Cloudflare/ssl

@swamp/cloudflare/sslv2026.07.24.1· 2d agoMODELS

01README

Cloudflare ssl infrastructure models

02Release Notes

Updated: custom_csrs

03Models7

@swamp/cloudflare/ssl/certificatesv2026.07.21.1certificates.ts

Global Arguments

Argument	Type	Required	Description
zone_id	string	yes	Cloudflare zone ID
name	string	yes	Instance name for this resource (used as the unique identifier in the factory pattern)
certificate	string	yes	The hostname certificate.
private_key	string	yes	The hostname certificate's private key.
apiToken?	string	no	Cloudflare API token; overrides the CLOUDFLARE_API_TOKEN environment variable. Wire with a vault.get(...) expression to source it from a vault.
apiKey?	string	no	Cloudflare API key for the legacy key+email auth path; overrides the CLOUDFLARE_API_KEY environment variable. Wire with a vault.get(...) expression. Requires email.
email?	string	no	Cloudflare account email for the legacy key+email auth path; overrides the CLOUDFLARE_EMAIL environment variable. Requires apiKey.

fn create()

Create a Certificates

fn get(id: string)

Get a Certificates

Argument	Type	Required	Description
id	string	yes	The ID of the Certificates

fn lookup()

Look up an existing Certificates by matching global argument values and import it into state

fn adopt(id: string)

Import an existing Certificates by ID into state for management

Argument	Type	Required	Description
id	string	yes	The ID of the Certificates to import

fn delete(id: string)

Delete the Certificates

Argument	Type	Required	Description
id	string	yes	The ID of the Certificates

fn sync(identifier?: string)

Sync Certificates state from Cloudflare

Argument	Type	Required	Description
identifier?	string	no	Target a specific Certificates by id (e.g. one discovered by list)

Resources

state(infinite)— Certificates resource state

@swamp/cloudflare/ssl/client-certificatesv2026.07.21.1client_certificates.ts

Global Arguments

Argument	Type	Required	Description
zone_id	string	yes	Cloudflare zone ID
name	string	yes	Instance name for this resource (used as the unique identifier in the factory pattern)
reactivate?	boolean	no
csr	string	yes	The Certificate Signing Request (CSR). Must be newline-encoded.
validity_days	number	yes	The number of days the Client Certificate will be valid after the issued_on date.
apiToken?	string	no	Cloudflare API token; overrides the CLOUDFLARE_API_TOKEN environment variable. Wire with a vault.get(...) expression to source it from a vault.
apiKey?	string	no	Cloudflare API key for the legacy key+email auth path; overrides the CLOUDFLARE_API_KEY environment variable. Wire with a vault.get(...) expression. Requires email.
email?	string	no	Cloudflare account email for the legacy key+email auth path; overrides the CLOUDFLARE_EMAIL environment variable. Requires apiKey.

fn create()

Create a Client Certificates

fn get(id: string)

Get a Client Certificates

Argument	Type	Required	Description
id	string	yes	The ID of the Client Certificates

fn lookup()

Look up an existing Client Certificates by matching global argument values and import it into state

fn adopt(id: string)

Import an existing Client Certificates by ID into state for management

Argument	Type	Required	Description
id	string	yes	The ID of the Client Certificates to import

fn update(identifier?: string)

Update Client Certificates attributes

Argument	Type	Required	Description
identifier?	string	no	Target a specific Client Certificates by id (e.g. one discovered by list)

fn delete(id: string)

Delete the Client Certificates

Argument	Type	Required	Description
id	string	yes	The ID of the Client Certificates

fn sync(identifier?: string)

Sync Client Certificates state from Cloudflare

Argument	Type	Required	Description
identifier?	string	no	Target a specific Client Certificates by id (e.g. one discovered by list)

