{"id":19177791,"url":"https://github.com/andrewsomething/terraform-digitalocean-firewall-cloudflare","last_synced_at":"2025-06-12T05:08:24.361Z","repository":{"id":46230653,"uuid":"105463346","full_name":"andrewsomething/terraform-digitalocean-firewall-cloudflare","owner":"andrewsomething","description":"Terraform Module for DigitalOcean Firewall + Cloudflare","archived":false,"fork":false,"pushed_at":"2021-11-04T23:03:52.000Z","size":10,"stargazers_count":23,"open_issues_count":0,"forks_count":9,"subscribers_count":2,"default_branch":"main","last_synced_at":"2025-06-12T05:08:22.480Z","etag":null,"topics":["cloudflare","devops","digitalocean","hactoberfest","terraform","terraform-modules"],"latest_commit_sha":null,"homepage":"","language":"HCL","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/andrewsomething.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null}},"created_at":"2017-10-01T18:17:06.000Z","updated_at":"2024-10-26T01:52:43.000Z","dependencies_parsed_at":"2022-08-31T02:41:19.765Z","dependency_job_id":null,"html_url":"https://github.com/andrewsomething/terraform-digitalocean-firewall-cloudflare","commit_stats":null,"previous_names":[],"tags_count":3,"template":false,"template_full_name":null,"purl":"pkg:github/andrewsomething/terraform-digitalocean-firewall-cloudflare","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/andrewsomething%2Fterraform-digitalocean-firewall-cloudflare","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/andrewsomething%2Fterraform-digitalocean-firewall-cloudflare/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/andrewsomething%2Fterraform-digitalocean-firewall-cloudflare/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/andrewsomething%2Fterraform-digitalocean-firewall-cloudflare/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/andrewsomething","download_url":"https://codeload.github.com/andrewsomething/terraform-digitalocean-firewall-cloudflare/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/andrewsomething%2Fterraform-digitalocean-firewall-cloudflare/sbom","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":259402147,"owners_count":22851878,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["cloudflare","devops","digitalocean","hactoberfest","terraform","terraform-modules"],"created_at":"2024-11-09T10:35:10.319Z","updated_at":"2025-06-12T05:08:24.342Z","avatar_url":"https://github.com/andrewsomething.png","language":"HCL","funding_links":[],"categories":[],"sub_categories":[],"readme":"# Terraform Module for DigitalOcean Firewall + Cloudflare\n\nThis module allows you to create a DigitalOcean Firewall that only accepts inbound connections from Cloudflare's [published list](https://www.cloudflare.com/ips/) of IP addresses.\n\n### Why would I use this?\n\nCloudflare provides DDOS protection for domains using its DNS. If an attacker knows the IP address of your origin server, this can easily be circumvented. Using the approach in this module prevents incoming connections to the server from all non-Cloudflare IPs.\n\nThis could be done at the server level using `iptables` or other firewall software. Though a missconfigured firewall could prevent you from accessing your server. Using a DigitalOcean Firewall, you can open or close additional ports as needed.\n\nThis can also be achieved at the web server level using the `DenyAllButCloudFlare` rule from Cloudflare's [Mod_Cloudflare](https://www.cloudflare.com/technical-resources/#mod_cloudflare) Apache extension or similar tools for Nginx. Though this still uses bandwidth and system resources on the origin server. Using a DigitalOcean Firewall means the un-wanted traffic will be blocked before it ever reaches you.\n\nCloudflare IP addresses may also change. Tracking those changes and applying them by hand in the DigitalOcean control panel can be tedious. Using this module, re-running `terraform apply` will pick up those changes and reconfigure your Firewall.\n\n## Module input variables\n\n- `name` - The name of the firewall to be created.\n- `droplet_ids` - A list of the IDs of the Droplets assigned to the Firewall.\n- `tags` - A list of tag names assigned to the Firewall.\n\n## Example\n\nThis example creates a Firewall and a tag named `allow_inbound_cloudflare`. Any Droplet with this tag applied to it will only allow inbound connections to ports 80 and 443 from Cloudflare IPs.\n\n```tf\nmodule \"firewall_inbound_cloudflare\" {\n  source = \"andrewsomething/firewall-cloudflare/digitalocean\"\n\n  name   = \"inbound-cloudflare\"\n  tags   = [\"allow_inbound_cloudflare\"]\n}\n\nresource \"digitalocean_tag\" \"allow_inbound_cloudflare\" {\n  name = \"allow_inbound_cloudflare\"\n}\n```\n\n**Note:** DigitalOcean Firewalls are composable. Creating separate Firewalls for separate concerns is considered a best practice. When using the above example, additional Firewalls should be applied to the Droplets in order to allow for things like inbound SSH access and outbound DNS lookups.\n\n## License\n\nMIT licensed. See LICENSE for full details.\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fandrewsomething%2Fterraform-digitalocean-firewall-cloudflare","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fandrewsomething%2Fterraform-digitalocean-firewall-cloudflare","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fandrewsomething%2Fterraform-digitalocean-firewall-cloudflare/lists"}