pangea-cloudflare 0.1.0

data/flake.nix

@@ -0,0 +1,60 @@
+{
+  description = "Pangea Cloudflare provider — typed Terraform resource functions";
+
+  inputs = {
+    nixpkgs.url = "github:NixOS/nixpkgs/nixos-unstable";
+    ruby-nix.url = "github:inscapist/ruby-nix";
+    flake-utils.url = "github:numtide/flake-utils";
+    substrate = {
+      url = "github:pleme-io/substrate";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
+    forge = {
+      url = "github:pleme-io/forge";
+      inputs.nixpkgs.follows = "nixpkgs";
+      inputs.substrate.follows = "substrate";
+    };
+  };
+
+  outputs = {
+    self,
+    nixpkgs,
+    ruby-nix,
+    flake-utils,
+    substrate,
+    forge,
+    ...
+  }:
+    flake-utils.lib.eachSystem ["x86_64-linux" "aarch64-linux" "aarch64-darwin"] (system: let
+      pkgs = import nixpkgs {
+        inherit system;
+        overlays = [ruby-nix.overlays.ruby];
+      };
+      rnix = ruby-nix.lib pkgs;
+      rnix-env = rnix {
+        name = "pangea-cloudflare";
+        gemset = ./gemset.nix;
+      };
+      env = rnix-env.env;
+      ruby = rnix-env.ruby;
+
+      rubyBuild = import "${substrate}/lib/ruby-build.nix" {
+        inherit pkgs;
+        forgeCmd = "${forge.packages.${system}.default}/bin/forge";
+        defaultGhcrToken = "";
+      };
+    in {
+      devShells.default = pkgs.mkShell {
+        buildInputs = [env ruby];
+        shellHook = ''
+          export RUBYLIB=$PWD/lib:$RUBYLIB
+          export DRY_TYPES_WARNINGS=false
+        '';
+      };
+
+      apps = rubyBuild.mkRubyGemApps {
+        srcDir = self;
+        name = "pangea-cloudflare";
+      };
+    });
+}

data/gemset.nix

@@ -0,0 +1,272 @@
+{
+  abstract-synthesizer = {
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "1724yzbklcmiiahb7s3y1ir1i0n03b9c3arlib35g85d8hf0h75d";
+      type = "gem";
+    };
+    version = "0.0.15";
+  };
+  base64 = {
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0yx9yn47a8lkfcjmigk79fykxvr80r4m1i35q82sxzynpbm7lcr7";
+      type = "gem";
+    };
+    version = "0.3.0";
+  };
+  bigdecimal = {
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "19y406nx17arzsbc515mjmr6k5p59afprspa1k423yd9cp8d61wb";
+      type = "gem";
+    };
+    version = "4.0.1";
+  };
+  concurrent-ruby = {
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "1aymcakhzl83k77g2f2krz07bg1cbafbcd2ghvwr4lky3rz86mkb";
+      type = "gem";
+    };
+    version = "1.3.6";
+  };
+  diff-lcs = {
+    groups = ["default" "development"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0qlrj2qyysc9avzlr4zs1py3x684hqm61n4czrsk1pyllz5x5q4s";
+      type = "gem";
+    };
+    version = "1.6.2";
+  };
+  docile = {
+    groups = ["default" "development"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "07pj4z3h8wk4fgdn6s62vw1lwvhj0ac0x10vfbdkr9xzk7krn5cn";
+      type = "gem";
+    };
+    version = "1.4.1";
+  };
+  dry-core = {
+    dependencies = ["concurrent-ruby" "logger" "zeitwerk"];
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "18cn9s2p7cbgacy0z41h3sf9jvl75vjfmvj774apyffzi3dagi8c";
+      type = "gem";
+    };
+    version = "1.2.0";
+  };
+  dry-inflector = {
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "1k1dd35sqqqg2abd2g2w78m94pa3mcwvmrsjbkr3hxpn0jxw5c3z";
+      type = "gem";
+    };
+    version = "1.3.1";
+  };
+  dry-logic = {
+    dependencies = ["bigdecimal" "concurrent-ruby" "dry-core" "zeitwerk"];
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "18nf8mbnhgvkw34drj7nmvpx2afmyl2nyzncn3wl3z4h1yyfsvys";
+      type = "gem";
+    };
+    version = "1.6.0";
+  };
+  dry-struct = {
+    dependencies = ["dry-core" "dry-types" "ice_nine" "zeitwerk"];
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0ri9iqxknxvvhpbshf6jn7bq581k8l67iv23mii69yr4k5aqphvl";
+      type = "gem";
+    };
+    version = "1.8.0";
+  };
+  dry-types = {
+    dependencies = ["bigdecimal" "concurrent-ruby" "dry-core" "dry-inflector" "dry-logic" "zeitwerk"];