Resources

state(infinite)— Client Certificates resource state

@swamp/cloudflare/ssl/custom-certificatesv2026.07.21.1custom_certificates.ts

Global Arguments

Argument	Type	Required	Description
zone_id	string	yes	Cloudflare zone ID
name	string	yes	Instance name for this resource (used as the unique identifier in the factory pattern)
bundle_method?	enum	no	A ubiquitous bundle has the highest probability of being verified everywhere, even by clients using outdated or unusual trust stores. An optimal bundle uses the shortest chain and newest intermediates. And the force bundle verifies the chain, but does not otherwise modify it.
certificate	string	yes	The zone's SSL certificate or certificate and the intermediate(s).
custom_csr_id?	string	no	The identifier for the Custom CSR that was used.
deploy?	enum	no	The environment to deploy the certificate to, defaults to production.
geo_restrictions?	object	no	Specify the region where your private key can be held locally for optimal TLS performance. HTTPS connections to any excluded data center will still be fully encrypted, but will incur some latency while Keyless SSL is used to complete the handshake with the nearest allowed data center. Options allow distribution to only to U.S. data centers, only to E.U. data centers, or only to highest security data centers. Default distribution is to all Cloudflare datacenters, for optimal performance.
policy?	string	no	Specify the policy that determines the region where your private key will be held locally. HTTPS connections to any excluded data center will still be fully encrypted, but will incur some latency while Keyless SSL is used to complete the handshake with the nearest allowed data center. Any combination of countries, specified by their two letter country code (https://en.wikipedia.org/wiki/ISO_3166-1_alpha-2#Officially_assigned_code_elements) can be chosen, such as \
private_key?	string	no	The zone's private key. Not required if custom_csr_id is provided, in which case the private key is retrieved from the CSR record held by Cloudflare.
type?	enum	no	The type 'legacy_custom' enables support for legacy clients which do not include SNI in the TLS handshake.
apiToken?	string	no	Cloudflare API token; overrides the CLOUDFLARE_API_TOKEN environment variable. Wire with a vault.get(...) expression to source it from a vault.
apiKey?	string	no	Cloudflare API key for the legacy key+email auth path; overrides the CLOUDFLARE_API_KEY environment variable. Wire with a vault.get(...) expression. Requires email.
email?	string	no	Cloudflare account email for the legacy key+email auth path; overrides the CLOUDFLARE_EMAIL environment variable. Requires apiKey.

fn create()

Create a Custom Certificates

fn get(id: string)

Get a Custom Certificates

Argument	Type	Required	Description
id	string	yes	The ID of the Custom Certificates

fn lookup()

Look up an existing Custom Certificates by matching global argument values and import it into state

fn adopt(id: string)

Import an existing Custom Certificates by ID into state for management

Argument	Type	Required	Description
id	string	yes	The ID of the Custom Certificates to import

fn update(identifier?: string)

Update Custom Certificates attributes

Argument	Type	Required	Description
identifier?	string	no	Target a specific Custom Certificates by id (e.g. one discovered by list)

fn delete(id: string)

Delete the Custom Certificates

Argument	Type	Required	Description
id	string	yes	The ID of the Custom Certificates

fn sync(identifier?: string)

Sync Custom Certificates state from Cloudflare

Argument	Type	Required	Description
identifier?	string	no	Target a specific Custom Certificates by id (e.g. one discovered by list)

Resources

state(infinite)— Custom Certificates resource state

@swamp/cloudflare/ssl/custom-csrsv2026.07.24.1custom_csrs.ts

Global Arguments

Argument	Type	Required	Description
account_id?	string	no	Cloudflare account ID (provide account_id or zone_id)
zone_id?	string	no	Cloudflare zone ID (provide account_id or zone_id)
common_name	string	yes	The common name (domain) for the CSR. Must be at most 64 characters.
country	string	yes	Two-letter ISO 3166-1 alpha-2 country code.
description?	string	no	Optional description for the CSR.
key_type?	enum	no	Key algorithm to use for the CSR. Defaults to rsa2048 if not specified.
locality	string	yes	City or locality name.
name?	string	no	Human-readable name for the CSR.
organization	string	yes	Organization name.
organizational_unit?	string	no	Organizational unit name.
sans	array	yes	Subject Alternative Names for the CSR. At least one SAN is required.
state	string	yes	State or province name.
apiToken?	string	no	Cloudflare API token; overrides the CLOUDFLARE_API_TOKEN environment variable. Wire with a vault.get(...) expression to source it from a vault.
apiKey?	string	no	Cloudflare API key for the legacy key+email auth path; overrides the CLOUDFLARE_API_KEY environment variable. Wire with a vault.get(...) expression. Requires email.
email?	string	no	Cloudflare account email for the legacy key+email auth path; overrides the CLOUDFLARE_EMAIL environment variable. Requires apiKey.

