pangea-cloudflare 0.1.0

data/lib/pangea/resources/cloudflare_cloudforce_one_request_asset/resource.rb

@@ -0,0 +1,27 @@
+# frozen_string_literal: true
+require 'pangea/resources/base'
+require 'pangea/resources/reference'
+require 'pangea/resources/cloudflare_cloudforce_one_request_asset/types'
+require 'pangea/resource_registry'
+
+module Pangea::Resources
+  module CloudflareCloudforceOneRequestAsset
+    def cloudflare_cloudforce_one_request_asset(name, attributes = {})
+      attrs = Cloudflare::Types::CloudforceOneRequestAssetAttributes.new(attributes)
+      resource(:cloudflare_cloudforce_one_request_asset, name) do
+        account_id attrs.account_id if attrs.account_id
+        zone_id attrs.zone_id if attrs.zone_id
+      end
+      ResourceReference.new(
+        type: 'cloudflare_cloudforce_one_request_asset',
+        name: name,
+        resource_attributes: attrs.to_h,
+        outputs: { id: "${cloudflare_cloudforce_one_request_asset.\#{name}.id}" }
+      )
+    end
+  end
+  module Cloudflare
+    include CloudflareCloudforceOneRequestAsset
+  end
+end
+Pangea::ResourceRegistry.register_module(Pangea::Resources::Cloudflare)

data/lib/pangea/resources/cloudflare_cloudforce_one_request_asset/types.rb

@@ -0,0 +1,11 @@
+# frozen_string_literal: true
+require 'dry-struct'
+require 'pangea/resources/types'
+
+module Pangea::Resources::Cloudflare::Types
+  class CloudforceOneRequestAssetAttributes < Dry::Struct
+    transform_keys(&:to_sym)
+    attribute :account_id, ::Pangea::Resources::Types::CloudflareAccountId.optional.default(nil)
+    attribute :zone_id, ::Pangea::Resources::Types::CloudflareZoneId.optional.default(nil)
+  end
+end

data/lib/pangea/resources/cloudflare_cloudforce_one_request_message/resource.rb

@@ -0,0 +1,27 @@
+# frozen_string_literal: true
+require 'pangea/resources/base'
+require 'pangea/resources/reference'
+require 'pangea/resources/cloudflare_cloudforce_one_request_message/types'
+require 'pangea/resource_registry'
+
+module Pangea::Resources
+  module CloudflareCloudforceOneRequestMessage
+    def cloudflare_cloudforce_one_request_message(name, attributes = {})
+      attrs = Cloudflare::Types::CloudforceOneRequestMessageAttributes.new(attributes)
+      resource(:cloudflare_cloudforce_one_request_message, name) do
+        account_id attrs.account_id if attrs.account_id
+        zone_id attrs.zone_id if attrs.zone_id
+      end
+      ResourceReference.new(
+        type: 'cloudflare_cloudforce_one_request_message',
+        name: name,
+        resource_attributes: attrs.to_h,
+        outputs: { id: "${cloudflare_cloudforce_one_request_message.\#{name}.id}" }
+      )
+    end
+  end
+  module Cloudflare
+    include CloudflareCloudforceOneRequestMessage
+  end
+end
+Pangea::ResourceRegistry.register_module(Pangea::Resources::Cloudflare)

data/lib/pangea/resources/cloudflare_cloudforce_one_request_message/types.rb

@@ -0,0 +1,11 @@
+# frozen_string_literal: true
+require 'dry-struct'
+require 'pangea/resources/types'
+
+module Pangea::Resources::Cloudflare::Types
+  class CloudforceOneRequestMessageAttributes < Dry::Struct
+    transform_keys(&:to_sym)
+    attribute :account_id, ::Pangea::Resources::Types::CloudflareAccountId.optional.default(nil)
+    attribute :zone_id, ::Pangea::Resources::Types::CloudflareZoneId.optional.default(nil)
+  end
+end