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0y7icwaa26ycikz6h97gwd1hji3r280n4yr2kmn5sfgqp76yxsxs";
+      type = "gem";
+    };
+    version = "1.9.1";
+  };
+  ice_nine = {
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "1nv35qg1rps9fsis28hz2cq2fx1i96795f91q4nmkm934xynll2x";
+      type = "gem";
+    };
+    version = "0.11.2";
+  };
+  logger = {
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "00q2zznygpbls8asz5knjvvj2brr3ghmqxgr83xnrdj4rk3xwvhr";
+      type = "gem";
+    };
+    version = "1.7.0";
+  };
+  pangea-cloudflare = {
+    dependencies = ["dry-struct" "dry-types" "pangea-core" "terraform-synthesizer"];
+    groups = ["default"];
+    platforms = [];
+    source = {
+      path = ./.;
+      type = "path";
+    };
+    version = "0.1.0";
+  };
+  pangea-core = {
+    dependencies = ["base64" "dry-struct" "dry-types" "terraform-synthesizer"];
+    groups = ["default"];
+    platforms = [];
+    source = {
+      path = ../pangea-core;
+      type = "path";
+    };
+    version = "0.1.0";
+  };
+  rake = {
+    groups = ["development"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "175iisqb211n0qbfyqd8jz2g01q6xj038zjf4q0nm8k6kz88k7lc";
+      type = "gem";
+    };
+    version = "13.3.1";
+  };
+  rspec = {
+    dependencies = ["rspec-core" "rspec-expectations" "rspec-mocks"];
+    groups = ["development"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "11q5hagj6vr694innqj4r45jrm8qcwvkxjnphqgyd66piah88qi0";
+      type = "gem";
+    };
+    version = "3.13.2";
+  };
+  rspec-core = {
+    dependencies = ["rspec-support"];
+    groups = ["default" "development"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0bcbh9yv6cs6pv299zs4bvalr8yxa51kcdd1pjl60yv625j3r0m8";
+      type = "gem";
+    };
+    version = "3.13.6";
+  };
+  rspec-expectations = {
+    dependencies = ["diff-lcs" "rspec-support"];
+    groups = ["default" "development"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0dl8npj0jfpy31bxi6syc7jymyd861q277sfr6jawq2hv6hx791k";
+      type = "gem";
+    };
+    version = "3.13.5";
+  };
+  rspec-mocks = {
+    dependencies = ["diff-lcs" "rspec-support"];
+    groups = ["default" "development"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "071bqrk2rblk3zq3jk1xxx0dr92y0szi5pxdm8waimxici706y89";
+      type = "gem";
+    };
+    version = "3.13.7";
+  };
+  rspec-support = {
+    groups = ["default" "development"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0z64h5rznm2zv21vjdjshz4v0h7bxvg02yc6g7yzxakj11byah06";
+      type = "gem";
+    };
+    version = "3.13.7";
+  };
+  simplecov = {
+    dependencies = ["docile" "simplecov-html" "simplecov_json_formatter"];
+    groups = ["development"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "198kcbrjxhhzca19yrdcd6jjj9sb51aaic3b0sc3pwjghg3j49py";
+      type = "gem";
+    };
+    version = "0.22.0";
+  };
+  simplecov-html = {
+    groups = ["default" "development"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0ikjfwydgs08nm3xzc4cn4b6z6rmcrj2imp84xcnimy2wxa8w2xx";
+      type = "gem";
+    };
+    version = "0.13.2";
+  };
+  simplecov_json_formatter = {
+    groups = ["default" "development"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0a5l0733hj7sk51j81ykfmlk2vd5vaijlq9d5fn165yyx3xii52j";
+      type = "gem";
+    };
+    version = "0.1.4";
+  };
+  terraform-synthesizer = {
+    dependencies = ["abstract-synthesizer"];
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "01yl1s6xnxn3qh42ybqanxdgcfpppg2cvjk8pka7xcf5hxz9qxda";
+      type = "gem";
+    };
+    version = "0.0.28";
+  };
+  zeitwerk = {
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "1pbkiwwla5gldgb3saamn91058nl1sq1344l5k36xsh9ih995nnq";
+      type = "gem";
+    };
+    version = "2.7.5";
+  };
+}

data/lib/pangea/resources/cloudflare.rb

@@ -0,0 +1,213 @@
+# frozen_string_literal: true
+
+module Pangea
+  module Resources
+    # Aggregator module that includes all Cloudflare resource modules.
