wangjia
7d89ec9d91
- domains.md: 四组域名隔离登记 + 冷备池 ≥5 + 启用流程（不含身份信息） - cdn/terraform: Cloudflare 配置即代码（WAF/bot/速率限制/代理DNS/回源鉴权注入）+ 30min 重放 Runbook - server/internal/originauth: 回源鉴权中间件，非 CDN 网段或鉴权头不符一律 403，支持双值轮换 - tools/endpoint-signer: 离线 Ed25519 签名 CLI（端点 + 公告文档，单调版本防回滚，key_id 双公钥轮换） - tools/publish-mirrors: ≥3 镜像发布 + hash 一致性校验 + 故障转移取回 - CLIENT-CONTRACT.md: schema/验签/防回滚/合并/兜底链/channel 客户端契约 - 出站独立出口要求写入部署文档；私钥/token/身份信息一律不入库 Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
51 lines
1.5 KiB
Terraform
51 lines
1.5 KiB
Terraform
variable "zone_id" {
|
|
description = "Cloudflare zone ID for the domain being onboarded."
|
|
type = string
|
|
}
|
|
|
|
variable "account_id" {
|
|
description = "Cloudflare account ID (used by account-scoped resources)."
|
|
type = string
|
|
default = ""
|
|
}
|
|
|
|
variable "origin_ip" {
|
|
description = "Origin server IP the CDN proxies to. Only the CDN ever talks to it; clients never see it (doc/05 §2)."
|
|
type = string
|
|
}
|
|
|
|
variable "api_hostnames" {
|
|
description = "Proxied hostnames served by this zone (API pool / subscription / website mirror)."
|
|
type = list(string)
|
|
}
|
|
|
|
variable "origin_auth_header" {
|
|
description = "Header name the CDN injects on origin requests; the Go originauth middleware checks it."
|
|
type = string
|
|
default = "X-Origin-Auth"
|
|
}
|
|
|
|
variable "origin_auth_value" {
|
|
description = "Secret origin-auth value. Provide via TF_VAR_origin_auth_value env var — NEVER commit it. Rotated quarterly (doc/06 §6)."
|
|
type = string
|
|
sensitive = true
|
|
}
|
|
|
|
variable "rate_limit_requests_per_minute" {
|
|
description = "Per-IP request budget for /v1/* before mitigation."
|
|
type = number
|
|
default = 120
|
|
}
|
|
|
|
variable "rate_limit_mitigation_seconds" {
|
|
description = "How long an offending IP stays blocked."
|
|
type = number
|
|
default = 600
|
|
}
|
|
|
|
variable "enable_bot_management" {
|
|
description = "Enable the cloudflare_bot_management resource (requires Pro+/Bot Management on the plan)."
|
|
type = bool
|
|
default = true
|
|
}
|