data/lib/pangea/resources/cloudflare_cloudforce_one_request_priority/resource.rb

@@ -0,0 +1,27 @@
+# frozen_string_literal: true
+require 'pangea/resources/base'
+require 'pangea/resources/reference'
+require 'pangea/resources/cloudflare_cloudforce_one_request_priority/types'
+require 'pangea/resource_registry'
+
+module Pangea::Resources
+  module CloudflareCloudforceOneRequestPriority
+    def cloudflare_cloudforce_one_request_priority(name, attributes = {})
+      attrs = Cloudflare::Types::CloudforceOneRequestPriorityAttributes.new(attributes)
+      resource(:cloudflare_cloudforce_one_request_priority, name) do
+        account_id attrs.account_id if attrs.account_id
+        zone_id attrs.zone_id if attrs.zone_id
+      end
+      ResourceReference.new(
+        type: 'cloudflare_cloudforce_one_request_priority',
+        name: name,
+        resource_attributes: attrs.to_h,
+        outputs: { id: "${cloudflare_cloudforce_one_request_priority.\#{name}.id}" }
+      )
+    end
+  end
+  module Cloudflare
+    include CloudflareCloudforceOneRequestPriority
+  end
+end
+Pangea::ResourceRegistry.register_module(Pangea::Resources::Cloudflare)

data/lib/pangea/resources/cloudflare_cloudforce_one_request_priority/types.rb

@@ -0,0 +1,11 @@
+# frozen_string_literal: true
+require 'dry-struct'
+require 'pangea/resources/types'
+
+module Pangea::Resources::Cloudflare::Types
+  class CloudforceOneRequestPriorityAttributes < Dry::Struct
+    transform_keys(&:to_sym)
+    attribute :account_id, ::Pangea::Resources::Types::CloudflareAccountId.optional.default(nil)
+    attribute :zone_id, ::Pangea::Resources::Types::CloudflareZoneId.optional.default(nil)
+  end
+end

data/lib/pangea/resources/cloudflare_content_scanning/resource.rb

@@ -0,0 +1,27 @@
+# frozen_string_literal: true
+require 'pangea/resources/base'
+require 'pangea/resources/reference'
+require 'pangea/resources/cloudflare_content_scanning/types'
+require 'pangea/resource_registry'
+
+module Pangea::Resources
+  module CloudflareContentScanning
+    def cloudflare_content_scanning(name, attributes = {})
+      attrs = Cloudflare::Types::ContentScanningAttributes.new(attributes)
+      resource(:cloudflare_content_scanning, name) do
+        account_id attrs.account_id if attrs.account_id
+        zone_id attrs.zone_id if attrs.zone_id
+      end
+      ResourceReference.new(
+        type: 'cloudflare_content_scanning',
+        name: name,
+        resource_attributes: attrs.to_h,
+        outputs: { id: "${cloudflare_content_scanning.\#{name}.id}" }
+      )
+    end
+  end
+  module Cloudflare
+    include CloudflareContentScanning
+  end
+end
+Pangea::ResourceRegistry.register_module(Pangea::Resources::Cloudflare)

data/lib/pangea/resources/cloudflare_content_scanning/types.rb

@@ -0,0 +1,11 @@
+# frozen_string_literal: true
+require 'dry-struct'
+require 'pangea/resources/types'
+
+module Pangea::Resources::Cloudflare::Types
+  class ContentScanningAttributes < Dry::Struct
+    transform_keys(&:to_sym)
+    attribute :account_id, ::Pangea::Resources::Types::CloudflareAccountId.optional.default(nil)
+    attribute :zone_id, ::Pangea::Resources::Types::CloudflareZoneId.optional.default(nil)
+  end
+end

data/lib/pangea/resources/cloudflare_content_scanning_expression/resource.rb

@@ -0,0 +1,27 @@
+# frozen_string_literal: true
+require 'pangea/resources/base'
+require 'pangea/resources/reference'
+require 'pangea/resources/cloudflare_content_scanning_expression/types'
+require 'pangea/resource_registry'
+
+module Pangea::Resources
+  module CloudflareContentScanningExpression
+    def cloudflare_content_scanning_expression(name, attributes = {})
+      attrs = Cloudflare::Types::ContentScanningExpressionAttributes.new(attributes)
+      resource(:cloudflare_content_scanning_expression, name) do
+        account_id attrs.account_id if attrs.account_id
+        zone_id attrs.zone_id if attrs.zone_id
+      end
+      ResourceReference.new(
+        type: 'cloudflare_content_scanning_expression',
+        name: name,
+        resource_attributes: attrs.to_h,
+        outputs: { id: "${cloudflare_content_scanning_expression.\#{name}.id}" }
+      )
+    end
+  end
+  module Cloudflare
+    include CloudflareContentScanningExpression
+  end
+end
+Pangea::ResourceRegistry.register_module(Pangea::Resources::Cloudflare)

