Skip to content

Domain & DNS — apexstem.org

Organization: Apex STEM Education Inc. (NJ nonprofit corporation; EIN assigned 2026-06-11)
Primary domain: apexstem.org
Related: Portal & SOP Wiki Plan (Section 6 stack, Phase 0–2 DNS tasks) · Formation progress
Status: Domain on Cloudflare — zone connected (nameservers active)
Last updated: June 2026

Repo hygiene: Do not commit registrar passwords, API tokens, or recovery codes. Store credentials in a board-approved password manager (1Password, Bitwarden org vault, etc.).

1. Registrar (Spaceship)

Field Value
Registrar Spaceship (www.spaceship.org redirects to product site)
Account username rexnfx79
Account email See § Internal — restrict access below
Domain(s) apexstem.org (confirm in Spaceship dashboard; add www only if purchased or included)

Account recovery checklist

  • [ ] Confirm domain appears under My Domains for account rexnfx79
  • [ ] Verify registrar account email is current and accessible by at least two trusted adults (founder + backup board contact when named)
  • [ ] Enable two-factor authentication (2FA) on Spaceship (authenticator app preferred over SMS)
  • [ ] Save recovery/backup codes in password manager — not in this repo
  • [ ] Document who holds the password manager entry (admin role per portal plan)
  • [ ] When org email exists (admin@apexstem.org or it@apexstem.org), add as secondary contact and plan to migrate primary login to org-owned email

Security

  1. 2FA required on Spaceship and on Cloudflare (once added).
  2. Separate Cloudflare account for Apex (org email as account owner when available); do not reuse personal Cloudflare accounts long-term.
  3. Least privilege: Only admin volunteers get registrar + Cloudflare super-admin; board chair holds break-glass recovery info offline.
  4. Lock domain (registrar lock / transfer lock) after DNS is stable.
  5. WHOIS privacy: Enable if offered; org contact can still be legal entity address when incorporated.

2. Planned DNS targets (portal stack)

Aligns with apexstem_portal_plan.md phased stack.

Hostname Purpose Hosting / auth
apexstem.org Public org site (mission, teams, donate, sponsor) Cloudflare Pages (Astro or MkDocs public section)
www.apexstem.org Optional alias 301 redirect → https://apexstem.org (recommended)
docs.apexstem.org Mentor / shared SOP wiki (MkDocs Material) Cloudflare Pages + Cloudflare Access
board.apexstem.org Board hub + grants (MkDocs Material) Cloudflare Pages + Access (board/finance/admin only)
ridgeracersnj.com Team competition site Existing Netlify deploy (separate; cross-link only)

DNS record checklist (after Cloudflare zone is active)

Use Proxied (orange cloud) for web records unless a provider requires DNS-only.

Type Name Content / target Notes
CNAME @ or A Cloudflare Pages apex target Pages provides exact hostname per project
CNAME www apexstem.org or Pages www Redirect rule preferred over duplicate content
CNAME docs Cloudflare Pages project apexstem-docs Access: mentors/parents/board when invited
CNAME board Cloudflare Pages project apexstem-board Access: board/finance/admin only
TXT @ SPF (if sending mail via provider) Add when email provider chosen
TXT _dmarc v=DMARC1; p=none; → tighten later After SPF/DKIM stable
CAA @ Optional: restrict CAs to Let's Encrypt / Cloudflare Hardening

SSL/TLS: With Cloudflare proxy + Pages, certificates are automatic. Set SSL mode to Full (strict) once origin is configured.

Why: Single place for DNS, DDoS protection, Access policies for docs.apexstem.org, and Pages deploys for apex + docs.

Step A — Create Cloudflare zone

  1. Sign up / log in at dash.cloudflare.com with org email when available.
  2. Add site → enter apexstem.org.
  3. Select Free plan (sufficient for MVP).
  4. Cloudflare scans existing records (may be empty).
  5. Copy the two nameservers assigned (e.g. ada.ns.cloudflare.com, bob.ns.cloudflare.com).

Step B — Point registrar to Cloudflare

  1. Log in to Spaceship → Domains → apexstem.org → DNS or Nameservers.
  2. Choose Custom nameservers (not Spaceship default DNS).
  3. Paste Cloudflare’s two nameserver hostnames → save.
  4. Propagation: typically minutes to 48 hours. Cloudflare dashboard shows Active when complete.

Step C — Configure records in Cloudflare

  1. Add Pages projects (apexstem-public, apexstem-docs or similar naming).
  2. Attach custom domains per project (apexstem.org, docs.apexstem.org).
  3. Cloudflare UI will suggest required CNAMEs — add any missing records.
  4. Redirect rule: www.apexstem.org/* → https://apexstem.org/$1 (301).
  5. Enable Always Use HTTPS and Automatic HTTPS Rewrites.

Cloudflare Access for docs

(Step D in cutover sequence.)

  1. Zero Trust → Access → Applications → add docs.apexstem.org.
  2. Policy: allow emails in groups apex-board, apex-mentors, etc. (see portal plan RBAC).
  3. Test with a non-member email (should deny).

Use only for a short bridge before Cloudflare migration.