+    # Each resource file reopens this module and includes itself,
+    # so by the time this file is loaded all resource modules are
+    # already mixed in. This file exists as a single entry point
+    # for consumers who want `include Pangea::Resources::Cloudflare`.
+    module Cloudflare
+      include CloudflareAccessRule
+      include CloudflareAccount
+      include CloudflareAccountDnsSettings
+      include CloudflareAccountDnsSettingsInternalView
+      include CloudflareAccountMember
+      include CloudflareAccountSubscription
+      include CloudflareAccountToken
+      include CloudflareAddressMap
+      include CloudflareApiShield
+      include CloudflareApiShieldDiscoveryOperation
+      include CloudflareApiShieldOperation
+      include CloudflareApiShieldOperationSchemaValidationSettings
+      include CloudflareApiShieldSchema
+      include CloudflareApiShieldSchemaValidationSettings
+      include CloudflareApiToken
+      include CloudflareArgo
+      include CloudflareAuthenticatedOriginPulls
+      include CloudflareAuthenticatedOriginPullsCertificate
+      include CloudflareAuthenticatedOriginPullsSettings
+      include CloudflareBotManagement
+      include CloudflareByoIpPrefix
+      include CloudflareCallsSfuApp
+      include CloudflareCallsTurnApp
+      include CloudflareCertificatePack
+      include CloudflareCloudConnectorRules
+      include CloudflareCloudforceOneRequest
+      include CloudflareCloudforceOneRequestAsset
+      include CloudflareCloudforceOneRequestMessage
+      include CloudflareCloudforceOneRequestPriority
+      include CloudflareContentScanning
+      include CloudflareContentScanningExpression
+      include CloudflareCustomHostname
+      include CloudflareCustomHostnameFallbackOrigin
+      include CloudflareCustomPages
+      include CloudflareCustomSsl
+      include CloudflareD1Database
+      include CloudflareDnsFirewall
+      include CloudflareDnsZoneTransfersAcl
+      include CloudflareDnsZoneTransfersIncoming
+      include CloudflareDnsZoneTransfersOutgoing
+      include CloudflareDnsZoneTransfersPeer
+      include CloudflareDnsZoneTransfersTsig
+      include CloudflareEmailRoutingAddress
+      include CloudflareEmailRoutingCatchAll
+      include CloudflareEmailRoutingDns
+      include CloudflareEmailRoutingRule
+      include CloudflareEmailRoutingSettings
+      include CloudflareEmailSecurityBlockSender
+      include CloudflareEmailSecurityImpersonationRegistry
+      include CloudflareEmailSecurityTrustedDomains
+      include CloudflareFilter
+      include CloudflareFirewallRule
+      include CloudflareHealthcheck
+      include CloudflareHostnameTlsSetting
+      include CloudflareHyperdriveConfig
+      include CloudflareImage
+      include CloudflareImageVariant
+      include CloudflareKeylessCertificate
+      include CloudflareLeakedCredentialCheck
+      include CloudflareLeakedCredentialCheckRule
+      include CloudflareList
+      include CloudflareListItem
+      include CloudflareLoadBalancer
+      include CloudflareLoadBalancerMonitor
+      include CloudflareLoadBalancerPool
+      include CloudflareLogpullRetention
+      include CloudflareLogpushJob
+      include CloudflareLogpushOwnershipChallenge
+      include CloudflareMagicNetworkMonitoringConfiguration
+      include CloudflareMagicNetworkMonitoringRule
+      include CloudflareMagicTransitConnector
+      include CloudflareMagicTransitSite
+      include CloudflareMagicTransitSiteAcl
+      include CloudflareMagicTransitSiteLan
+      include CloudflareMagicTransitSiteWan
+      include CloudflareMagicWanGreTunnel
+      include CloudflareMagicWanIpsecTunnel
+      include CloudflareMagicWanStaticRoute
+      include CloudflareManagedTransforms
+      include CloudflareMtlsCertificate
+      include CloudflareNotificationPolicy