fn create()

Create a Custom Csrs

fn get(id: string)

Get a Custom Csrs

Argument	Type	Required	Description
id	string	yes	The ID of the Custom Csrs

fn lookup()

Look up an existing Custom Csrs by matching global argument values and import it into state

fn adopt(id: string)

Import an existing Custom Csrs by ID into state for management

Argument	Type	Required	Description
id	string	yes	The ID of the Custom Csrs to import

fn delete(id: string)

Delete the Custom Csrs

Argument	Type	Required	Description
id	string	yes	The ID of the Custom Csrs

fn sync(identifier?: string)

Sync Custom Csrs state from Cloudflare

Argument	Type	Required	Description
identifier?	string	no	Target a specific Custom Csrs by id (e.g. one discovered by list)

Resources

state(infinite)— Custom Csrs resource state

@swamp/cloudflare/ssl/custom-trust-storev2026.07.21.1custom_trust_store.ts

Global Arguments

Argument	Type	Required	Description
zone_id	string	yes	Cloudflare zone ID
name	string	yes	Instance name for this resource (used as the unique identifier in the factory pattern)
certificate	string	yes	The root CA certificate in PEM format. Only root CA certificates are accepted; intermediate and leaf certificates are not supported.
apiToken?	string	no	Cloudflare API token; overrides the CLOUDFLARE_API_TOKEN environment variable. Wire with a vault.get(...) expression to source it from a vault.
apiKey?	string	no	Cloudflare API key for the legacy key+email auth path; overrides the CLOUDFLARE_API_KEY environment variable. Wire with a vault.get(...) expression. Requires email.
email?	string	no	Cloudflare account email for the legacy key+email auth path; overrides the CLOUDFLARE_EMAIL environment variable. Requires apiKey.

fn create()

Create a Custom Trust Store

fn get(id: string)

Get a Custom Trust Store

Argument	Type	Required	Description
id	string	yes	The ID of the Custom Trust Store

fn lookup()

Look up an existing Custom Trust Store by matching global argument values and import it into state

fn adopt(id: string)

Import an existing Custom Trust Store by ID into state for management

Argument	Type	Required	Description
id	string	yes	The ID of the Custom Trust Store to import

fn delete(id: string)

Delete the Custom Trust Store

Argument	Type	Required	Description
id	string	yes	The ID of the Custom Trust Store

fn sync(identifier?: string)

Sync Custom Trust Store state from Cloudflare

Argument	Type	Required	Description
identifier?	string	no	Target a specific Custom Trust Store by id (e.g. one discovered by list)

Resources

state(infinite)— Custom Trust Store resource state

@swamp/cloudflare/ssl/keyless-certificatesv2026.07.21.1keyless_certificates.ts

Global Arguments

Argument	Type	Required	Description
zone_id	string	yes	Cloudflare zone ID
enabled?	boolean	no	Whether or not the Keyless SSL is on or off.
host	string	yes	The keyless SSL name.
name?	string	no	The keyless SSL name.
port	number	yes	The keyless SSL port used to communicate between Cloudflare and the client's Keyless SSL server.
tunnel?	object	no	Configuration for using Keyless SSL through a Cloudflare Tunnel.
bundle_method?	enum	no	A ubiquitous bundle has the highest probability of being verified everywhere, even by clients using outdated or unusual trust stores. An optimal bundle uses the shortest chain and newest intermediates. And the force bundle verifies the chain, but does not otherwise modify it.
certificate	string	yes	The zone's SSL certificate or SSL certificate and intermediate(s).
apiToken?	string	no	Cloudflare API token; overrides the CLOUDFLARE_API_TOKEN environment variable. Wire with a vault.get(...) expression to source it from a vault.
apiKey?	string	no	Cloudflare API key for the legacy key+email auth path; overrides the CLOUDFLARE_API_KEY environment variable. Wire with a vault.get(...) expression. Requires email.
email?	string	no	Cloudflare account email for the legacy key+email auth path; overrides the CLOUDFLARE_EMAIL environment variable. Requires apiKey.

fn create()

Create a Keyless Certificates

fn get(id: string)

Get a Keyless Certificates

Argument	Type	Required	Description
id	string	yes	The ID of the Keyless Certificates

fn lookup()

Look up an existing Keyless Certificates by matching global argument values and import it into state

fn adopt(id: string)

