014).
+
 ## Checks
 
 ```bash
diff --git a/scripts/FERNDESK.md b/scripts/FERNDESK.md
index a6edad6..09ce17a 100644
--- a/scripts/FERNDESK.md
+++ b/scripts/FERNDESK.md
@@ -84,3 +84,8 @@ backoff). Local runs fall back to urllib only if `curl_cffi` is not installed.
 
 Separately: the FernDesk UI still needs **Connect domain** for `docs.cortex.foundation`
 HTTPS. That custom-domain 403 is unrelated to CF 1010 on `api.ferndesk.com`.
+
+When that record goes in, use a **Direct CNAME (DNS only)** — **do not enable
+orange-cloud Proxied**; that causes Cloudflare **Cross-User Banned** (Error 1014).
+The same rule holds for every other Cortex custom domain that CNAMEs to a
+third-party host: [`README.md`](../README.md#custom-domain-dns).