@gfargo/doorman 3.10.0 → 3.10.2
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
package/package.json
CHANGED
|
@@ -203,21 +203,21 @@ doorman sync --provider cloudflare --config .doorman.json
|
|
|
203
203
|
```bash
|
|
204
204
|
# Migrate rules between providers
|
|
205
205
|
doorman download --provider vercel --config .doorman.json
|
|
206
|
-
doorman validate --
|
|
206
|
+
doorman validate --config .doorman.json
|
|
207
207
|
doorman sync --provider cloudflare --config .doorman.json
|
|
208
208
|
```
|
|
209
209
|
|
|
210
210
|
## Command Flags Reference
|
|
211
211
|
|
|
212
|
-
|
|
212
|
+
Common flags (availability varies by command):
|
|
213
213
|
|
|
214
|
-
| Flag | Description
|
|
215
|
-
| ------------------------------------------------- |
|
|
216
|
-
| `--config <path>` | Path to config file (default: auto-discovered `.doorman.json`)
|
|
217
|
-
| `--provider vercel\|cloudflare\|fastly` | Override provider detection
|
|
218
|
-
| `--format json\|table\|yaml\|markdown\|terraform` | Output format (command-dependent)
|
|
219
|
-
| `--verbose` | Show detailed output
|
|
220
|
-
| `--output <path>` | Write output to file instead of stdout
|
|
214
|
+
| Flag | Description |
|
|
215
|
+
| ------------------------------------------------- | ----------------------------------------------------------------------------------------------------- |
|
|
216
|
+
| `--config <path>` | Path to config file (default: auto-discovered `.doorman.json`) |
|
|
217
|
+
| `--provider vercel\|cloudflare\|fastly` | Override provider detection — `sync`/`diff`/`download`/`list`/`status`/`watch`/`backup`/`export` only |
|
|
218
|
+
| `--format json\|table\|yaml\|markdown\|terraform` | Output format (command-dependent) |
|
|
219
|
+
| `--verbose` | Show detailed output |
|
|
220
|
+
| `--output <path>` | Write output to file instead of stdout |
|
|
221
221
|
|
|
222
222
|
## Error Handling in Automation
|
|
223
223
|
|
|
@@ -15,6 +15,7 @@ CLOUDFLARE_ACCOUNT_ID=acc_xxx # Optional — enables Lists API for bulk IP
|
|
|
15
15
|
### API Token Permissions
|
|
16
16
|
|
|
17
17
|
Create a Custom Token at https://dash.cloudflare.com/profile/api-tokens with:
|
|
18
|
+
|
|
18
19
|
- **Zone > Firewall Services > Edit** — for custom rulesets
|
|
19
20
|
- **Account > Account Filter Lists > Edit** — for Lists API (bulk IP management, requires `CLOUDFLARE_ACCOUNT_ID`)
|
|
20
21
|
|
|
@@ -37,13 +38,14 @@ Multi-provider config with explicit provider declaration:
|
|
|
37
38
|
}
|
|
38
39
|
```
|
|
39
40
|
|
|
40
|
-
Or pass `--provider cloudflare` to any command to override
|
|
41
|
+
Or pass `--provider cloudflare` to any provider-aware command (`sync`, `diff`, `download`, `list`, `status`, `watch`, `backup`, `export`) to override auto-detection.
