wangjia
7d89ec9d91
- domains.md: 四组域名隔离登记 + 冷备池 ≥5 + 启用流程（不含身份信息） - cdn/terraform: Cloudflare 配置即代码（WAF/bot/速率限制/代理DNS/回源鉴权注入）+ 30min 重放 Runbook - server/internal/originauth: 回源鉴权中间件，非 CDN 网段或鉴权头不符一律 403，支持双值轮换 - tools/endpoint-signer: 离线 Ed25519 签名 CLI（端点 + 公告文档，单调版本防回滚，key_id 双公钥轮换） - tools/publish-mirrors: ≥3 镜像发布 + hash 一致性校验 + 故障转移取回 - CLIENT-CONTRACT.md: schema/验签/防回滚/合并/兜底链/channel 客户端契约 - 出站独立出口要求写入部署文档；私钥/token/身份信息一律不入库 Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
23 lines
670 B
Plaintext
23 lines
670 B
Plaintext
# Copy to terraform.tfvars and fill in. terraform.tfvars is gitignored.
|
|
# NEVER put the API token or origin_auth_value in a committed file.
|
|
#
|
|
# export CLOUDFLARE_API_TOKEN=... # provider auth
|
|
# export TF_VAR_origin_auth_value=... # secret origin-auth header value
|
|
|
|
zone_id = "__CF_ZONE_ID__"
|
|
account_id = "__CF_ACCOUNT_ID__"
|
|
origin_ip = "__ORIGIN_IP__"
|
|
|
|
api_hostnames = [
|
|
"api.example.com",
|
|
"sub.example.com",
|
|
]
|
|
|
|
origin_auth_header = "X-Origin-Auth"
|
|
|
|
rate_limit_requests_per_minute = 120
|
|
rate_limit_mitigation_seconds = 600
|
|
enable_bot_management = true
|
|
|
|
# origin_auth_value is intentionally omitted here — set TF_VAR_origin_auth_value.
|