Skip to content

Cloudflare Setup

Jump to bottom
Griffen Fargo edited this page May 4, 2026 · 6 revisions

Cloudflare Setup

Complete guide for setting up Vercel Doorman with Cloudflare WAF.

Status: Cloudflare support is production-ready with comprehensive error handling, validation, and rule translation.

Prerequisites

  • Cloudflare account with at least one domain
  • Node.js 18+ installed
  • Vercel Doorman installed (npm install -g vercel-doorman)

Get Your Credentials

API Token

  1. Go to Cloudflare API Tokens
  2. Click Create Token → Custom token
  3. Set these permissions:
Permission Type Permission Access Level
Zone Zone Settings Read
Zone Zone Read
Zone Firewall Services Edit
Account Account Rulesets Edit (optional)
  1. Under Zone Resources, select your domain (or "All zones from an account" for multiple domains)
  2. Optionally set Client IP Filtering and TTL for extra security
  3. Click Continue to summary → Create Token
  4. Copy the token immediately — you won't see it again

Zone ID

  1. Go to Cloudflare Dashboard and select your domain
  2. On the Overview page, find Zone ID in the right sidebar
  3. Copy it

Account ID (Optional)

The Account ID enables the Cloudflare Lists API for efficient bulk IP management.

  1. On any Cloudflare dashboard page, find Account ID in the right sidebar
  2. Copy it

Without an Account ID, Doorman falls back to individual IP rules instead of Lists.

Configure Environment Variables

export CLOUDFLARE_API_TOKEN="your_api_token_here"
export CLOUDFLARE_ZONE_ID="your_zone_id_here"
export CLOUDFLARE_ACCOUNT_ID="your_account_id_here"  # Optional

Or create a .env file in your project root:

CLOUDFLARE_API_TOKEN=your_api_token_here
CLOUDFLARE_ZONE_ID=your_zone_id_here
CLOUDFLARE_ACCOUNT_ID=your_account_id_here

Important: Add .env to your .gitignore to avoid committing secrets.

Initialize Your Project

vercel-doorman init --provider cloudflare --interactive

This validates your credentials, tests API connectivity, and creates a configuration file.

Or create .doorman.json manually:

{
  "$schema": "https://doorman.griffen.codes/schema.json",
  "provider": "cloudflare",
  "providers": {
    "cloudflare": {
      "zoneId": "your_zone_id",
      "accountId": "your_account_id"
    }
  },
  "rules": [],
  "ips": []
}

Add Your First Rules

Add a template or write rules by hand:

# Add bot protection
vercel-doorman template add bad-bots --provider cloudflare

# Add AI bot blocking
vercel-doorman template add ai-bots --provider cloudflare

# Add WordPress protection
vercel-doorman template add wordpress --provider cloudflare

Deploy

# Preview what will change
vercel-doorman diff --provider cloudflare

# Deploy rules
vercel-doorman sync --provider cloudflare

# Verify deployment
vercel-doorman status --provider cloudflare

Day-to-Day Commands

vercel-doorman status --provider cloudflare    # Check sync status and health
vercel-doorman list --provider cloudflare      # List deployed rules
vercel-doorman diff --provider cloudflare      # Preview pending changes
vercel-doorman sync --provider cloudflare      # Deploy changes
vercel-doorman validate                        # Validate config syntax
vercel-doorman backup                          # Create a backup
vercel-doorman watch --provider cloudflare     # Auto-sync on file changes

Advanced Configuration

Multiple Zones

Create separate config files per zone:

vercel-doorman init --provider cloudflare --config zone1.config.json
vercel-doorman init --provider cloudflare --config zone2.config.json

Account-Level Rules

With an Account ID, you can create rules that apply across all zones:

{
  "providers": {
    "cloudflare": {
      "accountId": "your_account_id",
      "useAccountRules": true
    }
  }
}

Cloudflare Plan Limits

Plan Custom Rules
Free 5
Pro 20
Business 100
Enterprise Unlimited

Troubleshooting

"Invalid API Token"

  • Verify the token hasn't expired
  • Confirm it has Zone: Firewall Services: Edit permission
  • Test manually: 
    curl -X GET "https://api.cloudflare.com/client/v4/user/tokens/verify" \
  -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN"

"Zone Not Found"

  • Double-check the Zone ID in the Cloudflare dashboard
  • Ensure the token has access to that zone
  • List accessible zones: 
    curl -X GET "https://api.cloudflare.com/client/v4/zones" \
  -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN" | jq '.result[] | {name, id}'

Rules Not Appearing

  • Check Security → WAF → Custom rules in the Cloudflare dashboard
  • Run vercel-doorman sync --provider cloudflare --verbose for detailed output
  • Look for translation warnings — complex conditions may have been simplified

Rate Limit Errors (429)

Doorman has built-in retry logic, but if you hit persistent rate limits:

  • Avoid running multiple sync operations simultaneously
  • Wait 60 seconds and retry

IP Blocking Not Working

  • Ensure IPs use CIDR notation (192.168.1.1/32 not 192.168.1.1)
  • Provide an Account ID to enable the more efficient Lists API
  • Check rule priority in the Cloudflare dashboard

Security Best Practices

  1. Never commit API tokens — use environment variables or secret management
  2. Use minimum permissions — only grant what Doorman needs
  3. Set token expiration — rotate tokens regularly
  4. Test in staging first — create rules disabled, enable after testing
  5. Create backups before major changes
  6. Monitor Cloudflare Analytics (Security → Events) for rule effectiveness

Related Pages

Getting Started

Configuration

Commands

Guides

Clone this wiki locally