data/lib/pangea/resources/cloudflare_content_scanning_expression/types.rb

@@ -0,0 +1,11 @@
+# frozen_string_literal: true
+require 'dry-struct'
+require 'pangea/resources/types'
+
+module Pangea::Resources::Cloudflare::Types
+  class ContentScanningExpressionAttributes < Dry::Struct
+    transform_keys(&:to_sym)
+    attribute :account_id, ::Pangea::Resources::Types::CloudflareAccountId.optional.default(nil)
+    attribute :zone_id, ::Pangea::Resources::Types::CloudflareZoneId.optional.default(nil)
+  end
+end

data/lib/pangea/resources/cloudflare_custom_hostname/resource.rb

@@ -0,0 +1,158 @@
+# frozen_string_literal: true
+# Copyright 2025 The Pangea Authors
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+
+require 'pangea/resources/base'
+require 'pangea/resources/reference'
+require 'pangea/resources/cloudflare_custom_hostname/types'
+require 'pangea/resource_registry'
+
+module Pangea
+  module Resources
+    # Cloudflare Custom Hostname resource module that self-registers
+    module CloudflareCustomHostname
+      # Create a Cloudflare Custom Hostname
+      #
+      # Custom hostnames allow customers to use their own domains with
+      # Cloudflare services via CNAME records (also known as SSL for SaaS).
+      #
+      # Supports automatic SSL certificate provisioning via Let's Encrypt,
+      # DigiCert, or Google Trust Services, with multiple validation methods.
+      #
+      # @param name [Symbol] The resource name
+      # @param attributes [Hash] Custom hostname attributes
+      # @option attributes [String] :zone_id Zone ID (required)
+      # @option attributes [String] :hostname Custom hostname (required, e.g., "app.customer.com")
+      # @option attributes [Hash] :ssl SSL configuration
+      # @option attributes [String] :custom_origin_server Custom origin server
+      # @option attributes [String] :custom_origin_sni Custom origin SNI
+      # @option attributes [Hash] :custom_metadata Custom metadata key-value pairs
+      # @option attributes [Boolean] :wait_for_ssl_pending_validation Wait for SSL validation
+      #
+      # @return [ResourceReference] Reference object with outputs
+      #
+      # @example Basic custom hostname with HTTP validation
+      #   cloudflare_custom_hostname(:customer_app, {
+      #     zone_id: "023e105f4ecef8ad9ca31a8372d0c353",
+      #     hostname: "app.customer.com",
+      #     ssl: {
+      #       method: "http",
+      #       type: "dv",
+      #       certificate_authority: "lets_encrypt"
+      #     }
+      #   })
+      #
+      # @example Custom hostname with custom origin
+      #   cloudflare_custom_hostname(:saas_app, {
+      #     zone_id: "023e105f4ecef8ad9ca31a8372d0c353",
+      #     hostname: "branded.customer.com",
+      #     ssl: {
+      #       method: "txt",
+      #       certificate_authority: "digicert",
+      #       bundle_method: "ubiquitous"
+      #     },
+      #     custom_origin_server: "origin.myapp.com",
+      #     custom_origin_sni: "sni.myapp.com"
+      #   })
+      #
+      # @example Wildcard custom hostname
+      #   cloudflare_custom_hostname(:wildcard, {
+      #     zone_id: "023e105f4ecef8ad9ca31a8372d0c353",
+      #     hostname: "*.customer.com",
+      #     ssl: {
+      #       method: "txt",
+      #       type: "dv_wildcard",
+      #       wildcard: true
+      #     }
+      #   })
+      def cloudflare_custom_hostname(name, attributes = {})
+        # Validate attributes using dry-struct
+        hostname_attrs = Cloudflare::Types::CustomHostnameAttributes.new(attributes)
+
+        # Generate terraform resource block via terraform-synthesizer
