diff --git a/README.md b/README.md index 6967912..7d9c795 100644 --- a/README.md +++ b/README.md @@ -114,7 +114,7 @@ module "zone" { source = "cloudposse/zone/cloudflare" # Cloud Posse recommends pinning every module to a specific version # version = "x.x.x" - zone = "cloudposse.co" + zone = "cloudposse.co" records = [ { name = "bastion" @@ -257,7 +257,7 @@ Are you using this project or any of our other projects? Consider [leaving a tes Check out these related projects. - [terraform-null-label](https://github.com/cloudposse/terraform-null-label) - Terraform Module to define a consistent naming convention by (namespace, stage, name, [attributes]) -- [terraform-cloudflare-waf-rulesets](https://github.com/cloudposse/terraform-cloudflare-waf-rulesets) - %!s() +- [terraform-cloudflare-waf-rulesets](https://github.com/cloudposse/terraform-cloudflare-waf-rulesets) - Terraform module to manage CloudFlare WAF rulesetes diff --git a/README.yaml b/README.yaml index 0de374f..309b4c2 100644 --- a/README.yaml +++ b/README.yaml @@ -37,7 +37,7 @@ related: stage, name, [attributes]) url: https://github.com/cloudposse/terraform-null-label - name: terraform-cloudflare-waf-rulesets - description: + description: Terraform module to manage CloudFlare WAF rulesetes url: https://github.com/cloudposse/terraform-cloudflare-waf-rulesets references: - name: terraform-provider-cloudflare @@ -72,7 +72,7 @@ usage: |- source = "cloudposse/zone/cloudflare" # Cloud Posse recommends pinning every module to a specific version # version = "x.x.x" - zone = "cloudposse.co" + zone = "cloudposse.co" records = [ { name = "bastion" diff --git a/firewall.tf b/firewall.tf index b5f2610..b63f897 100644 --- a/firewall.tf +++ b/firewall.tf @@ -1,10 +1,9 @@ locals { firewall_rules = module.this.enabled && var.firewall_rules != null ? { - for indx, rule in flatten(var.firewall_rules) : - format("%s-%s-%s", + for rule in flatten(var.firewall_rules) : + format("%s-%s", rule.action, md5(rule.expression), - lookup(rule, "description", null) == null ? md5(format("Managed by Terraform #%d", indx)) : md5(rule.description), ) => rule } : {} } @@ -28,10 +27,5 @@ resource "cloudflare_firewall_rule" "default" { priority = lookup(each.value, "priority", null) paused = lookup(each.value, "paused", null) products = lookup(each.value, "products", null) - - filter_id = [ - for filter in values(cloudflare_filter.default)[*] : - filter.id - if filter.description == each.value.description - ][0] + filter_id = cloudflare_filter.default[each.key].id } diff --git a/healthcheck.tf b/healthcheck.tf index 689d20f..95b80d6 100644 --- a/healthcheck.tf +++ b/healthcheck.tf @@ -2,7 +2,7 @@ locals { healthchecks = module.this.enabled && var.healthchecks != null ? { for healthcheck in flatten(var.healthchecks) : format("%s-%s-%s", - lookup(healthcheck, "name", null) == null ? module.this.id : healthcheck.name, + lookup(healthcheck, "name", module.this.id), healthcheck.type, healthcheck.address ) => healthcheck diff --git a/page_rule.tf b/page_rule.tf index dac6aa4..b51ce91 100644 --- a/page_rule.tf +++ b/page_rule.tf @@ -101,6 +101,7 @@ resource "cloudflare_page_rule" "default" { include = lookup(cache_key_fields.value.query_string, "include", null) ignore = lookup(cache_key_fields.value.query_string, "ignore", null) } + user { device_type = lookup(cache_key_fields.value.user, "device_type", null) geo = lookup(cache_key_fields.value.user, "geo", null) diff --git a/variables.tf b/variables.tf index 11034b9..e618063 100644 --- a/variables.tf +++ b/variables.tf @@ -46,12 +46,22 @@ variable "plan" { type = string description = "The name of the commercial plan to apply to the zone. Possible values: `free`, `pro`, `business`, `enterprise`" default = "free" + + validation { + condition = var.plan == null ? true : contains(["free", "pro", "business", "enterprise"], var.plan) + error_message = "Allowed values: `free`, `pro`, `business`, `enterprise`." + } } variable "type" { type = string description = "A full zone implies that DNS is hosted with Cloudflare. A `partial` zone is typically a partner-hosted zone or a CNAME setup. Possible values: `full`, `partial`." default = "full" + + validation { + condition = var.type == null ? true : contains(["full", "partial"], var.type) + error_message = "Allowed values: `full`, `partial`." + } } variable "argo_enabled" {