+      include CloudflareNotificationPolicyWebhooks
+      include CloudflareObservatoryScheduledTest
+      include CloudflareOrganization
+      include CloudflareOrganizationProfile
+      include CloudflareOriginCACertificate
+      include CloudflarePageRule
+      include CloudflarePageShieldPolicy
+      include CloudflarePagesDomain
+      include CloudflarePagesProject
+      include CloudflareQueue
+      include CloudflareQueueConsumer
+      include CloudflareR2Bucket
+      include CloudflareR2BucketCors
+      include CloudflareR2BucketEventNotification
+      include CloudflareR2BucketLifecycle
+      include CloudflareR2BucketLock
+      include CloudflareR2BucketSippy
+      include CloudflareR2CustomDomain
+      include CloudflareR2ManagedDomain
+      include CloudflareRateLimit
+      include CloudflareRecord
+      include CloudflareRegionalHostname
+      include CloudflareRegionalTieredCache
+      include CloudflareRegistrarDomain
+      include CloudflareRuleset
+      include CloudflareSchemaValidationOperationSettings
+      include CloudflareSchemaValidationSchemas
+      include CloudflareSchemaValidationSettings
+      include CloudflareSnippet
+      include CloudflareSnippetRules
+      include CloudflareSpectrumApplication
+      include CloudflareStaticRoute
+      include CloudflareStream
+      include CloudflareStreamAudioTrack
+      include CloudflareStreamCaptionLanguage
+      include CloudflareStreamDownload
+      include CloudflareStreamKey
+      include CloudflareStreamLiveInput
+      include CloudflareStreamWatermark
+      include CloudflareStreamWebhook
+      include CloudflareTieredCache
+      include CloudflareTotalTls
+      include CloudflareTurnstileWidget
+      include CloudflareURLNormalizationSettings
+      include CloudflareUser
+      include CloudflareUserAgentBlockingRule
+      include CloudflareWaitingRoom
+      include CloudflareWaitingRoomEvent
+      include CloudflareWaitingRoomRules
+      include CloudflareWaitingRoomSettings
+      include CloudflareWeb3Hostname
+      include CloudflareWebAnalyticsRule
+      include CloudflareWebAnalyticsSite
+      include CloudflareWorker
+      include CloudflareWorkerRoute
+      include CloudflareWorkerScript
+      include CloudflareWorkerVersion
+      include CloudflareWorkersCronTrigger
+      include CloudflareWorkersCustomDomain
+      include CloudflareWorkersDeployment
+      include CloudflareWorkersForPlatformsDispatchNamespace
+      include CloudflareWorkersKv
+      include CloudflareWorkersKvNamespace
+      include CloudflareWorkersScriptSubdomain
+      include CloudflareWorkflow
+      include CloudflareZeroTrustAccessApplication
+      include CloudflareZeroTrustAccessCustomPage
+      include CloudflareZeroTrustAccessGroup
+      include CloudflareZeroTrustAccessIdentityProvider
+      include CloudflareZeroTrustAccessInfrastructureTarget
+      include CloudflareZeroTrustAccessKeyConfiguration
+      include CloudflareZeroTrustAccessMtlsCertificate
+      include CloudflareZeroTrustAccessMtlsHostnameSettings
+      include CloudflareZeroTrustAccessPolicy
+      include CloudflareZeroTrustAccessServiceToken
+      include CloudflareZeroTrustAccessShortLivedCertificate
+      include CloudflareZeroTrustAccessTag
+      include CloudflareDeviceCustomProfile
+      include CloudflareDeviceCustomProfileLocalDomainFallback
+      include CloudflareDeviceDefaultProfile
+      include CloudflareDeviceDefaultProfileCertificates
+      include CloudflareDeviceDefaultProfileLocalDomainFallback
+      include CloudflareZeroTrustDeviceManagedNetworks
+      include CloudflareZeroTrustDevicePostureIntegration
+      include CloudflareZeroTrustDevicePostureRule
+      include CloudflareZeroTrustDeviceSettings
+      include CloudflareZeroTrustDexTest
+      include CloudflareZeroTrustDlpCustomEntry