+        resource(:cloudflare_custom_hostname, name) do
+          zone_id hostname_attrs.zone_id
+          hostname hostname_attrs.hostname
+
+          # SSL configuration
+          if hostname_attrs.ssl
+            ssl do
+              # method is a Kernel method, must use hash access and method_missing
+              method_missing(:method, hostname_attrs.ssl[:method]) if hostname_attrs.ssl[:method]
+              type hostname_attrs.ssl.type if hostname_attrs.ssl.type
+              certificate_authority hostname_attrs.ssl.certificate_authority if hostname_attrs.ssl.certificate_authority
+              bundle_method hostname_attrs.ssl.bundle_method if hostname_attrs.ssl.bundle_method
+              wildcard hostname_attrs.ssl.wildcard if hostname_attrs.ssl.wildcard
+
+              custom_certificate hostname_attrs.ssl.custom_certificate if hostname_attrs.ssl.custom_certificate
+              custom_key hostname_attrs.ssl.custom_key if hostname_attrs.ssl.custom_key
+
+              # SSL settings
+              if hostname_attrs.ssl.settings
+                settings do
+                  min_tls_version hostname_attrs.ssl.settings.min_tls_version if hostname_attrs.ssl.settings.min_tls_version
+                  early_hints hostname_attrs.ssl.settings.early_hints if hostname_attrs.ssl.settings.early_hints
+                  http2 hostname_attrs.ssl.settings.http2 if hostname_attrs.ssl.settings.http2
+                  tls13 hostname_attrs.ssl.settings.tls13 if hostname_attrs.ssl.settings.tls13
+                  ciphers hostname_attrs.ssl.settings.ciphers if hostname_attrs.ssl.settings.ciphers
+                end
+              end
+            end
+          end
+
+          # Custom origin configuration
+          custom_origin_server hostname_attrs.custom_origin_server if hostname_attrs.custom_origin_server
+          custom_origin_sni hostname_attrs.custom_origin_sni if hostname_attrs.custom_origin_sni
+
+          # Custom metadata
+          if hostname_attrs.custom_metadata
+            custom_metadata do
+              hostname_attrs.custom_metadata.each do |key, value|
+                send(key.to_sym, value)
+              end
+            end
+          end
+
+          # Wait for SSL validation
+          wait_for_ssl_pending_validation hostname_attrs.wait_for_ssl_pending_validation if hostname_attrs.wait_for_ssl_pending_validation
+        end
+
+        # Return resource reference with available outputs
+        ResourceReference.new(
+          type: 'cloudflare_custom_hostname',
+          name: name,
+          resource_attributes: hostname_attrs.to_h,
+          outputs: {
+            id: "${cloudflare_custom_hostname.#{name}.id}",
+            status: "${cloudflare_custom_hostname.#{name}.status}",
+            ownership_verification: "${cloudflare_custom_hostname.#{name}.ownership_verification}",
+            ownership_verification_http: "${cloudflare_custom_hostname.#{name}.ownership_verification_http}",
+            ssl_status: "${cloudflare_custom_hostname.#{name}.ssl.0.status}",
+            ssl_validation_errors: "${cloudflare_custom_hostname.#{name}.ssl.0.validation_errors}",
+            ssl_validation_records: "${cloudflare_custom_hostname.#{name}.ssl.0.validation_records}"
+          }
+        )
+      end
+    end
+
+    # Maintain backward compatibility by extending Cloudflare module
+    module Cloudflare
+      include CloudflareCustomHostname
+    end
+  end
+end
+
+# Auto-register this module when it's loaded
+Pangea::ResourceRegistry.register_module(Pangea::Resources::Cloudflare)

