Doorman
DocsRule BuilderGet StartedGitHub

© 2026 griffen.codes

DiscordIssuesGitHub
    For Cloudflare

    Doorman for Cloudflare WAF

    The same rule, translated into a real Wirefilter expression automatically. No wirefilter syntax to learn by hand.

    npm install -g @gfargo/doorman

    Pass --provider cloudflare, or set "provider": "cloudflare" in your config.

    Real Wirefilter, not a black box

    path becomes http.request.uri.path, user_agent becomes http.user_agent. Every field maps to a documented Cloudflare expression.

    Bulk IP management

    Add CLOUDFLARE_ACCOUNT_ID and IP blocking uses Cloudflare's Lists API instead of one rule per address.

    One ruleset, fully versioned

    Cloudflare's custom rules live in a single ruleset. Doorman diffs it against your config and replaces it as a whole on sync.

    Deploy managed rulesets too

    Turn on the Cloudflare Managed Ruleset or OWASP CRS alongside your custom rules, with per-rule overrides, from the same config file.

    Environment variables

    export CLOUDFLARE_API_TOKEN="..."
    export CLOUDFLARE_ZONE_ID="..."
    export CLOUDFLARE_ACCOUNT_ID="..."  # optional, enables Lists API

    Nothing set yet? Doorman prompts you for credentials the first time it needs them.

    Then ship
    doorman sync --provider cloudflare
    Full Cloudflare setup guideSee all providers