Allow creating mixed type page_rules and firewall_rules

docs/terraform.md

@@ -3,7 +3,7 @@
 
 | Name | Version |
 |------|---------|
-| <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 1.0.0 |
+| <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 1.3.0 |
 | <a name="requirement_cloudflare"></a> [cloudflare](#requirement\_cloudflare) | >= 3.23 |
 | <a name="requirement_time"></a> [time](#requirement\_time) | >= 0.8 |
 
@@ -49,7 +49,7 @@
 | <a name="input_descriptor_formats"></a> [descriptor\_formats](#input\_descriptor\_formats) | Describe additional descriptors to be output in the `descriptors` output map.<br>Map of maps. Keys are names of descriptors. Values are maps of the form<br>`{<br>   format = string<br>   labels = list(string)<br>}`<br>(Type is `any` so the map values can later be enhanced to provide additional options.)<br>`format` is a Terraform format string to be passed to the `format()` function.<br>`labels` is a list of labels, in order, to pass to `format()` function.<br>Label values will be normalized before being passed to `format()` so they will be<br>identical to how they appear in `id`.<br>Default is `{}` (`descriptors` output will be empty). | `any` | `{}` | no |
 | <a name="input_enabled"></a> [enabled](#input\_enabled) | Set to false to prevent the module from creating any resources | `bool` | `null` | no |
 | <a name="input_environment"></a> [environment](#input\_environment) | ID element. Usually used for region e.g. 'uw2', 'us-west-2', OR role 'prod', 'staging', 'dev', 'UAT' | `string` | `null` | no |
-| <a name="input_firewall_rules"></a> [firewall\_rules](#input\_firewall\_rules) | paused:<br>  Whether this filter is currently paused.<br>expression:<br>  The filter expression to be used.<br>description:<br>  A note that you can use to describe the purpose of the filter and rule.<br>ref:<br>  Short reference tag to quickly select related rules.<br>action:<br>  The action to apply to a matched request.<br>  Possible values: `block`, `challenge`, `allow`, `js_challenge`, `bypass`.<br>priority:<br>  The priority of the rule to allow control of processing order.<br>  A lower number indicates high priority.<br>  If not provided, any rules with a priority will be sequenced before those without.<br>products:<br>  List of products to bypass for a request when the bypass action is used.<br>  Possible values: `zoneLockdown`, `uaBlock`, `bic`, `hot`, `securityLevel`, `rateLimit`, `waf`. | `list(any)` | `null` | no |
+| <a name="input_firewall_rules"></a> [firewall\_rules](#input\_firewall\_rules) | paused:<br>  Whether this filter is currently paused.<br>expression:<br>  The filter expression to be used.<br>description:<br>  A note that you can use to describe the purpose of the filter and rule.<br>ref:<br>  Short reference tag to quickly select related rules.<br>action:<br>  The action to apply to a matched request.<br>  Possible values: `block`, `challenge`, `allow`, `js_challenge`, `bypass`.<br>priority:<br>  The priority of the rule to allow control of processing order.<br>  A lower number indicates high priority.<br>  If not provided, any rules with a priority will be sequenced before those without.<br>products:<br>  List of products to bypass for a request when the bypass action is used.<br>  Possible values: `zoneLockdown`, `uaBlock`, `bic`, `hot`, `securityLevel`, `rateLimit`, `waf`. | <pre>list(object({<br>    action      = string<br>    description = string<br>    expression  = string<br>    paused      = optional(bool)<br>    priority    = optional(number)<br>    products    = optional(list(string))<br>    ref         = optional(string)<br>  }))</pre> | `null` | no |
 | <a name="input_healthchecks"></a> [healthchecks](#input\_healthchecks) | A list of maps of Health Checks rules.<br>The values of map is fully compliant with `cloudflare_healthcheck` resource.<br>To get more info see https://registry.terraform.io/providers/cloudflare/cloudflare/latest/docs/resources/healthcheck | `list(any)` | `null` | no |
 | <a name="input_id_length_limit"></a> [id\_length\_limit](#input\_id\_length\_limit) | Limit `id` to this many characters (minimum 6).<br>Set to `0` for unlimited length.<br>Set to `null` for keep the existing setting, which defaults to `0`.<br>Does not affect `id_full`. | `number` | `null` | no |
 | <a name="input_jump_start"></a> [jump\_start](#input\_jump\_start) | Whether to scan for DNS records on creation. | `bool` | `false` | no |
@@ -59,7 +59,7 @@
 | <a name="input_labels_as_tags"></a> [labels\_as\_tags](#input\_labels\_as\_tags) | Set of labels (ID elements) to include as tags in the `tags` output.<br>Default is to include all labels.<br>Tags with empty values will not be included in the `tags` output.<br>Set to `[]` to suppress all generated tags.<br>**Notes:**<br>  The value of the `name` tag, if included, will be the `id`, not the `name`.<br>  Unlike other `null-label` inputs, the initial setting of `labels_as_tags` cannot be<br>  changed in later chained modules. Attempts to change it will be silently ignored. | `set(string)` | <pre>[<br>  "default"<br>]</pre> | no |