data/lib/pangea/resources/cloudflare_custom_hostname/types/ssl_types.rb

@@ -0,0 +1,145 @@
+# frozen_string_literal: true
+# Copyright 2025 The Pangea Authors
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+require 'dry-struct'
+
+module Pangea
+  module Resources
+    module Cloudflare
+      module Types
+        # SSL validation method for custom hostnames
+        CloudflareCustomHostnameSSLMethod = Dry::Types['strict.string'].enum(
+          'http',      # HTTP token validation
+          'txt',       # DNS TXT record validation
+          'email'      # Email validation
+        )
+
+        # SSL certificate type
+        CloudflareCustomHostnameSSLType = Dry::Types['strict.string'].enum(
+          'dv',        # Domain Validation (default)
+          'dv_wildcard'  # Domain Validation with wildcard support
+        )
+
+        # Certificate authority
+        CloudflareCustomHostnameSSLCA = Dry::Types['strict.string'].enum(
+          'digicert',   # DigiCert
+          'lets_encrypt', # Let's Encrypt
+          'google'      # Google Trust Services
+        )
+
+        # Bundle method for certificate chain
+        CloudflareCustomHostnameSSLBundleMethod = Dry::Types['strict.string'].enum(
+          'ubiquitous', # Most compatible (default)
+          'optimal',    # Balanced
+          'force'       # Smallest bundle
+        )
+
+        # Minimum TLS version
+        CloudflareMinTLSVersion = Dry::Types['strict.string'].enum(
+          '1.0',
+          '1.1',
+          '1.2',
+          '1.3'
+        )
+
+        # SSL settings for custom hostname
+        class CustomHostnameSSLSettings < Dry::Struct
+          transform_keys(&:to_sym)
+
+          # @!attribute min_tls_version
+          #   @return [String, nil] Minimum TLS version
+          attribute :min_tls_version, CloudflareMinTLSVersion.optional.default(nil)
+
+          # @!attribute early_hints
+          #   @return [String, nil] Early Hints support ('on' or 'off')
+          attribute :early_hints, Dry::Types['strict.string']
+            .enum('on', 'off')
+            .optional
+            .default(nil)
+
+          # @!attribute http2
+          #   @return [String, nil] HTTP/2 support ('on' or 'off')
+          attribute :http2, Dry::Types['strict.string']
+            .enum('on', 'off')
+            .optional
+            .default(nil)
+
+          # @!attribute tls13
+          #   @return [String, nil] TLS 1.3 support ('on' or 'off')
+          attribute :tls13, Dry::Types['strict.string']
+            .enum('on', 'off')
+            .optional
+            .default(nil)
+
+          # @!attribute ciphers
+          #   @return [Array<String>, nil] List of allowed cipher suites
+          attribute :ciphers, Dry::Types['strict.array']
+            .of(Dry::Types['strict.string'])
+            .optional
+            .default(nil)
+        end
+
+        # SSL configuration for custom hostname
+        class CustomHostnameSSL < Dry::Struct
+          transform_keys(&:to_sym)
+
+          # @!attribute method
+          #   @return [String, nil] Validation method
+          attribute :method, CloudflareCustomHostnameSSLMethod.optional.default(nil)
+
+          # @!attribute type
+          #   @return [String, nil] Certificate type (defaults to 'dv')
+          attribute :type, CloudflareCustomHostnameSSLType.optional.default(nil)
+
+          # @!attribute certificate_authority
+          #   @return [String, nil] Certificate authority
+          attribute :certificate_authority, CloudflareCustomHostnameSSLCA.optional.default(nil)
+
+          # @!attribute bundle_method
+          #   @return [String, nil] Certificate bundle method
+          attribute :bundle_method, CloudflareCustomHostnameSSLBundleMethod.optional.default(nil)
+
+          # @!attribute wildcard
+          #   @return [Boolean, nil] Enable wildcard certificate
+          attribute :wildcard, Dry::Types['strict.bool'].optional.default(nil)
+
+          # @!attribute custom_certificate
+          #   @return [String, nil] Custom certificate PEM
+          attribute :custom_certificate, Dry::Types['strict.string'].optional.default(nil)
+
+          # @!attribute custom_key
+          #   @return [String, nil] Custom private key PEM
+          attribute :custom_key, Dry::Types['strict.string'].optional.default(nil)
+
+          # @!attribute settings
+          #   @return [CustomHostnameSSLSettings, nil] SSL settings
+          attribute :settings, CustomHostnameSSLSettings.optional.default(nil)
+
+          # Check if using custom certificate
+          # @return [Boolean] true if custom certificate provided
+          def custom_certificate?
+            !custom_certificate.nil? && !custom_key.nil?
+          end
+
+          # Check if wildcard enabled
+          # @return [Boolean] true if wildcard certificate requested
+          def wildcard?
+            wildcard == true
+          end
+        end
+      end
+    end
+  end
+end

