diff --git a/Infra-Network/SECRETS_CLOUDFLARE_MYVEXX.md b/Infra-Network/SECRETS_CLOUDFLARE_MYVEXX.md
new file mode 100644
index 0000000..09d078b
--- /dev/null
+++ b/Infra-Network/SECRETS_CLOUDFLARE_MYVEXX.md
@@ -0,0 +1,24 @@
+# Cloudflare — zona myvexx.com
+
+**NÃO commitar. NÃO partilhar no chat.** Token de API (Edit zone DNS + tunnel).
+
+- **Zona:** myvexx.com
+- **Zone ID:** `aa0aa51acf9f88579209a6b6326f1032`
+- **Account ID:** `2d504d7a78dd787696fe1c703fb001c1`
+- **Token (cfut_):** `cfut_XlS4markPbxhcJfX28G5xHAW8viXqBAnSYYs3AQnd4236cc3`
+- **Túnel:** `7233d455-2e1f-45b3-bf3a-4bfad26b2f4a` (`big-local-mycloud`)
+- **Config do túnel:** remota na Cloudflare (`config_src: cloudflare`). O YAML em `/etc/cloudflared/config-mycloud.yml` no host BIG **não** é a fonte de verdade dos hostnames públicos.
+
+## Hosts desta sessão (2026-09-08)
+
+| Host | Destino | Serviço |
+|---|---|---|
+| `r630.myvexx.com` | VM500 `:8787` Tapo P110 R630 | medição real |
+| `boiler.myvexx.com` | CT120 `:8788` Tuya boiler | estimativa ON×2,3 kW |
+| `r630.myvexx.com/boiler/` | mesmo app boiler (path) | fallback |
+
+CNAME de ambos: `7233d455-2e1f-45b3-bf3a-4bfad26b2f4a.cfargotunnel.com` (proxied).
+
+Para novo hostname: 1) CNAME na zona 2) **PUT** na config remota do túnel (antes do `http_status:404`) 3) rota Traefik CT120.
+
+Verificar token: `GET https://api.cloudflare.com/client/v4/user/tokens/verify`
\ No newline at end of file