CLOUDFLARE WITH SWAMP
Swamp works with Cloudflare through behaviors. Each behavior holds a Cloudflare API token and, where needed, a zone or account ID. Its methods call the Cloudflare API and record what came back as Swamp data. The token is a vault reference, so it never sits in a definition file. Workflows combine several behaviors into one run.
Get started
curl -fsSL https://swamp-club.com/install.sh | sh swamp repo init swamp extension pull @swamp/cloudflare/resource-library swamp extension pull @webframp/cloudflare swamp extension pull @webframp/cloudflare-auditMost day-to-day work goes through @webframp/cloudflare. It provides five behavior types:
@webframp/cloudflare/zonelists zones, reads and updates zone settings, and pauses or unpauses the Cloudflare proxy@webframp/cloudflare/dnslists, creates, updates, deletes and exports DNS records for one zone@webframp/cloudflare/wafcreates, lists, pauses and deletes firewall rules, and reads WAF packages and recent security events@webframp/cloudflare/workerdeploys and deletes Worker scripts and manages Worker routes and workers.dev subdomains@webframp/cloudflare/cachepurges cached content by URL, tag, prefix or zone, and reads and changes cache settings and analytics
Three more extensions cover other parts of Cloudflare. @webframp/cloudflare-audit is a workflow and report built on those five types. It checks one zone's SSL mode, HTTPS enforcement, DNS proxying, dangling CNAMEs, CAA records, WAF coverage, Worker routes and cache configuration, and rates each finding by severity. @mccormick/cloudflare is a read-only scan of Cloudflare One Access applications, policies, identity providers, service tokens and mTLS certificates across one or more accounts. @swamp/cloudflare/resource-library manages Access applications as tracked resource state, with create, adopt, update, delete and sync methods.
To start, the getting started tutorial adds the Cloudflare extension to a repository and stores an API token in a vault. For specific tasks, see purging cached URLs, challenging suspicious traffic with a firewall rule and running a security audit of a zone. Every type, global argument and method is listed in the extensions reference. Understanding Cloudflare automation in Swamp covers zone and account scope, token handling, and when to put an approval gate in front of a change.
Cloudflare documentation
Getting started with Cloudflare DNS in Swamp
Install the @webframp/cloudflare extension, store an API token in a vault, create a DNS behavior for one zone, validate it and list the zone's DNS records.
Tutorials →Purge cached URLs from a Cloudflare zone
Create a Cloudflare cache behavior for a zone and run purge_urls to remove specific URLs from the edge cache, then purge everything with purge_all if needed.
How-to Guides →Challenge suspicious traffic with a Cloudflare firewall rule
Create a Cloudflare WAF behavior, add a firewall rule that sends matching requests to a managed challenge, list the zone's rules and pause the rule later.
How-to Guides →Run a security audit of a Cloudflare zone
Pull the @webframp/cloudflare-audit extension, create the five Cloudflare behaviors it reads from, and run the workflow to produce a severity-rated report.
How-to Guides →Cloudflare extensions
Every Swamp extension for Cloudflare: behavior types, global arguments, methods, vault configuration and the data each one writes, read from the registry.
Reference →Understanding Cloudflare automation in Swamp
How Cloudflare zones, DNS, WAF, Workers, cache and Zero Trust map onto Swamp behaviors, vaults, data and workflows, and the choices teams make automating them.
Explanation →