Skip to content

Commit d1fff10

Browse files
authored
Update add-page-rules.mdx (#25163)
* Update add-page-rules.mdx * Update add-page-rules.mdx * Update add-page-rules.mdx * Update add-page-rules.mdx * Update add-page-rules.mdx
1 parent 3414101 commit d1fff10

File tree

1 file changed

+38
-210
lines changed

1 file changed

+38
-210
lines changed

src/content/docs/terraform/tutorial/add-page-rules.mdx

Lines changed: 38 additions & 210 deletions
Original file line numberDiff line numberDiff line change
@@ -14,245 +14,73 @@ In the [Configure HTTPS settings](/terraform/tutorial/configure-https-settings/)
1414

1515
Specifically, you will increase the security level for a URL known to be expensive to render and cannot be cached: `https://www.example.com/expensive-db-call`. Additionally, you will add a redirect from the previous URL used to host this page.
1616

17-
<Render file="v4-code-snippets" product="terraform" />
18-
19-
## 1. Create a new branch and append the page rule
17+
## 1. Create Page Rules configuration
2018

2119
Create a new branch and append the configuration.
2220

2321
```bash
2422
git checkout -b step5-pagerule
2523
```
2624

27-
```bash output
28-
Switched to a new branch 'step5-pagerule'
29-
```
30-
31-
```sh
32-
33-
cat >> cloudflare.tf <<'EOF'
34-
resource "cloudflare_page_rule" "increase-security-on-expensive-page" {
25+
Page Rules let you override zone settings for specific URL patterns. Add two Page Rules to your `main.tf`:
26+
```hcl
27+
# Increase security for expensive database operations
28+
resource "cloudflare_page_rule" "expensive_endpoint_security" {
3529
zone_id = var.zone_id
36-
target = "www.${var.domain}/expensive-db-call"
30+
target = "${var.domain}/expensive-db-call"
3731
priority = 1
38-
39-
actions {
32+
33+
actions = {
4034
security_level = "under_attack"
4135
}
4236
}
4337
44-
resource "cloudflare_page_rule" "redirect-to-new-db-page" {
38+
# Redirect old URLs to new location
39+
resource "cloudflare_page_rule" "legacy_redirect" {
4540
zone_id = var.zone_id
46-
target = "www.${var.domain}/old-location.php"
41+
target = "${var.domain}/old-location.php"
4742
priority = 2
48-
49-
actions {
50-
forwarding_url {
51-
url = "https://www.${var.domain}/expensive-db-call"
43+
44+
actions = {
45+
forwarding_url = {
46+
url = "https://www.${var.domain}/expensive-db-call"
5247
status_code = 301
5348
}
5449
}
5550
}
56-
EOF
5751
```
52+
The first rule increases security to "Under Attack" mode for your database endpoint. The second rule redirects old URLs with a 301 permanent redirect.
5853

59-
## 2. Preview and merge the changes
60-
61-
Preview the changes Terraform will make and then merge them into the `master` branch.
62-
54+
## 2. Preview and apply the changes:
6355
```sh
6456
terraform plan
57+
terraform apply
6558
```
66-
67-
```sh output
68-
cloudflare_record.www-asia: Refreshing state... [id=fda39d8c9bf909132e82a36bab992864]
69-
cloudflare_record.www: Refreshing state... [id=c38d3103767284e7cd14d5dad3ab8669]
70-
cloudflare_zone_settings_override.example-com-settings: Refreshing state... [id=e2e6491340be87a3726f91fc4148b126]
71-
cloudflare_load_balancer_monitor.get-root-https: Refreshing state... [id=4238142473fcd48e89ef1964be72e3e0]
72-
cloudflare_load_balancer_pool.www-servers: Refreshing state... [id=906d2a7521634783f4a96c062eeecc6d]
73-
cloudflare_load_balancer.www-lb: Refreshing state... [id=cb94f53f150e5c1a65a07e43c5d4cac4]
74-
75-