 | <a name="input_name"></a> [name](#input\_name) | ID element. Usually the component or solution name, e.g. 'app' or 'jenkins'.<br>This is the only ID element not also included as a `tag`.<br>The "name" tag is set to the full `id` string. There is no tag with the value of the `name` input. | `string` | `null` | no |
 | <a name="input_namespace"></a> [namespace](#input\_namespace) | ID element. Usually an abbreviation of your organization name, e.g. 'eg' or 'cp', to help ensure generated IDs are globally unique | `string` | `null` | no |
-| <a name="input_page_rules"></a> [page\_rules](#input\_page\_rules) | A list of maps of Page Rules.<br>The values of map is fully compliant with `cloudflare_page_rule` resource.<br>To get more info see https://registry.terraform.io/providers/cloudflare/cloudflare/latest/docs/resources/cloudflare_page_rule | `list(any)` | `null` | no |
+| <a name="input_page_rules"></a> [page\_rules](#input\_page\_rules) | A list of maps of Page Rules.<br>The values of map is fully compliant with `cloudflare_page_rule` resource.<br>To get more info see https://registry.terraform.io/providers/cloudflare/cloudflare/latest/docs/resources/page_rule | <pre>list(object({<br>    target   = string<br>    priority = optional(number)<br>    status   = optional(string)<br>    actions = object({<br>      always_use_https         = optional(bool)<br>      automatic_https_rewrites = optional(string)<br>      browser_cache_ttl        = optional(number)<br>      browser_check            = optional(string)<br>      bypass_cache_on_cookie   = optional(string)<br>      cache_by_device_type     = optional(string)<br>      cache_deception_armor    = optional(string)<br>      cache_key_fields = optional(object({<br>        cookie = optional(object({<br>          check_presence = optional(list(string))<br>          include        = optional(list(string))<br>        }))<br>        header = optional(object({<br>          check_presence = optional(list(string))<br>          exclude        = optional(list(string))<br>          include        = optional(list(string))<br>        }))<br>        host = object({<br>          resolved = optional(bool)<br>        })<br>        query_string = object({<br>          exclude = optional(list(string))<br>          include = optional(list(string))<br>          ignore  = optional(bool)<br>        })<br>      }))<br>      cache_level     = optional(string)<br>      cache_on_cookie = optional(string)<br>      cache_ttl_by_status = optional(object({<br>        codes = string<br>        ttl   = number<br>      }))<br>      disable_apps           = optional(bool)<br>      disable_performance    = optional(bool)<br>      disable_railgun        = optional(bool)<br>      disable_security       = optional(bool)<br>      disable_zaraz          = optional(bool)<br>      edge_cache_ttl         = optional(number)<br>      email_obfuscation      = optional(string)<br>      explicit_cache_control = optional(string)<br>      forwarding_url = optional(object({<br>        url         = string<br>        status_code = number<br>      }))<br>      host_header_override = optional(string)<br>      ip_geolocation       = optional(string)<br>      minify = optional(object({<br>        css  = string<br>        html = string<br>        js   = string<br>      }))<br>      mirage                      = optional(string)<br>      opportunistic_encryption    = optional(string)<br>      origin_error_page_pass_thru = optional(string)<br>      polish                      = optional(string)<br>      resolve_override            = optional(string)<br>      respect_strong_etag         = optional(string)<br>      response_buffering          = optional(string)<br>      rocket_loader               = optional(string)<br>      security_level              = optional(string)<br>      server_side_exclude         = optional(string)<br>      sort_query_string_for_cache = optional(string)<br>      ssl                         = optional(string)<br>      true_client_ip_header       = optional(string)<br>      waf                         = optional(string)<br>    })<br>  }))</pre> | `null` | no |
 | <a name="input_paused"></a> [paused](#input\_paused) | Whether this zone is paused (traffic bypasses Cloudflare) | `bool` | `false` | no |
 | <a name="input_plan"></a> [plan](#input\_plan) | The name of the commercial plan to apply to the zone. Possible values: `free`, `pro`, `business`, `enterprise` | `string` | `"free"` | no |
 | <a name="input_records"></a> [records](#input\_records) | name:<br>  The name of the record.<br>type:<br>  The type of the record.<br>value:<br>  The value of the record.<br>ttl:<br>  The TTL of the record.<br>  Default value: 1.<br>priority:<br>  The priority of the record.<br>proxied:<br>  Whether the record gets Cloudflare's origin protection.<br>  Default value: false. | `list(any)` | `[]` | no |

