CI CD Integration

CI/CD Integration

Doorman is designed for automated deployment pipelines. This guide covers integrating Doorman into your CI/CD workflow.

GitHub Actions

Basic Validation & Deploy

name: Firewall Deploy
on:
  push:
    branches: [main]
    paths:
      - '.doorman.json'

jobs:
  deploy:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - uses: actions/setup-node@v4
        with:
          node-version: 20

      - run: npm install -g @gfargo/doorman

      - name: Validate configuration
        run: doorman validate

      - name: Deploy firewall rules
        run: doorman sync
        env:
          VERCEL_TOKEN: ${{ secrets.VERCEL_TOKEN }}
          VERCEL_PROJECT_ID: ${{ secrets.VERCEL_PROJECT_ID }}
          VERCEL_TEAM_ID: ${{ secrets.VERCEL_TEAM_ID }}

Pull Request Validation

name: Firewall PR Check
on:
  pull_request:
    paths:
      - '.doorman.json'

jobs:
  validate:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - uses: actions/setup-node@v4
        with:
          node-version: 20

      - run: npm install -g @gfargo/doorman

      - name: Validate configuration
        run: doorman validate --verbose

      - name: Show diff
        run: doorman diff --format json
        env:
          VERCEL_TOKEN: ${{ secrets.VERCEL_TOKEN }}
          VERCEL_PROJECT_ID: ${{ secrets.VERCEL_PROJECT_ID }}
          VERCEL_TEAM_ID: ${{ secrets.VERCEL_TEAM_ID }}

Multi-Provider Pipeline

name: Multi-Provider Deploy
on:
  push:
    branches: [main]

jobs:
  deploy:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version: 20
      - run: npm install -g @gfargo/doorman

      - name: Validate all configs
        run: |
          doorman validate --config vercel.config.json
          doorman validate --config cloudflare.config.json
          doorman validate --config fastly.config.json

      - name: Deploy to Vercel
        run: doorman sync --config vercel.config.json --provider vercel
        env:
          VERCEL_TOKEN: ${{ secrets.VERCEL_TOKEN }}

      - name: Deploy to Cloudflare
        run: doorman sync --config cloudflare.config.json --provider cloudflare
        env:
          CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}

      - name: Deploy to Fastly
        run: doorman sync --config fastly.config.json --provider fastly
        env:
          FASTLY_API_TOKEN: ${{ secrets.FASTLY_API_TOKEN }}

Best Practices

Secrets Management

Never commit API tokens. Use your CI provider's secrets management:

• GitHub Actions — Repository secrets or environment secrets
• Vercel — Environment variables in project settings
• GitLab CI — CI/CD variables

Validation Before Deploy

Always validate your configuration before deploying:

doorman validate --verbose

--verbose/-v shows detailed validation results, including warnings.

Dry Run in PRs

Use --dry-run in pull request checks to preview changes without applying them:

doorman download --dry-run
doorman diff --format json

Backup Before Deploy

Create a backup before applying changes in production. backup has no --name option — it always writes an auto-generated, timestamped filename (e.g. firewall-backup-2024-01-01_00-00-00.json) into the --output/-o directory (defaults to ./backups):

doorman backup --output ./backups/pre-deploy
doorman sync

Related Pages

• Commands Overview — CLI command reference
• Configuration — Configuration file reference
• Getting Started — Quick setup guide