ce7cb702218693d08ea6d83464d2457c9250027c

terraform/external/cloudflare-tunnel/waf.tf

@@ -0,0 +1,21 @@
+resource "cloudflare_ruleset" "code_firewall" {
+  provider = cloudflare.waf
+
+  zone_id = var.zone_id
+  name    = "forge-code-waf"
+  kind    = "zone"
+  phase   = "http_request_firewall_custom"
+  rules = [
+    {
+      ref         = "meta_login"
+      description = "Block Meta-ExternalAgent requests to login pages. Added due to frequent robots.txt violations."
+      expression  = <<-EOT
+        (${local.code_host})
+        and lower(http.user_agent) contains "meta-externalagent"
+        and http.request.uri.path in {"/user/login" "/login-disabled"}
+      EOT
+      action      = "block"
+      enabled     = true
+    },
+  ]
+}