Terraform used the selected providers to generate the following execution plan.
76-
Resource actions are indicated with the following symbols:
77-
+ create
78-
79-
Terraform will perform the following actions:
80-
81-
# cloudflare_page_rule.increase-security-on-expensive-page will be created
82-
+ resource "cloudflare_page_rule" "increase-security-on-expensive-page" {
83-
+ id = (known after apply)
84-
+ priority = 1
85-
+ status = "active"
86-
+ target = "www.example.com/expensive-db-call"
87-
+ zone_id = "e2e6491340be87a3726f91fc4148b126"
88-
89-
+ actions {
90-
+ always_use_https = false
91-
+ disable_apps = false
92-
+ disable_performance = false
93-
+ disable_security = false
94-
+ disable_zaraz = false
95-
+ security_level = "under_attack"
96-
}
97-
}
98-
99-
# cloudflare_page_rule.redirect-to-new-db-page will be created
100-
+ resource "cloudflare_page_rule" "redirect-to-new-db-page" {
101-
+ id = (known after apply)
102-
+ priority = 2
103-
+ status = "active"
104-
+ target = "www.example.com/old-location.php"
105-
+ zone_id = "e2e6491340be87a3726f91fc4148b126"
106-
107-
+ actions {
108-
+ always_use_https = false
109-
+ disable_apps = false
110-
+ disable_performance = false
111-
+ disable_security = false
112-
+ disable_zaraz = false
113-
114-
+ forwarding_url {
115-
+ status_code = 301
116-
+ url = "https://www.example.com/expensive-db-call"
117-
}
118-
}
119-
}
120-
121-
Plan: 2 to add, 0 to change, 0 to destroy.
122-
123-
------------------------------------------------------------------------
124-
125-
Note: You didn't use the -out option to save this plan, so Terraform can't
126-
guarantee to take exactly these actions if you run "terraform apply" now.
127-
```
128-
129-
```sh
130-
131-
git add cloudflare.tf
132-
git commit -m "Step 5 - Add two Page Rules."
133-
```
134-
135-
```sh output
136-
[step5-pagerule d4fec16] Step 5 - Add two Page Rules.
137-
1 file changed, 23 insertions(+)
138-
```
139-
140-
```sh
141-
git checkout master
142-
```
143-
144-
```sh output
145-
Switched to branch 'master'
146-
```
147-
148-
```sh
149-
git merge step5-pagerule
150-
```
151-
152-
```sh output
153-
Updating 7a2ac34..d4fec16
154-
Fast-forward
155-
cloudflare.tf | 23 +++++++++++++++++++++++
156-
1 file changed, 23 insertions(+)
157-
```
158-
159-
## 3. Apply and verify the changes
160-
161-
First, test request the (now missing) old location of the expensive-to-render page.
162-
163-
```sh
164-
curl -vso /dev/null https://www.example.com/old-location.php 2>&1 | grep "< HTTP\|Location"
165-
```
166-
167-
```sh output
168-
< HTTP/1.1 404 Not Found
169-
```
170-
171-
As expected, the location cannot be found. Apply the Page Rules, including the redirect that should fix this error.
172-
173-
```sh
174-
terraform apply --auto-approve
175-
```
176-
177-
```sh output
178-
cloudflare_record.www-asia: Refreshing state... [id=fda39d8c9bf909132e82a36bab992864]
179-
cloudflare_load_balancer_monitor.get-root-https: Refreshing state... [id=4238142473fcd48e89ef1964be72e3e0]
180-
cloudflare_zone_settings_override.example-com-settings: Refreshing state... [id=e2e6491340be87a3726f91fc4148b126]
181-
cloudflare_record.www: Refreshing state... [id=c38d3103767284e7cd14d5dad3ab8669]
182-
cloudflare_load_balancer_pool.www-servers: Refreshing state... [id=906d2a7521634783f4a96c062eeecc6d]
183-
cloudflare_load_balancer.www-lb: Refreshing state... [id=cb94f53f150e5c1a65a07e43c5d4cac4]
184-
185-
Terraform used the selected providers to generate the following execution plan.
