Cloudflare/firewall

@swamp/cloudflare/firewallv2026.10.23.1· AGPL-3.0-or-later· 3d agoBEHAVIORS

01README

Cloudflare firewall infrastructure models

02Release Notes

Updated: rules
Updated: lockdowns
Updated: ua_rules
Updated: overrides
Updated: rate_limits

03Behaviors5

@swamp/cloudflare/firewall/lockdownsv2026.10.23.1lockdowns.ts

Global Arguments

Argument	Type	Required	Description
zone_id	string	yes	Cloudflare zone ID
configurations?	array	no	A list of IP addresses or CIDR ranges that will be allowed to access the URLs specified in the Zone Lockdown rule. You can include any number of `ip` or `ip_range` configurations.
urls?	array	no	The URLs to include in the current WAF override. You can use wildcards. Each entered URL will be escaped before use, which means you can only use simple wildcard patterns.
description?	string	no	An informative summary of the rule. This value is sanitized and any tags will be removed.
paused?	boolean	no	When true, indicates that the rule is currently paused.
priority?	number	no	The priority of the rule to control the processing order. A lower number indicates higher priority. If not provided, any rules with a configured priority will be processed before rules without a priority.
apiToken?	string	no	Cloudflare API token; overrides the CLOUDFLARE_API_TOKEN environment variable. Wire with a vault.get(...) expression to source it from a vault.
apiKey?	string	no	Cloudflare API key for the legacy key+email auth path; overrides the CLOUDFLARE_API_KEY environment variable. Wire with a vault.get(...) expression. Requires email.
email?	string	no	Cloudflare account email for the legacy key+email auth path; overrides the CLOUDFLARE_EMAIL environment variable. Requires apiKey.

fn create()

Create a Lockdowns

fn get(id: string)

Get a Lockdowns

Argument	Type	Required	Description
id	string	yes	The ID of the Lockdowns

fn lookup(allowMissing?: boolean)

Look up an existing Lockdowns by matching global argument values and import it into state

Argument	Type	Required	Description
allowMissing?	boolean	no	Succeed and record found: false in lookupResult when nothing matches, instead of failing

fn adopt(id: string)

Import an existing Lockdowns by ID into state for management

Argument	Type	Required	Description
id	string	yes	The ID of the Lockdowns to import

fn update(identifier?: string)

Update Lockdowns attributes

Argument	Type	Required	Description
identifier?	string	no	Target a specific Lockdowns by id (e.g. one discovered by list)

fn delete(id: string)

Delete the Lockdowns

Argument	Type	Required	Description
id	string	yes	The ID of the Lockdowns

fn sync(identifier?: string)

Sync Lockdowns state from Cloudflare

Argument	Type	Required	Description
identifier?	string	no	Target a specific Lockdowns by id (e.g. one discovered by list)

Resources

state(infinite)— Lockdowns resource state

lookupResult(infinite)— Outcome of the most recent lookup

@swamp/cloudflare/firewall/overridesv2026.10.23.1overrides.ts

Global Arguments

Argument	Type	Required	Description
zone_id	string	yes	Cloudflare zone ID
name	string	yes	Instance name for this resource (used as the unique identifier in the factory pattern)
id?	string	no	Defines an identifier.
rewrite_action?	object	no	Specifies that, when a WAF rule matches, its configured action will be replaced by the action configured in this object.
rules?	record	no	An object that allows you to override the action of specific WAF rules. Each key of this object must be the ID of a WAF rule, and each value must be a valid WAF action. Unless you are disabling a rule, ensure that you also enable the rule group that this WAF rule belongs to. When creating a new URI-based WAF override, you must provide a `groups` object or a `rules` object.
urls?	array	no	The URLs to include in the current WAF override. You can use wildcards. Each entered URL will be escaped before use, which means you can only use simple wildcard patterns.
apiToken?	string	no	Cloudflare API token; overrides the CLOUDFLARE_API_TOKEN environment variable. Wire with a vault.get(...) expression to source it from a vault.
apiKey?	string	no	Cloudflare API key for the legacy key+email auth path; overrides the CLOUDFLARE_API_KEY environment variable. Wire with a vault.get(...) expression. Requires email.
email?	string	no	Cloudflare account email for the legacy key+email auth path; overrides the CLOUDFLARE_EMAIL environment variable. Requires apiKey.

fn create()

Create a Overrides

fn get(id: string)

Get a Overrides

Argument	Type	Required	Description
id	string	yes	The ID of the Overrides

fn lookup(allowMissing?: boolean)

Look up an existing Overrides by matching global argument values and import it into state

Argument	Type	Required	Description
allowMissing?	boolean	no	Succeed and record found: false in lookupResult when nothing matches, instead of failing

fn adopt(id: string)

Import an existing Overrides by ID into state for management

Argument	Type	Required	Description
id	string	yes	The ID of the Overrides to import

fn update(identifier?: string)

