Hermes + Cloudflare: DNS and Deployment Automation from the Terminal

I have dozens of subdomains: blogs, landing pages, APIs, notification services. Managing all of this through the Cloudflare Dashboard is painful. Logging in every time, finding the right record, clicking around, waiting...

The solution is to hand it off to an AI agent. Hermes Agent can work with Cloudflare via CLI and API. Here's how I set up this pipeline.

Why Does an Agent Need Cloudflare?

A typical scenario: I deploy a new service on a VPS and want it accessible over HTTPS on its own subdomain. It used to be:

1. Log into the Cloudflare Dashboard
2. Create a DNS record
3. Wait for propagation
4. Verify SSL
5. Configure Caddy/nginx

Now I just tell Hermes: "Set up ntfy on the notify subdomain and proxy it through Cloudflare." The agent handles everything itself.

Tool: flarectl

flarectl is the official CLI utility from Cloudflare. Installation:

go install github.com/cloudflare/cloudflare-go/cmd/flarectl@latest

Authentication via environment variables:

export CF_API_TOKEN=your-api-token
export CF_ACCOUNT_ID=your-account-id

The token is created in Dashboard → My Profile → API Tokens. Required permissions: Zone:DNS:Edit, Zone:Zone:Read.

Basic Operations

Creating a DNS Record

A record (subdomain → server IP):

flarectl dns create --zone example.com \
  --type A --name myservice --content 203.0.113.1 --proxied

CNAME (subdomain → Cloudflare Pages project):

flarectl dns create --zone example.com \
  --type CNAME --name blog --content my-project.pages.dev --proxied

The --proxied flag enables the orange cloud — Cloudflare caches, protects against DDoS, and terminates SSL.

Updating Records

flarectl dns update --zone example.com \
  --id RECORD_ID --type A --name myservice --content 203.0.113.2

Deleting

flarectl dns delete --zone example.com --id RECORD_ID

Cloudflare Pages: Deploying Static Sites

For Nuxt, Astro, Next.js, and other SSG/SSR frameworks, Cloudflare Pages offers free hosting with a CDN. Deployment via the wrangler CLI:

npm install -g wrangler

# Authentication
wrangler login

# Deploy from dist/ folder
wrangler pages deploy dist --project-name=my-blog

A custom domain is attached via the API:

curl -s -X POST \
  "https://api.cloudflare.com/client/v4/accounts/$CF_ACCOUNT_ID/pages/projects/my-blog/domains" \
  -H "Authorization: Bearer *** \
  -H "Content-Type: application/json" \
  --data '{"name": "blog.example.com"}'

Wrangler v4.94+ may not support wrangler pages domain add. Use the API directly.

SSL: Flexible vs Full

SSL:Flexible — Cloudflare terminates SSL at its edge; plain HTTP goes to your origin. No certificate needed on the server. Ideal for services that don't natively support HTTPS.

SSL:Full — Cloudflare terminates SSL at the edge, but also uses SSL to connect to the origin. A certificate is required on the server (you can use a free Cloudflare Origin CA certificate).

For self-hosted services on a single VPS, Flexible is usually sufficient. However, if the service transmits sensitive data, use Full.

Automation via Hermes

Here's how it works in real life. Hermes Agent has terminal access and can execute commands. I say:

"Set up Grafana on monitor.example.com"

The agent:

1. Checks that Grafana is installed
2. Creates a DNS A record via flarectl
3. Configures the Caddy reverse proxy
4. Verifies HTTPS

All in one conversation, without switching to the Dashboard.

Cron Monitoring

Hermes can check DNS records on a schedule:

flarectl dns list --zone example.com --type A

If a record has changed or disappeared, the agent sends a notification.

Pitfalls

Proxy status. If a record is not proxied (grey cloud), Cloudflare won't terminate SSL or cache. For services that should be behind a CDN, always use proxied.

Cache purge. After deploying a new build, Cloudflare might serve the old cache. To purge:

curl -s -X POST \
  "https://api.cloudflare.com/client/v4/zones/$ZONE_ID/purge_cache" \
  -H "Authorization: Bearer *** \
  --data '{"purge_everything":true}'

Rate limits. The Cloudflare Free plan has API call limits. This is rarely an issue for automation, but if the agent makes dozens of requests per minute, it might hit a 429 error.

DNS propagation. After creating a record, DNS propagates within 1-5 minutes. Hermes verifies via dig or flarectl dns list before considering the task complete.

Conclusion

Cloudflare Free + Hermes Agent = full infrastructure automation from the terminal. No Dashboard, no manual clicking. The agent manages DNS, deploys static sites, configures SSL, and monitors records.

For self-hosted projects, this is the ideal stack: free, reliable, and entirely CLI-driven.