使用 Terraform 创建和管理小组件

使用 Terraform 将 Turnstile 小组件作为代码进行管理，以实现版本控制和自动化部署。

前提条件

在开始之前，您必须具备：

已安装 Terraform ↗
具有 Account:Turnstile:Edit 权限的 Cloudflare API 令牌
（可选）用于导入现有小组件的 cf-terraforming 工具

设置

1. 配置提供程序

创建一个 main.tf 文件。

terraform {
  required_providers {
    cloudflare = {
      source  = "cloudflare/cloudflare"
      version = "~> 4.0"
    }
  }
}

provider "cloudflare" {
  api_token = var.cloudflare_api_token
}

variable "cloudflare_api_token" {
  description = "Cloudflare API Token"
  type        = string
  sensitive   = true
}

variable "account_id" {
  description = "Cloudflare Account ID"
  type        = string
}

resource "cloudflare_turnstile_widget" "login_form" {
  account_id = var.account_id
  name       = "Login Form Widget"
  domains    = ["example.com", "www.example.com"]
  mode       = "managed"
  region     = "world"
}

resource "cloudflare_turnstile_widget" "api_protection" {
  account_id = var.account_id
  name       = "API Protection"
  domains    = ["api.example.com"]
  mode       = "invisible"
  region     = "world"
}

# 输出 sitekeys 以在您的应用程序中使用
output "login_sitekey" {
  value = cloudflare_turnstile_widget.login_form.sitekey
}

output "api_sitekey" {
  value = cloudflare_turnstile_widget.api_protection.sitekey
}

3. 环境变量

创建一个 .env 文件或设置环境变量。

export TF_VAR_cloudflare_api_token="your-api-token"
export TF_VAR_account_id="your-account-id"

Terraform 命令

初始化并编制计划

初始化 Terraformshell

terraform init

计划更改shell

terraform plan

应用配置shell

terraform apply

管理更改

更新小组件配置shell

terraform plan

应用更改shell

terraform apply

销毁小组件shell

terraform destroy

高级 Terraform 配置

多环境

locals {
  environments = {
    dev = {
      domains = ["dev.example.com"]
      mode    = "managed"
    }
    staging = {
      domains = ["staging.example.com"]
      mode    = "non_interactive"
    }
    prod = {
      domains = ["example.com", "www.example.com"]
      mode    = "invisible"
    }
  }
}

resource "cloudflare_turnstile_widget" "app_widget" {
  for_each = local.environments
  
  account_id = var.account_id
  name       = "App Widget - ${each.key}"
  domains    = each.value.domains
  mode       = each.value.mode
  region     = "world"
}

resource "cloudflare_turnstile_widget" "enterprise_widget" {
  account_id     = var.account_id
  name          = "Enterprise Form"
  domains       = ["enterprise.example.com"]
  mode          = "managed"
  region        = "world"
  offlabel      = true  # 去除 Cloudflare 品牌标识
  bot_fight_mode = true # 启用 bot fight mode
}

导入现有小组件

使用 cf-terraforming 导入现有小组件。

安装 cf-terraformingshell

go install github.com/cloudflare/cf-terraforming/cmd/cf-terraforming@latest

从现有小组件生成 Terraform 配置shell

cf-terraforming generate \
  --resource-type cloudflare_turnstile_widget \
  --account $ACCOUNT_ID

导入现有小组件shell

terraform import cloudflare_turnstile_widget.existing_widget \
  $ACCOUNT_ID/$WIDGET_SITEKEY