{"id":16788145,"url":"https://github.com/bobbyiliev/cloudflare-ddos-protection","last_synced_at":"2025-03-23T15:31:16.661Z","repository":{"id":55608032,"uuid":"273248304","full_name":"bobbyiliev/cloudflare-ddos-protection","owner":"bobbyiliev","description":"You can use this CLI script to enable and disable the CloudFlare DDOS protection for your website automatically based on the CPU load of your server.","archived":false,"fork":false,"pushed_at":"2024-11-19T10:42:34.000Z","size":27,"stargazers_count":23,"open_issues_count":0,"forks_count":19,"subscribers_count":6,"default_branch":"main","last_synced_at":"2025-03-18T21:52:08.408Z","etag":null,"topics":["bash","cloudflare","cloudflare-ddos-protection","hacktoberfest"],"latest_commit_sha":null,"homepage":"https://ebook.bobby.sh","language":"Shell","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/bobbyiliev.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2020-06-18T13:38:39.000Z","updated_at":"2025-02-11T21:35:03.000Z","dependencies_parsed_at":"2024-10-28T16:37:14.581Z","dependency_job_id":"0dfc81bb-9783-44d3-a734-a03774673381","html_url":"https://github.com/bobbyiliev/cloudflare-ddos-protection","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/bobbyiliev%2Fcloudflare-ddos-protection","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/bobbyiliev%2Fcloudflare-ddos-protection/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/bobbyiliev%2Fcloudflare-ddos-protection/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/bobbyiliev%2Fcloudflare-ddos-protection/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/bobbyiliev","download_url":"https://codeload.github.com/bobbyiliev/cloudflare-ddos-protection/tar.gz/refs/heads/main","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":245122746,"owners_count":20564365,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["bash","cloudflare","cloudflare-ddos-protection","hacktoberfest"],"created_at":"2024-10-13T08:17:04.502Z","updated_at":"2025-03-23T15:31:16.652Z","avatar_url":"https://github.com/bobbyiliev.png","language":"Shell","funding_links":[],"categories":[],"sub_categories":[],"readme":"# CloudFlare DDoS Protection Script\n\nA bash script that automatically manages CloudFlare's DDoS protection based on your server's CPU load. The script monitors system resources and dynamically adjusts CloudFlare's security level through their API.\n\n## Features\n\n- Automatic DDoS protection based on CPU load\n- Secure configuration handling\n- Logging\n- Email notifications\n- Temporary file management\n- Automatic cleanup\n\n## Prerequisites\n\n### Required Software\n\n- curl (for API requests)\n- jq (for JSON parsing)\n- mailutils/mailx (for notifications)\n\n### Installation on Debian/Ubuntu\n\n```bash\nsudo apt-get update\nsudo apt-get install -y curl jq mailutils\n```\n\n### Installation on RedHat/CentOS/Rocky Linux\n\n```bash\nsudo yum install -y curl jq mailx\n```\n\n### CloudFlare Requirements\n\n- CloudFlare account\n- CloudFlare API token with the following permissions:\n  - Zone - Zone Settings - Read\n  - Zone - Zone Settings - Edit\n- CloudFlare Zone ID\n\n## Installation\n\n1. Clone or download the script:\n\n```bash\ncurl -o protection.sh https://raw.githubusercontent.com/bobbyiliev/cloudflare-ddos-protection/main/protection.sh\n```\n\n2. Make the script executable:\n```bash\nchmod +x protection.sh\n```\n\n## Configuration\n\n### Method 1: Environment Variables\n\nSet your CloudFlare credentials as environment variables:\n```bash\nexport CF_ZONE_ID=\"your_zone_id\"\nexport CF_EMAIL_ADDRESS=\"your_email\"\nexport CF_API_TOKEN=\"your_api_token\"\n```\n\n### Method 2: Direct Script Configuration\n\nEdit the script and update the following variables:\n```bash\nCF_ZONE_ID=\"your_zone_id\"\nCF_EMAIL_ADDRESS=\"your_email\"\nCF_API_TOKEN=\"your_api_token\"\n```\n\n### Optional Settings\n\n- `NOTIFICATIONS_ENABLED`: Set to 1 to enable email notifications (default: 1)\n- You can modify the CPU load thresholds by adjusting the calculation in the `get_allowed_cpu_load` function\n\n## Usage\n\n### Manual Execution\n\nRun the script directly:\n\n```bash\n./protection.sh\n```\n\n### Automated Execution (Recommended)\n\nSet up a cron job to run the script every 30 seconds:\n\n1. Open your crontab:\n\n```bash\ncrontab -e\n```\n\n2. Add the following lines:\n\n```bash\n* * * * * /full/path/to/protection.sh\n* * * * * ( sleep 30 ; /full/path/to/protection.sh )\n```\n\n## Logging\n\nThe script logs all activities to `~/.cloudflare/ddos.log`. Each log entry includes:\n- Timestamp\n- Action taken (enabled/disabled DDoS protection)\n- Current CPU load\n- Any errors encountered\n\nExample log entry:\n\n```\n2024-11-19 14:30:00 - Enabled DDoS protection (Load: 8)\n```\n\n## Email Notifications\n\nWhen `NOTIFICATIONS_ENABLED` is set to 1, you'll receive email notifications for:\n- DDoS protection enabled/disabled\n- Error conditions\n- Configuration issues\n\nNote that the email notifications require a working `mail` command on your system and do not support SMTP authentication. This may require additional configuration for some mail servers as you might not be able to send emails directly from your server.\n\n## Security Considerations\n\n- The configuration directory is created with restricted permissions (700)\n- Temporary files are securely created and automatically cleaned up\n- API credentials are protected from exposure in logs\n- Input validation is performed on all variables\n\nIf you encounter any security issues, please report them to [@bobbyiliev_](https://x.com/bobbyiliev_).\n\n## Troubleshooting\n\nAdd `set -x` at the beginning of the script for verbose output:\n\n```bash\n#!/bin/bash\nset -x\n# rest of the script...\n```\n\n## Manual Testing\n\nYou can test the script manually by setting the `TEST_MODE` and `SIMULATED_LOAD` environment variables:\n\n```bash\n# Test under normal load\nTEST_MODE=1 SIMULATED_LOAD=5 ./protection.sh\n\n# Test high load (should trigger protection)\nTEST_MODE=1 SIMULATED_LOAD=30 ./protection.sh\n\n# Test returning to normal\nTEST_MODE=1 SIMULATED_LOAD=5 ./protection.sh\n```\n\n## CloudFlare API Reference\n\nFor more information about the CloudFlare API endpoints used in this script, visit:\n- [CloudFlare API Documentation](https://developers.cloudflare.com/api)\n- [Security Level Settings](https://developers.cloudflare.com/api/operations/zone-settings-change-security-level-setting)\n\n## Contributing\n\nFeel free to submit issues and enhancement requests!\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fbobbyiliev%2Fcloudflare-ddos-protection","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fbobbyiliev%2Fcloudflare-ddos-protection","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fbobbyiliev%2Fcloudflare-ddos-protection/lists"}