|
|
41
42
|
|
|
42
43
|
## Usage
|
|
43
44
|
|
|
45
|
+
`doorman init` only supports Vercel today — it has no `--provider` flag and doesn't prompt for Cloudflare credentials. Create `.doorman.json` by hand using the config shape above, then:
|
|
46
|
+
|
|
44
47
|
```bash
|
|
45
|
-
doorman
|
|
46
|
-
doorman validate --provider cloudflare # Validate against Cloudflare constraints
|
|
48
|
+
doorman validate # Validate — auto-detects Cloudflare from the config's `provider` field
|
|
47
49
|
doorman sync --provider cloudflare # Deploy to Cloudflare
|
|
48
50
|
doorman download --provider cloudflare # Pull rules from Cloudflare
|
|
49
51
|
doorman diff --provider cloudflare # Compare local vs live
|
|
@@ -56,33 +58,33 @@ Doorman translates its unified rule format into Cloudflare Wirefilter expression
|
|
|
56
58
|
|
|
57
59
|
### Field Mapping
|
|
58
60
|
|
|
59
|
-
| Doorman Type
|
|
60
|
-
|
|
61
|
-
| `path`
|
|
62
|
-
| `method`
|
|
63
|
-
| `host`
|
|
64
|
-
| `user_agent`
|
|
65
|
-
| `ip_address`
|
|
66
|
-
| `header`
|
|
67
|
-
| `query`
|
|
68
|
-
| `cookie`
|
|
69
|
-
| `geo_country`
|
|
70
|
-
| `geo_city`
|
|
71
|
-
| `geo_continent`
|
|
72
|
-
| `geo_country_region` | `ip.geoip.subdivision_1`
|
|
73
|
-
| `geo_as_number`
|
|
74
|
-
| `scheme`
|
|
61
|
+
| Doorman Type | Cloudflare Field |
|
|
62
|
+
| -------------------- | ----------------------------- |
|
|
63
|
+
| `path` | `http.request.uri.path` |
|
|
64
|
+
| `method` | `http.request.method` |
|
|
65
|
+
| `host` | `http.host` |
|
|
66
|
+
| `user_agent` | `http.user_agent` |
|
|
67
|
+
| `ip_address` | `ip.src` |
|
|
68
|
+
| `header` | `http.request.headers["key"]` |
|
|
69
|
+
| `query` | `http.request.uri.query` |
|
|
70
|
+
| `cookie` | `http.cookie` |
|
|
71
|
+
| `geo_country` | `ip.geoip.country` |
|
|
72
|
+
| `geo_city` | `ip.geoip.city` |
|
|
73
|
+
| `geo_continent` | `ip.geoip.continent` |
|
|
74
|
+
| `geo_country_region` | `ip.geoip.subdivision_1` |
|
|
75
|
+
| `geo_as_number` | `ip.geoip.asnum` |
|
|
76
|
+
| `scheme` | `ssl` (boolean) |
|
|
75
77
|
|
|
76
78
|
### Action Mapping
|
|
77
79
|
|
|
78
|
-
| Doorman Action | Cloudflare Action
|
|
79
|
-
|
|
80
|
-
| `deny`
|
|
81
|
-
| `challenge`
|
|
82
|
-
| `rate_limit`
|
|
83
|
-
| `redirect`
|
|
84
|
-
| `log`
|
|
85
|
-
| `bypass`
|
|
80
|
+
| Doorman Action | Cloudflare Action |
|
|
81
|
+
| -------------- | -------------------------------- |
|
|
82
|
+
| `deny` | `block` |
|
|
83
|
+
| `challenge` | `managed_challenge` |
|
|
84
|
+
| `rate_limit` | `block` + `ratelimit` config |
|
|
85
|
+
| `redirect` | `redirect` + `from_value` params |
|
|
86
|
+
| `log` | `log` |
|
|
87
|
+
| `bypass` | `skip` |
|
|
86
88
|
|
|
87
89
|
## Lists API (Bulk IP Management)
|
|
88
90
|
|
|
@@ -97,16 +99,16 @@ Without `CLOUDFLARE_ACCOUNT_ID`, IP blocking falls back to individual WAF rules
|
|
|
97
99
|
|
|
98
100
|
## Limitations & Differences
|
|
99
101
|
|
|
100
|
-
| Feature
|
|
101
|
-
|
|
102
|
-
| `re` operator
|
|
103
|
-
| `environment` type
|
|
104
|
-
| `ja3_digest`/`ja4_digest` | Yes
|
|
105
|
-
| `region` type
|
|
106
|
-
| IP Lists (bulk)
|
|
107
|
-
| Max custom rules
|
|
108
|
-
| Rate limit
|
|
109
|
-
| Rule order
|
|
102
|
+
| Feature | Vercel | Cloudflare | Notes |
|
|
103
|
+
| ------------------------- | ------------------- | ----------------------------- | ------------------------------------------------- |
