# Zone-wide security/TLS baseline (doc/05 §2 常规 Web 安全基线).
resource "cloudflare_zone_settings_override" "this" {
  zone_id = var.zone_id

  settings {
    ssl                      = "strict" # full (strict): verify origin cert
    min_tls_version          = "1.2"
    tls_1_3                  = "on"
    always_use_https         = "on"
    automatic_https_rewrites = "on"
    opportunistic_encryption = "on"
    brotli                   = "on"
    security_level           = "high"
    challenge_ttl            = 1800
    browser_check            = "on"

    # HSTS (doc/05 §2 全站 HSTS).
    security_header {
      enabled            = true
      max_age            = 31536000
      include_subdomains = true
      preload            = true
      nosniff            = true
    }
  }
}