Separate secret runtime state from deployable policy
The module stores tenant credentials and the Help4 site ID with Drupal State API while exportable configuration contains non-secret requested policy. Effective behavior still depends on the registered Help4 plan and DNS/proxy state.
Where settings live
| Data | Storage | Operational effect |
|---|---|---|
| API key, API secret, legacy token | Drupal State API | Not exported through normal configuration synchronization; blank fields preserve them. |
| Help4 site ID and runtime status | Drupal State API | Environment-specific identity, timestamps, plan, license, and last results. |
| Cache, proxy, WAF, bot, headers, access settings | Drupal Config API | Can move through configuration deployment, but the target environment must have its own valid site identity and secrets. |
| Purge work | Drupal Queue API | Processed by cron/queue workers without delaying the editor save. |
Configuration groups
Connection
Tenant credentials, explicit clear-credentials action, synchronization, site ID, plan, license, and last sync.
Cache and queue
Automatic management, path/domain automatic scope, respect-origin/custom browser policy, max age, and immutable.
Proxy and WAF
Static-only/full proxy, WAF off/basic/strict, sensitivity, managed challenge modes, and public HTML cache request.
Headers and transport
HTTPS, HSTS, nosniff, frame/referrer policy, HTTP/2, gzip, Brotli, and minimum response size.
Enterprise access
IP, country, ASN, user-agent, and path lists plus default allow/block action.
Operations
Manual selected-path/domain purge, managed scan, cron heartbeat, queue status, and Drupal logging.
Troubleshooting
| Symptom | Likely cause | Action |
|---|---|---|
| Module is missing from Extend | Wrong directory depth, altered ZIP structure, or unsupported Drupal version. | Confirm modules/custom/help4_cdn/help4_cdn.info.yml and Drupal 10.3/11, then rebuild caches. |
| Settings return access denied | Role lacks the dedicated permission. | Grant Administer Help4 CDN only to the intended administrator role. |
| Sync fails | Credential, hostname, DNS entitlement, or control-plane connectivity problem. | Confirm the production hostname and tenant credential privately; do not print secrets in logs or tickets. |
| Content is stale after save | Cron is not running, auto management is off, or queue processing failed. | Inspect the queue and help4_cdn log channel, process the queue, then verify the exact public object. |
| Imported config has no connection | State API values correctly did not move with config export. | Add environment-specific credentials and synchronize the target site. |
| Policy is saved but not active | Plan entitlement, DNS, or proxy validation does not permit it. | Compare requested module policy with effective Help4 site state and public headers. |
| Administration is blocked | Overbroad access rule, strict WAF, or bot challenge. | Use recovery access, remove the narrow offending rule, then retest login, administration, forms, and APIs. |
Useful checks
drush pm:list --status=enabled --type=module | grep help4_cdn
drush cron
drush queue:run help4_cdn_purge
drush watchdog:show --type=help4_cdn
curl -sSI https://example.com/affected-pathFor support, include the domain, UTC timestamp, Drupal/core module version, Help4 site ID, queue/cron state, requested operation, sanitized error, public POP/cache/policy headers, and a known body marker or hash. Never include tenant keys, secrets, tokens, cookies, session data, or private content.