mykiwi/mykiwi.blog · b9bda7a

⑂ b9bda7a

Migrate www redirect from Page Rules to Single Redirects

The Page Rules Edit permission only shows up in the API token builder
for account Super Administrators, which blocked provisioning with a
normal scoped token (Authentication error 10000). cloudflare_ruleset
with the http_request_dynamic_redirect phase does the same www -> apex
redirect and only needs Zone:Dynamic Redirect:Edit.

Romain Gautier committed 2026-09-18T19:58:17+02:00 Browse files

b9bda7a parent: 479f7e2

modified infra/README.md +2 -1

@@ -15,7 +15,8 @@ on.
15	15
16	16	Create a token at https://dash.cloudflare.com/profile/api-tokens (Custom
17	17	Token, scoped to the `mykiwi.blog` zone) with `Zone:DNS:Edit`,
18		-`Zone:Zone:Read`, and `Account:Cloudflare Pages:Edit`, then:
	18	+`Zone:Zone:Read`, `Zone:Dynamic Redirect:Edit`, and
	19	+`Account:Cloudflare Pages:Edit`, then:
19	20
20	21	```sh
21	22	export CLOUDFLARE_API_TOKEN=...

  Create a token at https://dash.cloudflare.com/profile/api-tokens (Custom
  Token, scoped to the `mykiwi.blog` zone) with `Zone:DNS:Edit`,
--`Zone:Zone:Read`, and `Account:Cloudflare Pages:Edit`, then:
++`Zone:Zone:Read`, `Zone:Dynamic Redirect:Edit`, and
++`Account:Cloudflare Pages:Edit`, then:
  ```sh
  export CLOUDFLARE_API_TOKEN=...

modified infra/main.tf +23 -8

@@ -56,15 +56,30 @@ resource "cloudflare_record" "www" {
56	56	proxied = true
57	57	}
58	58
59		-resource "cloudflare_page_rule" "www_redirect" {
60		- zone_id = data.cloudflare_zone.this.id
61		- target = "www.${var.zone_name}/*"
62		- priority = 1
	59	+# Page Rules would also do this but its Edit permission only shows up in
	60	+# the API token builder for account Super Administrators - Single Redirects
	61	+# (this resource) works with a normal scoped token (Zone:Dynamic Redirect:Edit).
	62	+resource "cloudflare_ruleset" "www_redirect" {
	63	+ zone_id = data.cloudflare_zone.this.id
	64	+ name = "www to apex redirect"
	65	+ description = "www.${var.zone_name} -> ${var.zone_name}, path preserved"
	66	+ kind = "zone"
	67	+ phase = "http_request_dynamic_redirect"
63	68
64		- actions {
65		- forwarding_url {
66		- url = "https://${var.zone_name}/$1"
67		- status_code = 301
	69	+ rules {
	70	+ ref = "www_redirect"
	71	+ description = "Redirect www to apex"
	72	+ expression = "(http.host eq \"www.${var.zone_name}\")"
	73	+ action = "redirect"
	74	+
	75	+ action_parameters {
	76	+ from_value {
	77	+ status_code = 301
	78	+ target_url {
	79	+ expression = "concat(\"https://${var.zone_name}\", http.request.uri.path)"
	80	+ }
	81	+ preserve_query_string = true
	82	+ }
68	83	}
69	84	}
70	85	}

    proxied = true
  }
--resource "cloudflare_page_rule" "www_redirect" {
++# Page Rules would also do this but its Edit permission only shows up in
--  zone_id  = data.cloudflare_zone.this.id
++# the API token builder for account Super Administrators - Single Redirects
--  target   = "www.${var.zone_name}/*"
++# (this resource) works with a normal scoped token (Zone:Dynamic Redirect:Edit).
--  priority = 1
++resource "cloudflare_ruleset" "www_redirect" {
++  zone_id     = data.cloudflare_zone.this.id
++  name        = "www to apex redirect"
++  description = "www.${var.zone_name} -> ${var.zone_name}, path preserved"
++  kind        = "zone"
++  phase       = "http_request_dynamic_redirect"
--  actions {
++  rules {
--    forwarding_url {
++    ref         = "www_redirect"
--      url         = "https://${var.zone_name}/$1"
++    description = "Redirect www to apex"
--      status_code = 301
++    expression  = "(http.host eq \"www.${var.zone_name}\")"
++    action      = "redirect"
++
++    action_parameters {
++      from_value {
++        status_code = 301
++        target_url {
++          expression = "concat(\"https://${var.zone_name}\", http.request.uri.path)"
++        }
++        preserve_query_string = true
++      }
      }
    }
  }