## Trigger

- Need to add, audit, or explain a `*.lihan3238.com` hostname that should use
  the same preferred Cloudflare edge IP as `api.lihan3238.com`.
- Current ownership split:
  - `lihan3238.com` DNS stays at Spaceship.
  - `lihan3238.top` is the Cloudflare-managed zone that owns Cloudflare for
    SaaS Custom Hostnames and fallback origin `origin.lihan3238.top`.
  - Hostinger origin runs `relay-cloudflared`; Caddy is only the legacy
    direct-origin fallback.

## Fix

- Default preferred IP: reuse the current `api.lihan3238.com` A record target
  `172.64.155.231` unless Lihan explicitly re-benchmarks and changes the
  preferred IP.
- For each new public hostname `<host>.lihan3238.com`:
  1. Spaceship DNS (`lihan3238.com`): create or replace:
     ```text
     Type: A
     Host: <host>
     Value: 172.64.155.231
     ```
     Do not keep a CNAME for the same host.
  2. Cloudflare `lihan3238.top` zone: add Custom Hostname
     `<host>.lihan3238.com`; keep fallback origin as
     `origin.lihan3238.top`; add Cloudflare-provided TXT validation records
     back in Spaceship DNS until certificate and hostname are active.
  3. If the hostname should serve New API, add an explicit `cloudflared`
     ingress rule before the final fallback:
     ```yaml
       - hostname: <host>.lihan3238.com
         service: http://new-api:3000
       - service: http_status:404
     ```
     Recreate only `cloudflared` so the bind-mounted single-file config is
     remounted:
     ```bash
     docker compose -p lihan_ai --env-file .env.production \
       -f docker-compose.yml \
       -f docker-compose.prod.yml \
       -f docker-compose.cpa.yml \
       -f docker-compose.cloudflare-tunnel.yml \
       up -d --no-deps --force-recreate cloudflared
     ```
  4. If the hostname should be a Worker/blog hostname, do **not** add it to
     New API `cloudflared` ingress. Keep or add the Worker route instead.
- Keep the last `cloudflared` rule as `http_status:404`, not
  `http://new-api:3000`. This prevents a misconfigured Custom Hostname, Worker,
  or DNS record from silently falling into New API.
- `origin.lihan3238.top` is the fallback-origin/tunnel anchor. It does not
  own all `*.lihan3238.com` traffic; Cloudflare only reaches it for hostnames
  whose Custom Hostname/route path is configured to use that fallback.

## Reuse Rule

- Load before changing Spaceship DNS, Cloudflare Custom Hostnames, Worker
  routes, or `cloudflared` ingress for `lihan3238.com` hostnames.
- Do not load for ordinary Cloudflare zones where DNS is already delegated to
  Cloudflare and Cloudflare for SaaS is not involved.