-
Notifications
You must be signed in to change notification settings - Fork 1
Cloudflare Migration
⚠️ Not yet available:doorman migratedoes not exist in the current CLI. It's a spec'd, unbuilt roadmap item ("Phase 6" in RELEASE-2.0.md). Running anydoorman migrate ...command shown below will fail withunknown command: migrate.This page documents the planned automated migration workflow so you know what's coming. For migrating today, see Manual Migration (Available Now) below — you'll use
doorman download, hand-edit the config using the Configuration reference and the compatibility matrix below, thendoorman validate/doorman sync --provider cloudflare.
Guide for migrating firewall rules from Vercel Firewall to Cloudflare WAF using Doorman.
- Complete the Cloudflare Setup guide first
- Back up your current Vercel configuration
- Review the compatibility matrix below — some features don't translate 1:1
Important: Always test in a staging environment before applying to production.
| Feature | Vercel | Cloudflare | Translation |
|---|---|---|---|
| Path matching | ✅ | ✅ | Direct |
| Method filtering | ✅ | ✅ | Direct |
| IP blocking | ✅ | ✅ | Direct (uses Lists API when Account ID provided) |
| User agent matching | ✅ | ✅ | Direct |
| Header matching | ✅ | ✅ | Direct |
| Geo-blocking | ✅ | ✅ | Direct |
| Rate limiting | ✅ | ✅ | Modified (different config format) |
| Redirects | ✅ | ✅ | Direct |
| Challenge actions | ✅ Basic | ✅ Advanced | Enhanced (Cloudflare offers more challenge types) |
| Regex matching | ✅ | Falls back to contains/starts_with | |
| Environment conditions | ✅ | ❌ | Removed (Vercel-specific) |
| JA3/JA4 fingerprints | ✅ | ❌ | Removed (Vercel-specific) |
Until doorman migrate ships, migrate by hand using commands that exist today:
doorman backup
doorman download --provider vercel --config vercel-current.jsonOpen vercel-current.json and, using the Configuration reference and the compatibility matrix above, write out the equivalent rules in a new file (e.g. cloudflare.config.json) with "provider": "cloudflare" and Cloudflare-shaped conditions/actions. This is the step the planned migrate command will eventually automate.
doorman validate --config cloudflare.config.json
doorman sync --config cloudflare.config.json --provider cloudflare --dry-rundoorman sync --config cloudflare.config.json --provider cloudflareVerify in the Cloudflare dashboard under Security → WAF → Custom rules, first against a staging zone/token if you have one, then repeat against production once you're confident.
The rest of this page describes the automated doorman migrate workflow once it ships (see the roadmap warning at the top of this page).
doorman backup
doorman export --format json --output vercel-backup.jsondoorman migrate --from vercel --to cloudflare --dry-runThis shows which rules will migrate perfectly, which will be modified, and which can't migrate. No changes are made.
doorman migrate --from vercel --to cloudflare --output cloudflare.config.jsonThe generated file includes:
- Translated rules with Cloudflare provider settings
- Migration metadata (source, date, warnings)
- Notes on any rules that were modified
Open cloudflare.config.json and review the translated rules, then:
doorman validate --config cloudflare.config.json
doorman status --config cloudflare.config.jsondoorman sync --config cloudflare.config.json --provider cloudflareVerify in the Cloudflare dashboard under Security → WAF → Custom rules.
doorman sync --config cloudflare.config.json --provider cloudflare
doorman status --config cloudflare.config.json- Check Security → Events in the Cloudflare dashboard
- Watch for false positives in the first few days
- Adjust rules based on real traffic patterns
Regex patterns are converted to simpler operators on non-Enterprise plans:
// Vercel (regex)
{ "type": "path", "op": "re", "value": "\\.(php|asp|jsp)$" }
// Cloudflare (converted to multiple suffix conditions)
[
{ "type": "path", "op": "suf", "value": ".php" },
{ "type": "path", "op": "suf", "value": ".asp" },
{ "type": "path", "op": "suf", "value": ".jsp" }
]Review these conversions to ensure they still cover your intended traffic patterns.
Cloudflare doesn't have an equivalent to Vercel's environment condition. Options:
- Use separate config files per environment
- Use zone-based separation (different Cloudflare zones for staging vs production)
Rate limiting translates automatically, but review thresholds — Cloudflare's rate limiting behavior may differ slightly from Vercel's.
doorman backup --list
doorman backup --restore backup-file.json
doorman sync --provider vercelNot automated yet either (same doorman migrate roadmap item). Use the same manual approach as the forward migration: doorman download --provider cloudflare --config cloudflare-current.json, hand-translate to a Vercel-shaped config, then doorman validate/doorman sync --provider vercel.
Note: Cloudflare → Vercel translation has some limitations. Review the output carefully.
For large rule sets, consider migrating in phases:
- Critical security rules (bot blocking, IP blocking)
- Rate limiting rules
- Remaining rules
- Optimize for Cloudflare-specific features
- All critical rules active in Cloudflare
- IP blocking working correctly
- Rate limiting functioning as expected
- No false positives in legitimate traffic
- Cloudflare Analytics showing expected rule triggers
- Team trained on Cloudflare-specific workflows
- CI/CD pipelines updated for Cloudflare provider
- Backup procedures updated
- Cloudflare Setup — Credentials, environment, and initial configuration
- Configuration — Configuration file reference
- Commands Overview — Full CLI reference
Getting Started
Configuration
Commands
Guides