cloudflare: disable managed robots.txt; fix v5 config bugs
- Add cloudflare_bot_management for all zones with is_robots_txt_managed=false so each app's own robots.txt is served instead of Cloudflare's managed one - Fix zone_setting id zero_rtt -> 0rtt (invalid id rejected by API) - Fix security_header value: object instead of jsonencode (avoids perpetual diff) - Fix firewall expression http.request.user_agent -> http.user_agent (invalid field) - tofu fmt reindentation
This commit is contained in:
parent
c5b658d653
commit
d632095eb2
1 changed files with 69 additions and 43 deletions
|
|
@ -327,10 +327,10 @@ resource "cloudflare_dns_record" "caa" {
|
|||
ttl = 86400
|
||||
|
||||
data = {
|
||||
flags = 0
|
||||
tag = "issue"
|
||||
value = each.value.ca
|
||||
}
|
||||
flags = 0
|
||||
tag = "issue"
|
||||
value = each.value.ca
|
||||
}
|
||||
}
|
||||
|
||||
# =============================================================================
|
||||
|
|
@ -349,11 +349,11 @@ resource "cloudflare_dns_record" "towerops_srv_autodiscover" {
|
|||
ttl = 86400
|
||||
|
||||
data = {
|
||||
priority = 0
|
||||
weight = 0
|
||||
port = 443
|
||||
target = "mail.mcintire.me"
|
||||
}
|
||||
priority = 0
|
||||
weight = 0
|
||||
port = 443
|
||||
target = "mail.mcintire.me"
|
||||
}
|
||||
}
|
||||
|
||||
# =============================================================================
|
||||
|
|
@ -383,7 +383,7 @@ resource "cloudflare_zone_setting" "aprs_me_tls_1_3" {
|
|||
|
||||
resource "cloudflare_zone_setting" "aprs_me_zero_rtt" {
|
||||
zone_id = cloudflare_zone.zones["aprs.me"].id
|
||||
setting_id = "zero_rtt"
|
||||
setting_id = "0rtt"
|
||||
value = "on"
|
||||
}
|
||||
|
||||
|
|
@ -396,7 +396,7 @@ resource "cloudflare_zone_setting" "aprs_me_ssl" {
|
|||
resource "cloudflare_zone_setting" "aprs_me_security_header" {
|
||||
zone_id = cloudflare_zone.zones["aprs.me"].id
|
||||
setting_id = "security_header"
|
||||
value = jsonencode({
|
||||
value = {
|
||||
strict_transport_security = {
|
||||
enabled = true
|
||||
max_age = 15552000
|
||||
|
|
@ -404,7 +404,7 @@ resource "cloudflare_zone_setting" "aprs_me_security_header" {
|
|||
preload = true
|
||||
nosniff = true
|
||||
}
|
||||
})
|
||||
}
|
||||
}
|
||||
|
||||
# towerops.net
|
||||
|
|
@ -428,7 +428,7 @@ resource "cloudflare_zone_setting" "towerops_net_tls_1_3" {
|
|||
|
||||
resource "cloudflare_zone_setting" "towerops_net_zero_rtt" {
|
||||
zone_id = cloudflare_zone.zones["towerops.net"].id
|
||||
setting_id = "zero_rtt"
|
||||
setting_id = "0rtt"
|
||||
value = "on"
|
||||
}
|
||||
|
||||
|
|
@ -441,7 +441,7 @@ resource "cloudflare_zone_setting" "towerops_net_ssl" {
|
|||
resource "cloudflare_zone_setting" "towerops_net_security_header" {
|
||||
zone_id = cloudflare_zone.zones["towerops.net"].id
|
||||
setting_id = "security_header"
|
||||
value = jsonencode({
|
||||
value = {
|
||||
strict_transport_security = {
|
||||
enabled = true
|
||||
max_age = 15552000
|
||||
|
|
@ -449,7 +449,7 @@ resource "cloudflare_zone_setting" "towerops_net_security_header" {
|
|||
preload = true
|
||||
nosniff = true
|
||||
}
|
||||
})
|
||||
}
|
||||
}
|
||||
|
||||
# gridmap.org
|
||||
|
|
@ -473,7 +473,7 @@ resource "cloudflare_zone_setting" "gridmap_org_tls_1_3" {
|
|||
|
||||
resource "cloudflare_zone_setting" "gridmap_org_zero_rtt" {
|
||||
zone_id = cloudflare_zone.zones["gridmap.org"].id
|
||||
setting_id = "zero_rtt"
|
||||
setting_id = "0rtt"
|
||||
value = "on"
|
||||
}
|
||||
|
||||
|
|
@ -486,7 +486,7 @@ resource "cloudflare_zone_setting" "gridmap_org_ssl" {
|
|||
resource "cloudflare_zone_setting" "gridmap_org_security_header" {
|
||||
zone_id = cloudflare_zone.zones["gridmap.org"].id
|
||||
setting_id = "security_header"
|
||||
value = jsonencode({
|
||||
value = {
|
||||
strict_transport_security = {
|
||||
enabled = true
|
||||
max_age = 15552000
|
||||
|
|
@ -494,8 +494,34 @@ resource "cloudflare_zone_setting" "gridmap_org_security_header" {
|
|||
preload = true
|
||||
nosniff = true
|
||||
}
|
||||
})