|
|
104
|
+
| `re` operator | All plans | Enterprise only | Use `sub`/`pre`/`suf` as alternatives |
|
|
105
|
+
| `environment` type | Yes | No | Vercel-specific concept |
|
|
106
|
+
| `ja3_digest`/`ja4_digest` | Yes | No | Vercel TLS fingerprints |
|
|
107
|
+
| `region` type | Yes | No | Vercel edge region |
|
|
108
|
+
| IP Lists (bulk) | Individual rules | Lists API | Cloudflare needs `accountId` |
|
|
109
|
+
| Max custom rules | ~100 | 5-125 (plan dependent) | Free: 5, Pro: 20, Business: 100, Enterprise: 125+ |
|
|
110
|
+
| Rate limit | Via rule action | Separate phase | Different underlying mechanism |
|
|
111
|
+
| Rule order | Parallel evaluation | Sequential (first match wins) | Ordering matters on Cloudflare |
|
|
110
112
|
|
|
111
113
|
## Translation Warnings
|
|
112
114
|
|
|
@@ -117,7 +119,7 @@ The `RuleTranslator` surfaces warnings when a translation is lossy:
|
|
|
117
119
|
- **Duration differences** — `actionDuration` maps differently between providers
|
|
118
120
|
- **Negation edge cases** — complex negated conditions may produce subtly different behavior in Wirefilter
|
|
119
121
|
|
|
120
|
-
Run `doorman validate
|
|
122
|
+
Run `doorman validate` to surface warnings before deploying — it auto-detects Cloudflare from the config's `provider` field.
|
|
121
123
|
|
|
122
124
|
## Cloudflare-Specific Validation
|
|
123
125
|
|
|
@@ -166,9 +168,7 @@ The `CloudflareOptimizer` consolidates rules for efficient deployment:
|
|
|
166
168
|
"name": "Rate Limit API",
|
|
167
169
|
"description": "Limit API requests to 100/min per IP",
|
|
168
170
|
"active": true,
|
|
169
|
-
"conditionGroup": [
|
|
170
|
-
{ "conditions": [{ "type": "path", "op": "pre", "value": "/api/" }] }
|
|
171
|
-
],
|
|
171
|
+
"conditionGroup": [{ "conditions": [{ "type": "path", "op": "pre", "value": "/api/" }] }],
|
|
172
172
|
"action": {
|
|
173
173
|
"mitigate": {
|
|
174
174
|
"action": "rate_limit",
|
|
@@ -181,8 +181,6 @@ The `CloudflareOptimizer` consolidates rules for efficient deployment:
|
|
|
181
181
|
}
|
|
182
182
|
}
|
|
183
183
|
],
|
|
184
|
-
"ips": [
|
|
185
|
-
{ "ip": "203.0.113.0/24", "action": "deny", "notes": "Known attack subnet" }
|
|
186
|
-
]
|
|
184
|
+
"ips": [{ "ip": "203.0.113.0/24", "action": "deny", "notes": "Known attack subnet" }]
|
|
187
185
|
}
|
|
188
186
|
```
|
|
@@ -33,13 +33,14 @@ Multi-provider config with explicit provider declaration:
|
|
|
33
33
|
}
|
|
34
34
|
```
|
|
35
35
|
|
|
36
|
-
Or pass `--provider fastly` to any command to override
|
|
36
|
+
Or pass `--provider fastly` to any provider-aware command (`sync`, `diff`, `download`, `list`, `status`, `watch`, `backup`, `export`) to override auto-detection.
|
|
37
37
|
|
|
38
38
|
## Usage
|
|
39
39
|
|
|
40
|
+
`doorman init` only supports Vercel today — it has no `--provider` flag and doesn't prompt for Fastly credentials. Create `.doorman.json` by hand using the config shape above, then:
|
|
41
|
+
|
|
40
42
|
```bash
|
|
41
|
-
doorman
|
|
42
|
-
doorman validate --provider fastly # Validate against Fastly constraints
|
|
43
|
+
doorman validate # Validate — auto-detects Fastly from the config's `provider` field
|
|
43
44
|
doorman sync --provider fastly # Deploy to Fastly
|
|
44
45
|
doorman download --provider fastly # Pull rules from Fastly
|
|
45
46
|
doorman diff --provider fastly # Compare local vs live
|