# 0.5 — Diagnose apex 403

Phase: 0 — Unblock

Depends on: [00-decisions.md](00-decisions.md) decision #2

- [ ] Diagnose apex 403 — check Cloudflare tunnel Public Hostnames list and WAF event log

Partial evidence (2026-08-18): `kubectl get ingress -A` has zero rules for bare host `riotpiao.com` — every ingress is a subdomain (22 hosts, all `*.riotpiao.com` per the `*.riotpiao.homelab.com` retirement). No in-cluster origin exists for the apex today. Leans toward "no origin configured" as the cause, but Cloudflare tunnel Public Hostnames list + WAF event log still needed to confirm the tunnel-side config (not visible from `kubectl`).

## Verify

```bash
curl -sS -o /dev/null -w '%{http_code}\n' https://riotpiao.com   # 200
```