# Inject the origin-auth header on every request the CDN forwards to the origin
# (doc/05 §2 回源鉴权). The Go originauth middleware rejects any request lacking
# this header or coming from a non-CDN source IP.
#
# The value is sensitive and supplied via TF_VAR_origin_auth_value; it is never
# stored in the repo. During quarterly rotation the origin accepts both the old
# and new value (Config.Previous), so apply the new value here first, then retire
# the old one on the origin after propagation.
resource "cloudflare_ruleset" "origin_auth" {
  zone_id = var.zone_id
  name    = "pangolin-origin-auth"
  kind    = "zone"
  phase   = "http_request_late_transform"

  rules {
    action      = "rewrite"
    description = "Inject origin-auth header on origin requests"
    enabled     = true
    expression  = "true"

    action_parameters {
      headers {
        name      = var.origin_auth_header
        operation = "set"
        value     = var.origin_auth_value
      }
    }
  }
}