wangjia
7d89ec9d91
- domains.md: 四组域名隔离登记 + 冷备池 ≥5 + 启用流程（不含身份信息） - cdn/terraform: Cloudflare 配置即代码（WAF/bot/速率限制/代理DNS/回源鉴权注入）+ 30min 重放 Runbook - server/internal/originauth: 回源鉴权中间件，非 CDN 网段或鉴权头不符一律 403，支持双值轮换 - tools/endpoint-signer: 离线 Ed25519 签名 CLI（端点 + 公告文档，单调版本防回滚，key_id 双公钥轮换） - tools/publish-mirrors: ≥3 镜像发布 + hash 一致性校验 + 故障转移取回 - CLIENT-CONTRACT.md: schema/验签/防回滚/合并/兜底链/channel 客户端契约 - 出站独立出口要求写入部署文档；私钥/token/身份信息一律不入库 Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
30 lines
997 B
Terraform
30 lines
997 B
Terraform
# Inject the origin-auth header on every request the CDN forwards to the origin
|
|
# (doc/05 §2 回源鉴权). The Go originauth middleware rejects any request lacking
|
|
# this header or coming from a non-CDN source IP.
|
|
#
|
|
# The value is sensitive and supplied via TF_VAR_origin_auth_value; it is never
|
|
# stored in the repo. During quarterly rotation the origin accepts both the old
|
|
# and new value (Config.Previous), so apply the new value here first, then retire
|
|
# the old one on the origin after propagation.
|
|
resource "cloudflare_ruleset" "origin_auth" {
|
|
zone_id = var.zone_id
|
|
name = "pangolin-origin-auth"
|
|
kind = "zone"
|
|
phase = "http_request_late_transform"
|
|
|
|
rules {
|
|
action = "rewrite"
|
|
description = "Inject origin-auth header on origin requests"
|
|
enabled = true
|
|
expression = "true"
|
|
|
|
action_parameters {
|
|
headers {
|
|
name = var.origin_auth_header
|
|
operation = "set"
|
|
value = var.origin_auth_value
|
|
}
|
|
}
|
|
}
|
|
}
|