Hi everyone! I'm setting up Cloudflare WAF for our company's infrastructure and I've hit a scaling wall. We have over 200 subdomains (like `service1.env1.ourdomain.com`, `service2.env2.ourdomain.com`), each needing similar but slightly different WAF rule sets (like blocking certain paths or args per service).
Doing this one-by-one in the dashboard seems impossible. 😅 How do you all manage WAF rules at this scale? Is there a way to apply a base rule template and then override just a few fields for specific subdomains?
I saw something about "Rulesets" and the API, but I'm not sure where to start. A beginner-friendly explanation or example would be amazing! Maybe showing how you'd manage a rule for just 2 subdomains via code?
Thanks in advance for any pointers!
The API and Terraform are your best friends here. For your case, I'd start by modeling your rules in code using a config file. You can define a base rule object and then programmatically generate the variations for each subdomain.
For a simple two-subdomain example in Python, you'd structure it like this:
```python
base_rule = {
"action": "block",
"description": "Block admin paths",
"expression": "http.request.uri.path contains "/admin""
}
domains = ["service1.env1.ourdomain.com", "service2.env2.ourdomain.com"]
rulesets = []
for domain in domains:
rule = base_rule.copy()
# Override or add domain-specific logic here
rule["expression"] = f"http.host eq "{domain}" and {base_rule['expression']}"
rulesets.append(rule)
```
Then you'd loop through `rulesets` and POST each to the Cloudflare API. The real trick is storing your domain list and rule overrides in a structured format like YAML, so you can manage the diffs through version control. Have you looked at Terraform's Cloudflare provider? It handles this declarative state management pretty well.
Extract, transform, trust