ops: extend Cloudflare IP synchronization to original gateway

scripts/node-onboarding/dpl-cloudflare-ips.service

@@ -1,5 +1,5 @@
 [Unit]
-Description=Synchronize DPL vhost trusted Cloudflare ranges
+Description=Synchronize both subscription gateways' trusted Cloudflare ranges
 [Service]
 Type=oneshot
 ExecStart=/usr/bin/python3 /opt/dpl-gateway/provision/update-cloudflare-ips.py

scripts/node-onboarding/enable-original-gateway-ip-sync.py

@@ -0,0 +1,28 @@
+#!/usr/bin/env python3
+"""Authorized extension: add dynamic CF trust only to the original gateway vhosts."""
+import pathlib
+import re
+import subprocess
+
+p = pathlib.Path('/etc/nginx/conf.d/g1.gembox-sub.com.conf')
+include = 'include /etc/nginx/dpl-cloudflare-realip.conf;'
+assert pathlib.Path('/etc/nginx/dpl-cloudflare-realip.conf').is_file()
+old = p.read_text()
+if include in old:
+    print('Original gateway already uses dynamic Cloudflare ranges')
+    raise SystemExit
+pattern = r'(?m)^(\s*server_name\s+fu101\.gembox-sub\.com\s*;)$'
+new, count = re.subn(pattern, lambda m: m.group(0) + '\n    ' + include, old)
+assert 1 <= count <= 2, 'Unexpected vhost structure; inspect manually'
+backup = pathlib.Path('/root/codex-backups/dpl-gateway-20261011/original-before-ip-sync.conf')
+assert not backup.exists(), 'Backup exists; inspect previous attempt'
+backup.write_text(old)
+backup.chmod(0o600)
+p.write_text(new)
+try:
+    subprocess.run(['nginx', '-t'], check=True)
+    subprocess.run(['systemctl', 'reload', 'nginx'], check=True)
+except Exception:
+    p.write_text(old)
+    raise
+print(f'Original gateway Cloudflare trust synchronized in {count} vhosts; no containers restarted')

scripts/node-onboarding/update-cloudflare-ips.py

@@ -1,5 +1,5 @@
 #!/usr/bin/env python3
-"""Update the DPL vhost's trusted ranges, retaining the last valid configuration on failure."""
+"""Update the gateway vhosts' trusted ranges, retaining the last valid configuration on failure."""
 import ipaddress
 import os
 import pathlib