Update Overrides attributes

Argument	Type	Required	Description
identifier?	string	no	Target a specific Overrides by id (e.g. one discovered by list)

fn delete(id: string)

Delete the Overrides

Argument	Type	Required	Description
id	string	yes	The ID of the Overrides

fn sync(identifier?: string)

Sync Overrides state from Cloudflare

Argument	Type	Required	Description
identifier?	string	no	Target a specific Overrides by id (e.g. one discovered by list)

Resources

state(infinite)— Overrides resource state

lookupResult(infinite)— Outcome of the most recent lookup

@swamp/cloudflare/firewall/rate-limitsv2026.10.23.1rate_limits.ts

Global Arguments

Argument	Type	Required	Description
zone_id	string	yes	Cloudflare zone ID
name	string	yes	Instance name for this resource (used as the unique identifier in the factory pattern)
action?	object	no
match?	object	no
period?	number	no	The time in seconds (an integer value) to count matching traffic. If the count exceeds the configured threshold within this period, Cloudflare will perform the configured action.
threshold?	number	no	The threshold that will trigger the configured mitigation action. Configure this value along with the `period` property to establish a threshold per period.
apiToken?	string	no	Cloudflare API token; overrides the CLOUDFLARE_API_TOKEN environment variable. Wire with a vault.get(...) expression to source it from a vault.
apiKey?	string	no	Cloudflare API key for the legacy key+email auth path; overrides the CLOUDFLARE_API_KEY environment variable. Wire with a vault.get(...) expression. Requires email.
email?	string	no	Cloudflare account email for the legacy key+email auth path; overrides the CLOUDFLARE_EMAIL environment variable. Requires apiKey.

fn create()

Create a Rate Limits

fn get(id: string)

Get a Rate Limits

Argument	Type	Required	Description
id	string	yes	The ID of the Rate Limits

fn lookup(allowMissing?: boolean)

Look up an existing Rate Limits by matching global argument values and import it into state

Argument	Type	Required	Description
allowMissing?	boolean	no	Succeed and record found: false in lookupResult when nothing matches, instead of failing

fn adopt(id: string)

Import an existing Rate Limits by ID into state for management

Argument	Type	Required	Description
id	string	yes	The ID of the Rate Limits to import

fn update(identifier?: string)

Update Rate Limits attributes

Argument	Type	Required	Description
identifier?	string	no	Target a specific Rate Limits by id (e.g. one discovered by list)

fn delete(id: string)

Delete the Rate Limits

Argument	Type	Required	Description
id	string	yes	The ID of the Rate Limits

fn sync(identifier?: string)

Sync Rate Limits state from Cloudflare

Argument	Type	Required	Description
identifier?	string	no	Target a specific Rate Limits by id (e.g. one discovered by list)

Resources

state(infinite)— Rate Limits resource state

lookupResult(infinite)— Outcome of the most recent lookup

@swamp/cloudflare/firewall/rulesv2026.10.23.1rules.ts

Global Arguments

Argument	Type	Required	Description
account_id?	string	no	Cloudflare account ID (provide account_id or zone_id)
zone_id?	string	no	Cloudflare zone ID (provide account_id or zone_id)
name	string	yes	Instance name for this resource (used as the unique identifier in the factory pattern)
allowed_modes?	array	no	The available actions that a rule can apply to a matched request.
configuration?	object	no
created_on?	string	no	The timestamp of when the rule was created.
id?	string	no	The unique identifier of the IP Access rule.
mode?	string	no	The action to apply to a matched request.
modified_on?	string	no	The timestamp of when the rule was last modified.
notes?	string	no	An informative summary of the rule, typically used as a reminder or explanation.
scope?	object	no	All zones owned by the user will have the rule applied.
apiToken?	string	no	Cloudflare API token; overrides the CLOUDFLARE_API_TOKEN environment variable. Wire with a vault.get(...) expression to source it from a vault.
apiKey?	string	no	Cloudflare API key for the legacy key+email auth path; overrides the CLOUDFLARE_API_KEY environment variable. Wire with a vault.get(...) expression. Requires email.
email?	string	no	Cloudflare account email for the legacy key+email auth path; overrides the CLOUDFLARE_EMAIL environment variable. Requires apiKey.

fn create()

Create a Rules

fn get(id: string)

Get a Rules

Argument	Type	Required	Description
id	string	yes	The ID of the Rules

fn lookup(allowMissing?: boolean)

Look up an existing Rules by matching global argument values and import it into state

Argument	Type	Required	Description
allowMissing?	boolean	no	Succeed and record found: false in lookupResult when nothing matches, instead of failing

fn adopt(id: string)

Import an existing Rules by ID into state for management

Argument	Type	Required	Description
id	string	yes	The ID of the Rules to import

fn update(identifier?: string)

Update Rules attributes

Argument	Type	Required	Description
identifier?	string	no	Target a specific Rules by id (e.g. one discovered by list)

fn delete(id: string)

