resource "cloudflare_ruleset" "code_firewall" {
  provider = cloudflare.waf

  zone_id = var.zone_id
  name    = "forge-code-waf"
  kind    = "zone"
  phase   = "http_request_firewall_custom"
  rules = [
    {
      ref         = "meta_login"
      description = "Block Meta-ExternalAgent requests to login pages. Added due to frequent robots.txt violations."
      expression  = <<-EOT
        (${local.code_host})
        and lower(http.user_agent) contains "meta-externalagent"
        and http.request.uri.path in {"/user/login" "/login-disabled"}
      EOT
      action      = "block"
      enabled     = true
    },
  ]
}