使用 Terraform 进行配置

可以使用 Cloudflare Terraform 提供商中的 cloudflare_connectivity_directory_service ↗ 资源将 VPC Services 作为基础设施进行管理。

这直接映射到连接目录 — 仪表板和 Wrangler CLI 也是使用这个底层 API 来创建和管理 VPC Services 的。无论服务如何创建，都适用相同的 VPC Service 配置字段（类型、主机、端口、隧道 ID）。

VPC Service 资源

cloudflare_connectivity_directory_service 资源在连接目录中创建一个 VPC Service。每个资源对应一个 Worker 可以绑定到的 VPC Service 条目。

基于主机名的配置

当使用主机名时，提供带有 resolver_network 块的 host.hostname。这类似于基于主机名的 JSON 配置示例。

resource "cloudflare_connectivity_directory_service" "my_private_api" {
  account_id = var.account_id
  name       = "my-private-api"
  type       = "http"
  http_port  = 80
  https_port = 443

  host = {
    hostname = "internal-api.example.com"
    resolver_network = {
      tunnel_id = var.tunnel_id
    }
  }
}

要在您的私有网络中使用自定义 DNS 解析器，添加 resolver_ips：

resource "cloudflare_connectivity_directory_service" "my_private_api" {
  account_id = var.account_id
  name       = "my-private-api"
  type       = "http"

  host = {
    hostname = "internal-api.example.com"
    resolver_network = {
      tunnel_id    = var.tunnel_id
      resolver_ips = ["10.0.0.53"]
    }
  }
}

基于 IP 的配置

当使用 IP 地址时，提供带有 network 块的 host.ipv4 和/或 host.ipv6。这类似于基于 IP 的 JSON 配置示例。

resource "cloudflare_connectivity_directory_service" "my_private_api" {
  account_id = var.account_id
  name       = "my-private-api"
  type       = "http"
  http_port  = 8080
  https_port = 8443

  host = {
    ipv4 = "10.0.1.50"
    ipv6 = "fe80::1"
    network = {
      tunnel_id = var.tunnel_id
    }
  }
}

TCP 服务配置

对于 TCP 服务（例如，数据库），设置 type = "tcp" 并提供 tcp_port。您可以选择指定 postgresql 或 mysql 的 app_protocol。

resource "cloudflare_connectivity_directory_service" "my_database" {
  account_id   = var.account_id
  name         = "my-postgres-db"
  type         = "tcp"
  tcp_port     = 5432
  app_protocol = "postgresql"

  host = {
    ipv4 = "10.0.0.5"
    network = {
      tunnel_id = var.tunnel_id
    }
  }
}

TLS 证书验证

要配置到源站连接的 TLS 证书验证模式，添加 tls_settings 块：

resource "cloudflare_connectivity_directory_service" "my_database" {
  account_id   = var.account_id
  name         = "my-postgres-db"
  type         = "tcp"
  tcp_port     = 5432
  app_protocol = "postgresql"

  host = {
    ipv4 = "10.0.0.5"
    network = {
      tunnel_id = var.tunnel_id
    }
  }

  tls_settings = {
    cert_verification_mode = "verify_ca"
  }
}

cert_verification_mode 的有效值是：

verify_full（默认）
verify_ca
disabled

有关详情，请参阅 TLS 证书验证模式。

端口配置

对于 HTTP 服务，端口是可选的，默认为 80 (HTTP) 和 443 (HTTPS)。要强制使用单一方案，只提供 http_port 或 https_port 中的一个。参阅 VPC Service 配置以了解方案执行和端口行为是如何工作的。

对于 TCP 服务，tcp_port 是必需的。

Workers 绑定配置

VPC Service 存在后，在 cloudflare_worker_version 资源的 bindings 数组中使用 vpc_service 绑定类型将其绑定到 Worker。这相当于 Wrangler 配置中的 vpc_services 数组。

resource "cloudflare_worker_version" "my_worker_version" {
  account_id         = var.account_id
  worker_id          = cloudflare_worker.my_worker.id
  compatibility_date = "2025-02-21" # Set this to today's date
  main_module        = "worker.js"

  modules = [{
    name         = "worker.js"
    content_type = "application/javascript+module"
    content_file = "build/worker.js"
  }]

  bindings = [{
    type       = "vpc_service"
    name       = "PRIVATE_API"
    service_id = cloudflare_connectivity_directory_service.my_private_api.service_id
  }]
}

可以在同一个 Worker 中添加多个 VPC Service 绑定：

bindings = [
  {
    type       = "vpc_service"
    name       = "PRIVATE_API"
    service_id = cloudflare_connectivity_directory_service.api.service_id
  },
  {
    type       = "vpc_service"
    name       = "PRIVATE_DATABASE"
    service_id = cloudflare_connectivity_directory_service.database.service_id
  }
]

Worker 代码通过 env.PRIVATE_API.fetch() 和 env.PRIVATE_DATABASE.fetch() 访问每个绑定，如 Workers Binding API 中所述。

有关使用 Terraform 管理 Workers 和绑定的更多详细信息，请参阅 Workers Infrastructure as Code。

数据源

Terraform 提供商包含数据源，用于读取现有的 VPC Services，而无需管理其生命周期。

查找单个 VPC Service

data "cloudflare_connectivity_directory_service" "existing" {
  account_id = var.account_id
  service_id = "182bd5e5-6e1a-4fe4-a799-aa6d9a6ab26e"
}

这对于绑定到在 Terraform 配置之外管理（例如，通过仪表板或 Wrangler CLI 创建）的 VPC Service 很有用。

列出 VPC Services

data "cloudflare_connectivity_directory_services" "all_http" {
  account_id = var.account_id
  type       = "http"
}

data "cloudflare_connectivity_directory_services" "all_tcp" {
  account_id = var.account_id
  type       = "tcp"
}

资源模式参考

resource "cloudflare_connectivity_directory_service" "example" {
  # Required
  account_id = "your-account-id"        # Account identifier
  name       = "my-private-api"         # Human-readable name
  type       = "http"                   # Service type: "http" or "tcp"

  # HTTP-specific (optional, defaults to 80/443)
  http_port  = 80                       # HTTP port
  https_port = 443                      # HTTPS port

  # TCP-specific (tcp_port is required when type = "tcp")
  # tcp_port     = 5432                 # TCP port
  # app_protocol = "postgresql"         # Optional: "postgresql" or "mysql"

  host = {
    # Use hostname OR ipv4/ipv6, not both

    # Option A: Hostname-based
    hostname = "internal-api.example.com"
    resolver_network = {
      tunnel_id    = "tunnel-uuid"      # Required — Cloudflare Tunnel ID
      resolver_ips = ["10.0.0.53"]      # Optional — custom DNS resolver IPs
    }

    # Option B: IP-based
    # ipv4 = "10.0.1.50"               # IPv4 address
    # ipv6 = "fe80::1"                 # IPv6 address
    # network = {
    #   tunnel_id = "tunnel-uuid"      # Required — Cloudflare Tunnel ID
    # }
  }

  # Optional TLS settings
  # tls_settings = {
  #   cert_verification_mode = "verify_full"  # "verify_full", "verify_ca", or "disabled"
  # }

  # Read-only (computed by the API)
  # id         — Terraform resource ID
  # service_id — VPC Service ID (use this for Worker bindings)
  # created_at — Creation timestamp
  # updated_at — Last update timestamp
}

有关完整模式，请参阅 Terraform registry 文档 ↗。