data/lib/pangea/resources/cloudflare_custom_hostname/types.rb

@@ -0,0 +1,107 @@
+# frozen_string_literal: true
+# Copyright 2025 The Pangea Authors
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+require 'dry-struct'
+require 'pangea/resources/types'
+require_relative 'types/ssl_types'
+
+module Pangea
+  module Resources
+    module Cloudflare
+      module Types
+        # Type-safe attributes for Cloudflare Custom Hostname
+        #
+        # Custom hostnames allow customers to use their own domains
+        # with Cloudflare services via CNAME records.
+        #
+        # @example Basic custom hostname
+        #   CustomHostnameAttributes.new(
+        #     zone_id: "023e105f4ecef8ad9ca31a8372d0c353",
+        #     hostname: "app.customer.com",
+        #     ssl: { method: "http", type: "dv" }
+        #   )
+        #
+        # @example Custom hostname with custom origin
+        #   CustomHostnameAttributes.new(
+        #     zone_id: "023e105f4ecef8ad9ca31a8372d0c353",
+        #     hostname: "app.customer.com",
+        #     ssl: { method: "txt", certificate_authority: "lets_encrypt" },
+        #     custom_origin_server: "origin.customer.com",
+        #     custom_origin_sni: "sni.customer.com"
+        #   )
+        class CustomHostnameAttributes < Dry::Struct
+          transform_keys(&:to_sym)
+
+          # @!attribute zone_id
+          #   @return [String] The zone ID
+          attribute :zone_id, ::Pangea::Resources::Types::CloudflareZoneId
+
+          # @!attribute hostname
+          #   @return [String] The custom hostname (e.g., "app.customer.com")
+          attribute :hostname, Dry::Types['strict.string'].constrained(
+            format: /\A(\*\.)?[a-z0-9]([a-z0-9-]*[a-z0-9])?(\.[a-z0-9]([a-z0-9-]*[a-z0-9])?)*\z/i
+          )
+
+          # @!attribute ssl
+          #   @return [CustomHostnameSSL, nil] SSL configuration
+          attribute :ssl, CustomHostnameSSL.optional.default(nil)
+
+          # @!attribute custom_origin_server
+          #   @return [String, nil] Custom origin server hostname
+          attribute :custom_origin_server, Dry::Types['strict.string'].optional.default(nil)
+
+          # @!attribute custom_origin_sni
+          #   @return [String, nil] Custom origin SNI hostname
+          attribute :custom_origin_sni, Dry::Types['strict.string'].optional.default(nil)
+
+          # @!attribute custom_metadata
+          #   @return [Hash, nil] Custom metadata (string keys and values)
+          attribute :custom_metadata, Dry::Types['strict.hash']
+            .map(Dry::Types['strict.string'], Dry::Types['strict.string'])
+            .optional
+            .default(nil)
+
+          # @!attribute wait_for_ssl_pending_validation
+          #   @return [Boolean, nil] Wait for SSL validation before returning
+          attribute :wait_for_ssl_pending_validation, Dry::Types['strict.bool'].optional.default(nil)
+
+          # Check if SSL is configured
+          # @return [Boolean] true if SSL configuration provided
+          def ssl_configured?
+            !ssl.nil?
+          end
+
+          # Check if custom origin is configured
+          # @return [Boolean] true if custom origin server provided
+          def custom_origin?
+            !custom_origin_server.nil?
+          end
+
+          # Check if custom metadata is provided
+          # @return [Boolean] true if custom metadata exists
+          def has_custom_metadata?
+            !custom_metadata.nil? && !custom_metadata.empty?
+          end
+
+          # Check if wildcard hostname
+          # @return [Boolean] true if hostname starts with wildcard
+          def wildcard?
+            hostname.start_with?('*.')
+          end
+        end
+      end
+    end
+  end
+end

data/lib/pangea/resources/cloudflare_custom_hostname_fallback_origin/resource.rb

@@ -0,0 +1,27 @@
+# frozen_string_literal: true
+require 'pangea/resources/base'
+require 'pangea/resources/reference'
+require 'pangea/resources/cloudflare_custom_hostname_fallback_origin/types'
+require 'pangea/resource_registry'
+
+module Pangea::Resources
+  module CloudflareCustomHostnameFallbackOrigin
+    def cloudflare_custom_hostname_fallback_origin(name, attributes = {})
+      attrs = Cloudflare::Types::CustomHostnameFallbackOriginAttributes.new(attributes)
+      resource(:cloudflare_custom_hostname_fallback_origin, name) do
+        zone_id attrs.zone_id if attrs.zone_id
+        account_id attrs.account_id if attrs.account_id
+      end
+      ResourceReference.new(
+        type: 'cloudflare_custom_hostname_fallback_origin',
+        name: name,
+        resource_attributes: attrs.to_h,
+        outputs: { id: "${cloudflare_custom_hostname_fallback_origin.\#{name}.id}" }
+      )
+    end
+  end
+  module Cloudflare
+    include CloudflareCustomHostnameFallbackOrigin
+  end
+end
+Pangea::ResourceRegistry.register_module(Pangea::Resources::Cloudflare)

data/lib/pangea/resources/cloudflare_custom_hostname_fallback_origin/types.rb

@@ -0,0 +1,11 @@
+# frozen_string_literal: true
+require 'dry-struct'
+require 'pangea/resources/types'
+
+module Pangea::Resources::Cloudflare::Types
+  class CustomHostnameFallbackOriginAttributes < Dry::Struct
+    transform_keys(&:to_sym)
+    attribute :zone_id, ::Pangea::Resources::Types::CloudflareZoneId.optional.default(nil)
+    attribute :account_id, ::Pangea::Resources::Types::CloudflareAccountId.optional.default(nil)
+  end
+end