Where W▲F meets .config
One config decides what gets through. Doorman enforces the same rules on Vercel Firewall, Cloudflare WAF, and Fastly Next‑Gen WAF.
npm install -g @gfargo/doorman
System status: ● Operational · Doorman v3.10.1
Illustrative requests, not a live feed. Real output is in the commands below.
One rule. Three providers.
doorman is the source of truth. Vercel gets the rule as-is. Cloudflare gets a Wirefilter expression. Fastly gets a Next-Gen WAF rule.
Vercel
Firewall
{
"id": "rule_block_bad_bots",
"conditionGroup": [{
"conditions": [
{ "type": "user_agent", "op": "sub", "value": "bot" }
]
}],
"action": { "mitigate": { "action": "deny" } }
}Cloudflare
WAF
{
"expression":
"http.user_agent
contains \"bot\"",
"action": "block"
}Fastly
Next‑Gen WAF
// translated, no wildcard needed
{
"description": "Block Bad Bots",
"conditions": [
{ "type": "single", "field": "user_agent",
"operator": "contains", "value": "bot" }
],
"actions": [{ "type": "block" }]
}What doorman does
Every doorman command, explained. Copy any line straight into your terminal.
Now shipping to Fastly
The same status, diff, and sync workflow you already run for Vercel and Cloudflare, now pointed at Fastly Next‑Gen WAF. Same commands, same config format. Just a third provider.
npx @gfargo/doorman sync --provider fastly
Sync changes
Synchronize rule packs to Vercel, Cloudflare, and Fastly from the same config. Catch drift with provider-aware diffs before anything ships.
npx @gfargo/doorman sync
Download configs
Export deployed rules from each provider into versioned config files. Keep Vercel, Cloudflare, and Fastly in lockstep with Git history.
npx @gfargo/doorman download
List rules & IPs
Inspect deployed policies with human-friendly tables or JSON. Filter by provider, environment, and rule group in seconds.
npx @gfargo/doorman list
Validate rules
Validate rule syntax and provider-specific constraints before deployment. Every provider accepts the result before you deploy.
npx @gfargo/doorman validate
Use templates
Start new protections from templates tuned for Vercel, Cloudflare, and Fastly. Customize and extend policy packs as you add providers.
npx @gfargo/doorman template
Adopt existing rules
Already have rules configured by hand in the Vercel dashboard? Download them into a versioned config, validate the result, and commit. No rework required.
npx @gfargo/doorman download
Set up your WAF in four steps.
Install, initialize, connect your provider, ship. The steps don't change whether you're on Vercel, Cloudflare, or Fastly, only the credentials do.
Install
One package, works with any of the three providers below.
npm install -g @gfargo/doorman
Initialize
Scaffolds a .doorman.json in your project.
doorman init
Connect your provider
The variable names change, the shape doesn't. A token plus one or two IDs, stored however you already manage secrets.
export VERCEL_TOKEN="..." export VERCEL_PROJECT_ID="..." export VERCEL_TEAM_ID="..." # optional
Nothing set yet? Doorman prompts you for credentials the first time it needs them.
Ship it
Same command, whichever provider you connected.
doorman sync
One skill. Any coding agent.
Doorman ships as an Agent Skill: a packaged set of instructions your coding agent reads before it touches a firewall rule. Install it once, then ask in plain English. Your agent runs the right doorman commands instead of guessing at flags.
Works with Claude Code, Cursor, Codex, and other Agent Skills‑compatible tools.
npx skills add gfargo/skills --skill doorman
> Block bad bots hitting /wp-login.php Using skill: doorman $ doorman add --interactive $ doorman validate $ doorman sync ✓ Added rule "Block Bad Bots" ✓ Config valid ✓ Synced to Vercel Firewall
Firewall rules are infrastructure. They belong in version control, reviewed in pull requests, and rolled back with git revert, not edited by hand in a dashboard nobody diffs.
Rules enforced.
Bring Vercel, Cloudflare, and Fastly WAF automation into the same review process you already use.