Now supporting Fastly Next‑Gen WAF

Where W▲F meets .config

One config decides what gets through. Doorman enforces the same rules on Vercel Firewall, Cloudflare WAF, and Fastly Next‑Gen WAF.

npm install @gfargo/doorman

System status: ● Operational · Doorman v3.10.0

Live trafficdoorman‑managed

GET/wp-admin✗ BlockUA: SemrushBot/7.1 · rule: Restrict Admin Routes

GET/api/users✓ Allow203.0.113.42

GET/✓ AllowUA: Googlebot/2.1

GET/wp-login.php✗ BlockUA: MJ12bot · rule: Block Bad Bots

POST/checkout✓ Allow198.51.100.7

Supported providers

One rule. Three providers.

doorman is the source of truth. Vercel gets the rule as-is. Cloudflare gets a Wirefilter expression. Fastly gets a Next-Gen WAF rule.

Vercel

Firewall

{
  "id": "rule_block_bad_bots",
  "conditionGroup": [{
    "conditions": [
      { "type": "user_agent", "op": "sub", "value": "bot" }
    ]
  }],
  "action": { "mitigate": { "action": "deny" } }
}

Cloudflare

WAF

{
  "expression":
    "http.user_agent
    contains \"bot\"",
  "action": "block"
}

Fastly

Next‑Gen WAF

// translated, no wildcard needed
{
  "description": "Block Bad Bots",
  "conditions": [
    { "type": "single", "field": "user_agent",
      "operator": "contains", "value": "bot" }
  ],
  "actions": [{ "type": "block" }]
}

Commands

What doorman does

Every doorman command, explained. Copy any line straight into your terminal.

Log 01

Now shipping to Fastly

Cleared

The same status, diff, and sync workflow you already run for Vercel and Cloudflare, now pointed at Fastly Next‑Gen WAF. No new commands, no new config format, just a third provider.

npx @gfargo/doorman sync --provider fastly

Log 02

Sync changes

Cleared

Synchronize rule packs to Vercel, Cloudflare, and Fastly from the same config. Catch drift with provider-aware diffs before anything ships.

npx @gfargo/doorman sync

Log 03

Download configs

Cleared

Export deployed rules from each provider into versioned config files. Keep Vercel, Cloudflare, and Fastly in lockstep with Git history.

npx @gfargo/doorman download

Log 04

List rules & IPs

Cleared

Inspect deployed policies with human-friendly tables or JSON. Filter by provider, environment, and rule group in seconds.

npx @gfargo/doorman list

Log 05

Validate rules

Cleared

Validate rule syntax and provider-specific constraints before deployment. Ship with confidence knowing every provider will accept the change.

npx @gfargo/doorman validate

Log 06

Use templates

Cleared

Kickstart new protections with templates tuned for Vercel, Cloudflare, and Fastly. Customize and extend policy packs as your edge footprint grows.

npx @gfargo/doorman template

Log 07

Adopt existing rules

Cleared

Already have rules configured by hand in the Vercel dashboard? Download them into a versioned config, validate the result, and commit. No rework required.

npx @gfargo/doorman download

Rules enforced.

Bring Vercel, Cloudflare, and Fastly WAF automation into the same review process your team already trusts.

View docs Getting started Example configs

// translated, no wildcard needed { "description": "Block Bad Bots", "conditions": [ { "type": "single", "field": "user_agent", "operator": "contains", "value": "bot" } ], "actions": [{ "type": "block" }] }