Cloudflare

export CF_API_TOKEN="<api-token>"

# Create zone
curl -s -X POST "https://api.cloudflare.com/client/v4/zones" \
  -H "Authorization: Bearer $CF_API_TOKEN" \
  -H "Content-Type: application/json" \
  --data '{"name":"example.com","account":{"id":"<account-id>"},"type":"full"}' | jq

# List zones to get zone_id and nameservers
curl -s -X GET "https://api.cloudflare.com/client/v4/zones?name=example.com" \
  -H "Authorization: Bearer $CF_API_TOKEN" | jq '.result[] | {id, name, name_servers}'

ZONE_ID="<zone-id>"

# A record for app.example.com proxied through Cloudflare
curl -s -X POST "https://api.cloudflare.com/client/v4/zones/$ZONE_ID/dns_records" \
  -H "Authorization: Bearer $CF_API_TOKEN" \
  -H "Content-Type: application/json" \
  --data '{
    "type":"A",
    "name":"app",
    "content":"203.0.113.10",
    "ttl":1,
    "proxied":true
  }' | jq

# CNAME for www -> app
curl -s -X POST "https://api.cloudflare.com/client/v4/zones/$ZONE_ID/dns_records" \
  -H "Authorization: Bearer $CF_API_TOKEN" \
  -H "Content-Type: application/json" \
  --data '{
    "type":"CNAME",
    "name":"www",
    "content":"app.example.com",
    "ttl":1,
    "proxied":true
  }' | jq

{
  "description": "Cache static assets for 30 days",
  "expression": "(http.request.uri.path matches \"^/assets/.*\\.(js|css|png|jpg|svg|woff2)$\")",
  "action": "set_cache_settings",
  "action_parameters": {
    "cache": true,
    "edge_ttl": {
      "mode": "override_origin",
      "default": 2592000
    },
    "browser_ttl": {
      "mode": "override_origin",
      "default": 604800
    }
  }
}

ZONE_ID="<zone-id>"

# Purge only pages tagged during origin response (Cache-Tag header)
curl -s -X POST "https://api.cloudflare.com/client/v4/zones/$ZONE_ID/purge_cache" \
  -H "Authorization: Bearer $CF_API_TOKEN" \
  -H "Content-Type: application/json" \
  --data '{"tags":["post:123","category:news"]}' | jq

{
  "description": "Block exploit scanning paths",
  "expression": "(http.request.uri.path contains \"/.env\" or http.request.uri.path contains \"/wp-admin\")",
  "action": "block"
}

{
  "description": "Rate limit login",
  "expression": "(http.request.uri.path eq \"/login\" and http.request.method eq \"POST\")",
  "action": "block",
  "ratelimit": {
    "characteristics": ["ip.src"],
    "period": 60,
    "requests_per_period": 10,
    "mitigation_timeout": 600
  }
}

export default {
  async fetch(request, env, ctx) {
    const url = new URL(request.url)

    if (url.pathname === "/health") {
      return new Response(JSON.stringify({ ok: true }), {
        headers: { "content-type": "application/json" }
      })
    }

    return new Response("Hello from Cloudflare Workers", { status: 200 })
  }
}

// wrangler.toml
// name = "edge-app"
// main = "src/index.js"
// compatibility_date = "2026-01-01"
// routes = [{ pattern = "app.example.com/*", zone_name = "example.com" }]

export default {
  async fetch(request, env) {
    const flag = await env.FLAGS.get("new_checkout")
    const enabled = flag === "true"

    return new Response(JSON.stringify({ newCheckout: enabled }), {
      headers: { "content-type": "application/json" }
    })
  }
}

// wrangler.toml binding example:
// [[kv_namespaces]]
// binding = "FLAGS"
// id = "<kv-namespace-id>"

# Install cloudflared and authenticate
cloudflared tunnel login

# Create tunnel
cloudflared tunnel create internal-app

# Route DNS to tunnel
cloudflared tunnel route dns internal-app internal.example.com

# config.yml
# tunnel: <tunnel-uuid>
# credentials-file: /root/.cloudflared/<tunnel-uuid>.json
# ingress:
#   - hostname: internal.example.com
#     service: http://localhost:8080
#   - service: http_status:404

# Run tunnel
cloudflared tunnel run internal-app

application:
  name: "Admin Portal"
  domain: "internal.example.com"
  session_duration: "24h"
policies:
  - name: "Allow engineering via Okta"
    decision: "allow"
    include:
      - email_domain:
          domain: "company.com"
    require:
      - okta:
          identity_provider_id: "<idp-id>"
  - name: "Deny everyone else"
    decision: "deny"