Import an existing Keyless Certificates by ID into state for management

Argument	Type	Required	Description
id	string	yes	The ID of the Keyless Certificates to import

fn update(identifier?: string)

Update Keyless Certificates attributes

Argument	Type	Required	Description
identifier?	string	no	Target a specific Keyless Certificates by id (e.g. one discovered by list)

fn delete(id: string)

Delete the Keyless Certificates

Argument	Type	Required	Description
id	string	yes	The ID of the Keyless Certificates

fn sync(identifier?: string)

Sync Keyless Certificates state from Cloudflare

Argument	Type	Required	Description
identifier?	string	no	Target a specific Keyless Certificates by id (e.g. one discovered by list)

Resources

state(infinite)— Keyless Certificates resource state

@swamp/cloudflare/ssl/origin-tls-client-authv2026.07.21.1origin_tls_client_auth.ts

Global Arguments

Argument	Type	Required	Description
zone_id	string	yes	Cloudflare zone ID
name	string	yes	Instance name for this resource (used as the unique identifier in the factory pattern)
certificate	string	yes	The zone's leaf certificate.
private_key	string	yes	The zone's private key.
apiToken?	string	no	Cloudflare API token; overrides the CLOUDFLARE_API_TOKEN environment variable. Wire with a vault.get(...) expression to source it from a vault.
apiKey?	string	no	Cloudflare API key for the legacy key+email auth path; overrides the CLOUDFLARE_API_KEY environment variable. Wire with a vault.get(...) expression. Requires email.
email?	string	no	Cloudflare account email for the legacy key+email auth path; overrides the CLOUDFLARE_EMAIL environment variable. Requires apiKey.

fn create()

Create a Origin Tls Client Auth

fn get(id: string)

Get a Origin Tls Client Auth

Argument	Type	Required	Description
id	string	yes	The ID of the Origin Tls Client Auth

fn lookup()

Look up an existing Origin Tls Client Auth by matching global argument values and import it into state

fn adopt(id: string)

Import an existing Origin Tls Client Auth by ID into state for management

Argument	Type	Required	Description
id	string	yes	The ID of the Origin Tls Client Auth to import

fn delete(id: string)

Delete the Origin Tls Client Auth

Argument	Type	Required	Description
id	string	yes	The ID of the Origin Tls Client Auth

fn sync(identifier?: string)

Sync Origin Tls Client Auth state from Cloudflare

Argument	Type	Required	Description
identifier?	string	no	Target a specific Origin Tls Client Auth by id (e.g. one discovered by list)

Resources

state(infinite)— Origin Tls Client Auth resource state

04Previous Versions5

2026.07.21.1Jul 21, 2026

Updated: custom_trust_store
Updated: client_certificates
Updated: custom_certificates
Updated: custom_csrs
Updated: keyless_certificates
Updated: origin_tls_client_auth
Updated: certificates

2026.07.18.2Jul 18, 2026

Modified 7 models

2026.06.08.2Jun 8, 2026

Updated: custom_trust_store
Updated: client_certificates
Updated: custom_certificates
Updated: custom_csrs
Updated: keyless_certificates
Updated: origin_tls_client_auth
Updated: certificates

2026.05.29.1May 29, 2026

Updated: custom_trust_store
Updated: client_certificates
Updated: custom_certificates
Updated: custom_csrs
Updated: keyless_certificates
Updated: origin_tls_client_auth
Updated: certificates

2026.05.22.1May 22, 2026

Added: custom_trust_store
Added: client_certificates
Added: custom_certificates
Added: custom_csrs
Added: keyless_certificates
Added: origin_tls_client_auth
Added: certificates

05Stats

100 / 100

Downloads

Archive size

31.9 KB

Verified by Swamp

Has README or module doc2/2earned
README has a code example1/1earned
README is substantive1/1earned
Most symbols documented1/1earned
No slow types (deprecated)1/1earned
Dependencies pass trust audit2/2earned
Has description1/1earned
Platform support declared (or universal)2/2earned
License declared1/1earned
Verified public repository2/2earned

Repository

https://github.com/swamp-club/swamp-extensions

06Platforms

linux · x86_64 linux · aarch64 macOS · x86_64 macOS · aarch64

07Labels

#cloudflare #ssl #cloud #infrastructure