mirror of
https://github.com/prdlk/dotfiles.git
synced 2026-11-03 19:37:52 +00:00
Prad Nukala
6406208b35
- 16 cross-shell utilities converted to sh/bash chezmoi executables: ai c2p cp-appid extract_agents fab gdc gh-sonr-org-migrate ghg-clone ghn gho git-summary launch_omp_livediff_overlay lc-elir mdcp mdp pj (ghg-clone not named ghg: unrelated cargo binary owns that name) - cwd/history helpers stay per-shell: yy c cd clip-last + ghg/ghn/gho cd-wrappers in bash/functions/ and zsh/functions/, loaded by rc files - fish keeps only shell-state functions; converted ones now hit PATH - cp-appid ignore gating moved to .local/bin path - dot_agents/skills: 82 skills materialized from dotstate storage so dot_claude skill symlinks resolve on fresh bootstrap; dotstate profile/symlinks.json released .agents/skills .bashrc .zshrc
5.2 KiB
5.2 KiB
Common Patterns
Deploy Managed Rulesets
// Deploy Cloudflare Managed Ruleset (default)
await client.rulesets.create({
zone_id: 'zone_id',
kind: 'zone',
phase: 'http_request_firewall_managed',
name: 'Cloudflare Managed Ruleset',
rules: [{
action: 'execute',
action_parameters: {
id: 'efb7b8c949ac4650a09736fc376e9aee', // Cloudflare Managed
// Or: '4814384a9e5d4991b9815dcfc25d2f1f' for OWASP CRS
// Or: 'c2e184081120413c86c3ab7e14069605' for Exposed Credentials
},
expression: 'true', // All requests
// Or: 'http.request.uri.path starts_with "/api"' for specific paths
enabled: true,
}],
});
Override Managed Ruleset
await client.rulesets.create({
zone_id: 'zone_id',
phase: 'http_request_firewall_managed',
rules: [{
action: 'execute',
action_parameters: {
id: 'efb7b8c949ac4650a09736fc376e9aee',
overrides: {
// Override specific rules
rules: [
{ id: '5de7edfa648c4d6891dc3e7f84534ffa', action: 'log' },
{ id: '75a0060762034b9dad4e883afc121b4c', enabled: false },
],
// Override categories: wordpress, sqli, xss, rce, etc.
categories: [
{ category: 'wordpress', enabled: false },
{ category: 'sqli', action: 'log' },
],
},
},
expression: 'true',
}],
});
Custom Rules
await client.rulesets.create({
zone_id: 'zone_id',
kind: 'zone',
phase: 'http_request_firewall_custom',
name: 'Custom WAF Rules',
rules: [
// Attack score-based
{ action: 'block', expression: 'cf.waf.score gt 50', enabled: true },
{ action: 'challenge', expression: 'cf.waf.score gt 20', enabled: true },
// Specific attack types
{ action: 'block', expression: 'cf.waf.score.sqli gt 30 or cf.waf.score.xss gt 30', enabled: true },
// Geographic blocking
{ action: 'block', expression: 'ip.geoip.country in {"CN" "RU"}', enabled: true },
],
});
Rate Limiting
await client.rulesets.create({
zone_id: 'zone_id',
kind: 'zone',
phase: 'http_ratelimit',
name: 'Rate Limits',
rules: [
// Per-IP global limit
{
action: 'block',
expression: 'true',
action_parameters: {
ratelimit: {
characteristics: ['cf.colo.id', 'ip.src'],
period: 60,
requests_per_period: 100,
mitigation_timeout: 600,
},
},
},
// Login endpoint (stricter)
{
action: 'block',
expression: 'http.request.uri.path eq "/api/login"',
action_parameters: {
ratelimit: {
characteristics: ['ip.src'],
period: 60,
requests_per_period: 5,
mitigation_timeout: 600,
},
},
},
// API writes only (using counting_expression)
{
action: 'block',
expression: 'http.request.uri.path starts_with "/api"',
action_parameters: {
ratelimit: {
characteristics: ['cf.colo.id', 'ip.src'],
period: 60,
requests_per_period: 50,
counting_expression: 'http.request.method ne "GET"',
},
},
},
],
});
Skip Rules
await client.rulesets.create({
zone_id: 'zone_id',
kind: 'zone',
phase: 'http_request_firewall_custom',
name: 'Skip Rules',
rules: [
// Skip static assets (current ruleset only)
{
action: 'skip',
action_parameters: { ruleset: 'current' },
expression: 'http.request.uri.path matches "\\.(jpg|css|js|woff2?)$"',
},
// Skip all WAF phases for trusted IPs
{
action: 'skip',
action_parameters: {
phases: ['http_request_firewall_managed', 'http_ratelimit'],
},
expression: 'ip.src in {192.0.2.0/24}',
},
],
});
Complete Setup Example
Combine all three phases for comprehensive protection:
const client = new Cloudflare({ apiToken: process.env.CF_API_TOKEN });
const zoneId = process.env.ZONE_ID;
// 1. Custom rules (execute first)
await client.rulesets.create({
zone_id: zoneId,
phase: 'http_request_firewall_custom',
rules: [
{ action: 'skip', action_parameters: { phases: ['http_request_firewall_managed', 'http_ratelimit'] }, expression: 'ip.src in {192.0.2.0/24}' },
{ action: 'block', expression: 'cf.waf.score gt 50' },
{ action: 'managed_challenge', expression: 'cf.waf.score gt 20' },
],
});
// 2. Managed ruleset (execute second)
await client.rulesets.create({
zone_id: zoneId,
phase: 'http_request_firewall_managed',
rules: [{
action: 'execute',
action_parameters: { id: 'efb7b8c949ac4650a09736fc376e9aee', overrides: { categories: [{ category: 'wordpress', enabled: false }] } },
expression: 'true',
}],
});
// 3. Rate limiting (execute third)
await client.rulesets.create({
zone_id: zoneId,
phase: 'http_ratelimit',
rules: [
{ action: 'block', expression: 'true', action_parameters: { ratelimit: { characteristics: ['cf.colo.id', 'ip.src'], period: 60, requests_per_period: 100, mitigation_timeout: 600 } } },
{ action: 'block', expression: 'http.request.uri.path eq "/api/login"', action_parameters: { ratelimit: { characteristics: ['ip.src'], period: 60, requests_per_period: 5, mitigation_timeout: 600 } } },
],
});