firewall.tf

@@ -5,7 +5,7 @@ locals {
       rule.action,
       md5(rule.expression),
     ) => rule
-  } : {}
+  } : null
 }
 
 resource "cloudflare_filter" "default" {

page_rule.tf

@@ -2,7 +2,7 @@ locals {
   page_rules = module.this.enabled && var.page_rules != null ? {
     for pr in flatten(var.page_rules) :
     pr.target => pr
-  } : {}
+  } : null
 }
 
 resource "cloudflare_page_rule" "default" {
@@ -27,6 +27,7 @@ resource "cloudflare_page_rule" "default" {
     disable_performance         = lookup(each.value.actions, "disable_performance", false)
     disable_railgun             = lookup(each.value.actions, "disable_railgun", false)
     disable_security            = lookup(each.value.actions, "disable_security", false)
+    disable_zaraz               = lookup(each.value.actions, "disable_zaraz", false)
     edge_cache_ttl              = lookup(each.value.actions, "edge_cache_ttl", null)
     email_obfuscation           = lookup(each.value.actions, "email_obfuscation", null)
     explicit_cache_control      = lookup(each.value.actions, "explicit_cache_control", null)

variables.tf

@@ -98,7 +98,15 @@ variable "healthchecks" {
 }
 
 variable "firewall_rules" {
-  type        = list(any)
+  type = list(object({
+    action      = string
+    description = string
+    expression  = string
+    paused      = optional(bool)
+    priority    = optional(number)
+    products    = optional(list(string))
+    ref         = optional(string)
+  }))
   default     = null
   description = <<-DOC
     paused:
@@ -123,11 +131,82 @@ variable "firewall_rules" {
 }
 
 variable "page_rules" {
-  type        = list(any)
+  type = list(object({
+    target   = string
+    priority = optional(number)
+    status   = optional(string)
+    actions = object({
+      always_use_https         = optional(bool)
+      automatic_https_rewrites = optional(string)
+      browser_cache_ttl        = optional(number)
+      browser_check            = optional(string)
+      bypass_cache_on_cookie   = optional(string)
+      cache_by_device_type     = optional(string)
+      cache_deception_armor    = optional(string)
+      cache_key_fields = optional(object({
+        cookie = optional(object({
+          check_presence = optional(list(string))
+          include        = optional(list(string))
+        }))
+        header = optional(object({
+          check_presence = optional(list(string))
+          exclude        = optional(list(string))
+          include        = optional(list(string))
+        }))
+        host = object({
+          resolved = optional(bool)
+        })
+        query_string = object({
+          exclude = optional(list(string))
+          include = optional(list(string))
+          ignore  = optional(bool)
+        })
+      }))
+      cache_level     = optional(string)
+      cache_on_cookie = optional(string)
+      cache_ttl_by_status = optional(object({
+        codes = string
+        ttl   = number
+      }))
+      disable_apps           = optional(bool)
+      disable_performance    = optional(bool)
+      disable_railgun        = optional(bool)
+      disable_security       = optional(bool)
+      disable_zaraz          = optional(bool)
+      edge_cache_ttl         = optional(number)
+      email_obfuscation      = optional(string)
+      explicit_cache_control = optional(string)
+      forwarding_url = optional(object({
+        url         = string
+        status_code = number
+      }))
+      host_header_override = optional(string)
+      ip_geolocation       = optional(string)
+      minify = optional(object({
+        css  = string
+        html = string
+        js   = string
+      }))
+      mirage                      = optional(string)
+      opportunistic_encryption    = optional(string)
+      origin_error_page_pass_thru = optional(string)
+      polish                      = optional(string)
+      resolve_override            = optional(string)
+      respect_strong_etag         = optional(string)
+      response_buffering          = optional(string)
+      rocket_loader               = optional(string)
+      security_level              = optional(string)
+      server_side_exclude         = optional(string)
+      sort_query_string_for_cache = optional(string)
+      ssl                         = optional(string)
+      true_client_ip_header       = optional(string)
+      waf                         = optional(string)
+    })
+  }))
   default     = null
   description = <<-DOC
   A list of maps of Page Rules.
   The values of map is fully compliant with `cloudflare_page_rule` resource.
-  To get more info see https://registry.terraform.io/providers/cloudflare/cloudflare/latest/docs/resources/cloudflare_page_rule
+  To get more info see https://registry.terraform.io/providers/cloudflare/cloudflare/latest/docs/resources/page_rule
   DOC
 }

versions.tf

@@ -1,5 +1,5 @@
 terraform {
-  required_version = ">= 1.0.0"
+  required_version = ">= 1.3.0"
 
   required_providers {
     cloudflare = {