+      include CloudflareZeroTrustDlpCustomProfile
+      include CloudflareZeroTrustDlpDataset
+      include CloudflareZeroTrustDlpEntry
+      include CloudflareZeroTrustDlpIntegrationEntry
+      include CloudflareZeroTrustDlpPredefinedEntry
+      include CloudflareZeroTrustDlpPredefinedProfile
+      include CloudflareZeroTrustDnsLocation
+      include CloudflareZeroTrustGatewayCertificate
+      include CloudflareZeroTrustGatewayLogging
+      include CloudflareZeroTrustGatewayPolicy
+      include CloudflareZeroTrustGatewayProxyEndpoint
+      include CloudflareZeroTrustGatewaySettings
+      include CloudflareZeroTrustList
+      include CloudflareZeroTrustNetworkHostnameRoute
+      include CloudflareZeroTrustOrganization
+      include CloudflareZeroTrustRiskBehavior
+      include CloudflareZeroTrustRiskScoringIntegration
+      include CloudflareZeroTrustTunnelCloudflared
+      include CloudflareZeroTrustTunnelCloudflaredConfig
+      include CloudflareZeroTrustTunnelCloudflaredRoute
+      include CloudflareZeroTrustTunnelCloudflaredVirtualNetwork
+      include CloudflareZeroTrustTunnelWarpConnector
+      include CloudflareZone
+      include CloudflareZoneCacheReserve
+      include CloudflareZoneCacheVariants
+      include CloudflareZoneDnsSettings
+      include CloudflareZoneDnssec
+      include CloudflareZoneHold
+      include CloudflareZoneLockdown
+      include CloudflareZoneSettingsOverride
+      include CloudflareZoneSubscription
+    end
+  end
+end

data/lib/pangea/resources/cloudflare_access_rule/resource.rb

@@ -0,0 +1,71 @@
+# frozen_string_literal: true
+# Copyright 2025 The Pangea Authors
+
+require 'pangea/resources/base'
+require 'pangea/resources/reference'
+require 'pangea/resources/cloudflare_access_rule/types'
+require 'pangea/resource_registry'
+
+module Pangea
+  module Resources
+    # Cloudflare Access Rule resource module
+    module CloudflareAccessRule
+      # Create a Cloudflare IP Access Rule
+      #
+      # Control access based on IP, ASN, or country at zone or account level.
+      #
+      # @param name [Symbol] The resource name
+      # @param attributes [Hash] Access rule attributes
+      # @return [ResourceReference] Reference object with outputs
+      #
+      # @example Block IP at zone level
+      #   cloudflare_access_rule(:block_bad_ip, {
+      #     zone_id: "023e105f4ecef8ad9ca31a8372d0c353",
+      #     mode: "block",
+      #     target: "ip",
+      #     value: "198.51.100.4"
+      #   })
+      #
+      # @example Whitelist IP range at account level
+      #   cloudflare_access_rule(:allow_office, {
+      #     account_id: "a" * 32,
+      #     mode: "whitelist",
+      #     target: "ip_range",
+      #     value: "192.0.2.0/24",
+      #     notes: "Office IP range"
+      #   })
+      def cloudflare_access_rule(name, attributes = {})
+        rule_attrs = Cloudflare::Types::AccessRuleAttributes.new(attributes)
+
+        resource(:cloudflare_access_rule, name) do
+          zone_id rule_attrs.zone_id if rule_attrs.zone_id
+          account_id rule_attrs.account_id if rule_attrs.account_id
+          mode rule_attrs.mode
+
+          configuration do
+            target rule_attrs.target
+            value rule_attrs.value
+          end
+
+          notes rule_attrs.notes if rule_attrs.notes
+        end
+
+        ResourceReference.new(
+          type: 'cloudflare_access_rule',
+          name: name,
+          resource_attributes: rule_attrs.to_h,
+          outputs: {
+            id: "${cloudflare_access_rule.#{name}.id}",
+            rule_id: "${cloudflare_access_rule.#{name}.id}"
+          }
+        )
+      end
+    end
+
+    module Cloudflare
+      include CloudflareAccessRule
+    end
+  end
+end
+
+Pangea::ResourceRegistry.register_module(Pangea::Resources::Cloudflare)