186-
Resource actions are indicated with the following symbols:
187-
+ create
188-
189-
Terraform will perform the following actions:
190-
191-
# cloudflare_page_rule.increase-security-on-expensive-page will be created
192-
+ resource "cloudflare_page_rule" "increase-security-on-expensive-page" {
193-
+ id = (known after apply)
194-
+ priority = 1
195-
+ status = "active"
196-
+ target = "www.example.com/expensive-db-call"
197-
+ zone_id = "e2e6491340be87a3726f91fc4148b126"
198-
199-
+ actions {
200-
+ always_use_https = false
201-
+ disable_apps = false
202-
+ disable_performance = false
203-
+ disable_security = false
204-
+ disable_zaraz = false
205-
+ security_level = "under_attack"
206-
}
207-
}
208-
209-
# cloudflare_page_rule.redirect-to-new-db-page will be created
210-
+ resource "cloudflare_page_rule" "redirect-to-new-db-page" {
211-
+ id = (known after apply)
212-
+ priority = 2
213-
+ status = "active"
214-
+ target = "www.example.com/old-location.php"
215-
+ zone_id = "e2e6491340be87a3726f91fc4148b126"
216-
217-
+ actions {
218-
+ always_use_https = false
219-
+ disable_apps = false
220-
+ disable_performance = false
221-
+ disable_security = false
222-
+ disable_zaraz = false
223-
224-
+ forwarding_url {
225-
+ status_code = 301
226-
+ url = "https://www.example.com/expensive-db-call"
227-
}
228-
}
229-
}
230-
231-
cloudflare_page_rule.redirect-to-new-db-page: Creating...
232-
cloudflare_page_rule.increase-security-on-expensive-page: Creating...
233-
cloudflare_page_rule.redirect-to-new-db-page: Creation complete after 3s [id=c5c40ff2dc12416b5fe4d0541980c591]
234-
cloudflare_page_rule.increase-security-on-expensive-page: Creation complete after 6s [id=1c13fdb84710c4cc8b11daf7ffcca449]
235-
236-
Apply complete! Resources: 2 added, 0 changed, 0 destroyed.
59+
## 3. Verify changes:
60+
Test the redirect functionality:
61+
```bash
62+
curl -I https://example.com/old-location.php
23763
```
238-
239-
With the Page Rules in place, try that call again, along with a test for the Under Attack mode:
240-
241-
```sh
242-
curl -vso /dev/null https://www.example.com/old-location.php 2>&1 | grep "< HTTP\|Location"
64+
Expected output:
65+
```bash output
66+
HTTP/1.1 301 Moved Permanently
67+
Location: https://example.com/expensive-db-call
24368
```
244-
245-
```sh output
246-
< HTTP/1.1 301 Moved Permanently
247-
< Location: https://www.example.com/expensive-db-call
69+
Test the increased security (Under Attack mode returns a challenge page):
70+
```bash
71+
curl -I https://example.com/expensive-db-call
24872
```
249-
250-
```sh
251-
curl -vso /dev/null https://www.example.com/expensive-db-call 2>&1 | grep "< HTTP"
73+
Expected output:
74+
```bash output
75+
HTTP/1.1 503 Service Temporarily Unavailable
25276
```
77+
The 503 response indicates the Under Attack mode is active, presenting visitors with a challenge page before allowing access to protect against DDoS attacks.
25378

254-
```sh output
255-
< HTTP/1.1 503 Service Temporarily Unavailable
79+
## 4. Commit and merge the changes:
80+
```bash
81+
git add main.tf
82+
git commit -m "Step 5 - Add two Page Rules"
83+
git push
25684
```
25785

25886
The call works as expected. In the first case, the Cloudflare global network responds with a `301` redirecting the browser to the new location. In the second case, the Cloudflare global network initially responds with a `503`, which is consistent with the Under Attack mode.

0 commit comments

Comments
 (0)