  1. Keep Spaceship default nameservers.
  2. Add A/CNAME records Spaceship provides for temporary hosting.
  3. You cannot use Cloudflare Access on the same hostname without proxying through Cloudflare — so internal docs still need Cloudflare (or another auth gateway).

Migration tip: When ready, switch nameservers to Cloudflare; remove duplicate records at Spaceship to avoid conflicts.

5. Email forwarding (pre-Google Workspace)

Until Google Workspace for Nonprofits is live, use Cloudflare Email Routing.

Goal: Mail to public aliases lands in one “hello” inbox now, and becomes aliases of hello@ on Workspace later.

Cloudflare limitation: Destination addresses must be verified personal inboxes (e.g. founder Gmail). You usually cannot route sponsorships@ → hello@apexstem.org because hello@ is only a route, not a mailbox yet. Do this instead:

Address Cloudflare destination (now) Google Workspace (later)
hello@apexstem.org Founder personal Gmail (primary) User hello@ (org mailbox)
sponsorships@apexstem.org Same founder Gmail as hello@ Alias of hello@
info@apexstem.org Same founder Gmail (when created) Alias of hello@
board@apexstem.org Google Group (all trustees) Keep as Google Group (not an alias of hello)
treasurer@apexstem.org Treasurer personal Gmail Separate user treasurer@ (or Group)
president@apexstem.org Chair’s inbox when ready Separate user or alias of hello@ if chair = founder

Do not point Cloudflare routes at another @apexstem.org address (loop / unsupported). Point shared public aliases at the same Gmail destination that receives hello@.

Send mail as: Founder Gmail can “Send mail as” hello@ and sponsorships@ (see gmail_send_mail_as.md).

Checklist:

  • [x] Cloudflare Email Routing MX for apexstem.org
  • [x] hello@, sponsorships@ → same founder destination; board@ → Group; treasurer@ → treasurer
  • [ ] Confirm sponsorships@ destination matches hello@ (same Gmail)
  • [ ] Publish hello@ on public site; keep personal emails off public pages
  • [ ] After Workspace: create user hello@, add aliases, move MX to Google, disable Cloudflare Email Routing

6. Operational ownership (RACI)

Task Responsible Accountable
Registrar account & 2FA Technical admin volunteer Board chair
Cloudflare zone & Access Technical admin volunteer Board chair
Public site DNS cutover Admin + marketing volunteer Board
Email forwarding / Workspace Secretary + treasurer Board

7. Immediate action list (founder)

  • [x] Cloudflare: Zone for apexstem.org — connected
  • [x] Spaceship: Nameservers pointed to Cloudflare
  • [ ] Spaceship: 2FA, auto-renew, registrar lock (recommended now)
  • [ ] Cloudflare: 2FA + second super-admin account
  • [x] Email Routing: hello@, board@ (→ Google Group), treasurer@, sponsorships@ (Option B)
  • [x] Send mail as: board@ via Gmail (working)
  • [x] Pages: MkDocs wiki deployed — deploy_docs_cloudflare_pages.md
  • [ ] Custom domain: docs.apexstem.org on Pages project (if not attached)
  • [ ] Pages (optional): Placeholder on apexstem.org
  • [ ] Access: Policies on docs.apexstem.org (rbac-groups.md)
  • [ ] SSL: Full (strict) once Pages attached

8. Next steps — zone is Active

Do these in order in the Cloudflare dashboard.

A. Email Routing (15 min)

  1. Email → Email Routing → enable for apexstem.org.
  2. Add destinations (your Gmail or workspace inboxes).
  3. Create routes:
Address Forward to
hello@apexstem.org Shared inbox you monitor
board@apexstem.org You + board distribution
treasurer@apexstem.org Treasurer
sponsorships@apexstem.org Sponsorship lead
  1. Send test mail to hello@apexstem.org.

B. Internal wiki — docs.apexstem.org (30–60 min)

Full runbook: deploy_docs_cloudflare_pages.md

  1. Workers & Pages → Create → Pages → Connect to Git → rexnfx79/STEMRacing.
  2. Build command: pip install -r docs-requirements.txt && mkdocs build -f mkdocs.apexstem.yml
  3. Output directory: site/apexstem-docs
  4. Custom domain: docs.apexstem.org

C. Cloudflare Access (20 min)

  1. Zero Trust → Access → Applications → add Self-hosted app.
  2. Domain: docs.apexstem.org; session duration per policy.
  3. Create policies + groups per rbac-groups.md.
  4. Test: invite your email; confirm a non-allowed email is blocked.

D. Public root (optional)

  • Second Pages project or redirect apexstem.org → “Coming soon” or link to Ridge Racers + mission one-pager.
  • Redirect rule: www.apexstem.org → https://apexstem.org (301).

E. GitHub Actions deploy (optional alternative to Git-connected Pages)

If you prefer CI deploy: add Cloudflare API token to GitHub secrets and use cloudflare/pages-action — only if Git-connected build is insufficient.

Internal — restrict access

For board/admin only. Store registrar login email, username (rexnfx79), and recovery codes in the board password manager only — not in git.

When Apex has org email and a second admin, update Spaceship and Cloudflare contacts to org-owned addresses.

Document control

Field Value
Author Operations draft (STEMRacing repo)
Next review After Cloudflare zone Active + first Pages deploy