|
||||
}
|
||||
}
|
||||
|
||||
# =============================================================================
|
||||
# Bot Management - disable Cloudflare managed robots.txt
|
||||
#
|
||||
# Each app repo ships its own robots.txt. Turning off the managed robots.txt
|
||||
# feature ("Instruct AI bot traffic with robots.txt") stops Cloudflare from
|
||||
# prepending/serving its own robots.txt at the zone edge, so the origin's file
|
||||
# is returned unchanged. All other bot_management fields are Optional+Computed,
|
||||
# so omitting them preserves their current values (e.g. Super Bot Fight Mode).
|
||||
#
|
||||
# NOTE: requires CLOUDFLARE_API_TOKEN to include the "Bot Management Write"
|
||||
# permission for these zones; the DNS-scoped token cannot apply this.
|
||||
# =============================================================================
|
||||
|
||||
resource "cloudflare_bot_management" "zones" {
|
||||
for_each = cloudflare_zone.zones
|
||||
|
||||
zone_id = each.value.id
|
||||
is_robots_txt_managed = false
|
||||
}
|
||||
|
||||
resource "cloudflare_bot_management" "w5isp_com" {
|
||||
zone_id = cloudflare_zone.w5isp_com.id
|
||||
is_robots_txt_managed = false
|
||||
}
|
||||
|
||||
# =============================================================================
|
||||
# Firewall - custom rules (applied to all zones)
|
||||
# =============================================================================
|
||||
|
|
@ -514,7 +540,7 @@ locals {
|
|||
"(http.request.uri.path contains \"/.git\")",
|
||||
"(http.request.uri.path contains \"/phpmyadmin\")",
|
||||
"(http.request.uri.path contains \"/cgi-bin\")",
|
||||
"(not http.request.user_agent exists)",
|
||||
"(not http.user_agent ne \"\")",
|
||||
])
|
||||
}
|
||||
|
||||
|
|
@ -581,13 +607,13 @@ resource "cloudflare_ruleset" "towerops_firewall" {
|
|||
logging = {
|
||||
enabled = false
|
||||
}
|
||||
},
|
||||
},
|
||||
|
||||
{
|
||||
action = "block"
|
||||
expression = local.firewall_expression
|
||||
description = "block abusers"
|
||||
enabled = true
|
||||
{
|
||||
action = "block"
|
||||
expression = local.firewall_expression
|
||||
description = "block abusers"
|
||||
enabled = true
|
||||
}]
|
||||
}
|
||||
import {
|
||||
|
|
@ -1017,11 +1043,11 @@ resource "cloudflare_dns_record" "w5isp_srv_autodiscover" {
|
|||
ttl = 86400
|
||||
|
||||
data = {
|
||||
priority = 0
|
||||
weight = 0
|
||||
port = 443
|
||||
target = "mail.w5isp.com"
|
||||
}
|
||||
priority = 0
|
||||
weight = 0
|
||||
port = 443
|
||||
target = "mail.w5isp.com"
|
||||
}
|
||||
}
|
||||
|
||||
# =============================================================================
|
||||
|
|
@ -1048,7 +1074,7 @@ resource "cloudflare_zone_setting" "w5isp_com_tls_1_3" {
|
|||
|
||||
resource "cloudflare_zone_setting" "w5isp_com_zero_rtt" {
|
||||
zone_id = cloudflare_zone.w5isp_com.id
|
||||
setting_id = "zero_rtt"
|
||||
setting_id = "0rtt"
|
||||
value = "on"
|
||||
}
|
||||
|
||||
|
|
@ -1061,7 +1087,7 @@ resource "cloudflare_zone_setting" "w5isp_com_ssl" {
|
|||
resource "cloudflare_zone_setting" "w5isp_com_security_header" {
|
||||
zone_id = cloudflare_zone.w5isp_com.id
|
||||
setting_id = "security_header"
|
||||
value = jsonencode({
|
||||
value = {
|
||||
strict_transport_security = {
|
||||
enabled = true
|
||||
max_age = 15552000
|
||||
|
|
@ -1069,7 +1095,7 @@ resource "cloudflare_zone_setting" "w5isp_com_security_header" {
|
|||
preload = true
|
||||
nosniff = true
|
||||
}
|
||||
})
|
||||
}
|
||||
}
|
||||
|
||||
# =============================================================================
|
||||
|
|
@ -1096,13 +1122,13 @@ resource "cloudflare_ruleset" "w5isp_firewall" {
|
|||
logging = {
|
||||
enabled = false
|
||||
}
|
||||
},
|
||||
},
|
||||
|
||||
{
|
||||
action = "block"
|
||||
expression = local.firewall_expression
|
||||
description = "block abusers"
|
||||
enabled = true
|
||||
{
|
||||
action = "block"
|
||||
expression = local.firewall_expression
|
||||
description = "block abusers"
|
||||
enabled = true
|
||||
}]
|
||||
}
|
||||
# =============================================================================
|
||||
|
|
@ -1118,10 +1144,10 @@ resource "cloudflare_dns_record" "w5isp_caa" {
|
|||
ttl = 86400
|
||||
|
||||
data = {
|
||||
flags = 0
|
||||
tag = "issue"
|
||||
value = each.value
|
||||
}
|
||||
flags = 0
|
||||
tag = "issue"
|
||||
value = each.value
|
||||
}
|
||||
}
|
||||
|
||||
resource "cloudflare_zero_trust_tunnel_cloudflared_config" "towerops_dev" {
|
||||
|
|
|
|||
Loading…
Add table
Reference in a new issue