Delete the Rules

Argument	Type	Required	Description
id	string	yes	The ID of the Rules

fn sync(identifier?: string)

Sync Rules state from Cloudflare

Argument	Type	Required	Description
identifier?	string	no	Target a specific Rules by id (e.g. one discovered by list)

Resources

state(infinite)— Rules resource state

lookupResult(infinite)— Outcome of the most recent lookup

@swamp/cloudflare/firewall/ua-rulesv2026.10.23.1ua_rules.ts

Global Arguments

Argument	Type	Required	Description
zone_id	string	yes	Cloudflare zone ID
configuration?	object	no
description?	string	no	An informative summary of the rule. This value is sanitized and any tags will be removed.
id?	string	no	The unique identifier of the resource.
mode?	string	no	The action to apply to a matched request.
paused?	boolean	no	When true, indicates that the rule is currently paused.
apiToken?	string	no	Cloudflare API token; overrides the CLOUDFLARE_API_TOKEN environment variable. Wire with a vault.get(...) expression to source it from a vault.
apiKey?	string	no	Cloudflare API key for the legacy key+email auth path; overrides the CLOUDFLARE_API_KEY environment variable. Wire with a vault.get(...) expression. Requires email.
email?	string	no	Cloudflare account email for the legacy key+email auth path; overrides the CLOUDFLARE_EMAIL environment variable. Requires apiKey.

fn create()

Create a Ua Rules

fn get(id: string)

Get a Ua Rules

Argument	Type	Required	Description
id	string	yes	The ID of the Ua Rules

fn lookup(allowMissing?: boolean)

Look up an existing Ua Rules by matching global argument values and import it into state

Argument	Type	Required	Description
allowMissing?	boolean	no	Succeed and record found: false in lookupResult when nothing matches, instead of failing

fn adopt(id: string)

Import an existing Ua Rules by ID into state for management

Argument	Type	Required	Description
id	string	yes	The ID of the Ua Rules to import

fn update(identifier?: string)

Update Ua Rules attributes

Argument	Type	Required	Description
identifier?	string	no	Target a specific Ua Rules by id (e.g. one discovered by list)

fn delete(id: string)

Delete the Ua Rules

Argument	Type	Required	Description
id	string	yes	The ID of the Ua Rules

fn sync(identifier?: string)

Sync Ua Rules state from Cloudflare

Argument	Type	Required	Description
identifier?	string	no	Target a specific Ua Rules by id (e.g. one discovered by list)

Resources

state(infinite)— Ua Rules resource state

lookupResult(infinite)— Outcome of the most recent lookup

04Previous Versions13

2026.10.20.1AGPL-3.0-or-laterOct 20, 2026

Updated: rules
Updated: lockdowns
Updated: ua_rules
Updated: overrides
Updated: rate_limits

Modified 5 behaviors

2026.10.16.1AGPL-3.0-or-later(was none)Oct 16, 2026

2026.10.13.1Oct 13, 2026

Updated: rules
Updated: lockdowns
Updated: ua_rules
Updated: overrides
Updated: rate_limits

2026.09.29.2Sep 29, 2026

Updated: lockdowns
Updated: ua_rules
Updated: overrides
Updated: rate_limits

2026.09.29.1Sep 28, 2026

Updated: rules
Updated: lockdowns
Updated: ua_rules
Updated: overrides
Updated: rate_limits

2026.09.22.1Sep 22, 2026

Updated: overrides
Updated: rate_limits

2026.08.11.1Aug 11, 2026

Updated: rules
Updated: lockdowns

2026.07.24.1Jul 24, 2026

Updated: rules

2026.07.21.1Jul 21, 2026

Updated: rules
Updated: lockdowns
Updated: ua_rules
Updated: overrides
Updated: rate_limits

2026.07.18.2Jul 18, 2026

Added 5, removed 1 behaviors

2026.06.08.2Jun 8, 2026

Updated: rules
Updated: lockdowns
Updated: ua_rules
Updated: overrides
Updated: rate_limits

2026.05.29.1May 29, 2026

Updated: rules
Updated: lockdowns
Updated: ua_rules
Updated: overrides
Updated: rate_limits

2026.05.22.1May 22, 2026

Added: rules
Added: lockdowns
Added: ua_rules
Added: overrides
Added: rate_limits

05Stats

100 / 100

Downloads

Archive size

22.0 KB

Verified by Swamp

Has README or module doc2/2earned
README has a code example1/1earned
README is substantive1/1earned
Most symbols documented1/1earned
No slow types (deprecated)1/1earned
Dependencies pass trust audit2/2earned
Docs keep secrets in a vault1/1earned
Has description1/1earned
Platform support declared (or universal)2/2earned
License2/2earned
Verified public repository2/2earned

Repository

https://github.com/swamp-club/swamp-extensions

06Platforms

linux · x86_64 linux · aarch64 macOS · x86_64 macOS · aarch64 windows · x86_64

07Labels

#cloudflare #firewall #cloud #infrastructure