The same rule, translated into a real Wirefilter expression automatically. No wirefilter syntax to learn by hand.
npm install -g @gfargo/doorman
Pass --provider cloudflare, or set "provider": "cloudflare" in your config.
path becomes http.request.uri.path, user_agent becomes http.user_agent. Every field maps to a documented Cloudflare expression.
Add CLOUDFLARE_ACCOUNT_ID and IP blocking uses Cloudflare's Lists API instead of one rule per address.
Cloudflare's custom rules live in a single ruleset. Doorman diffs it against your config and replaces it as a whole on sync.
Turn on the Cloudflare Managed Ruleset or OWASP CRS alongside your custom rules, with per-rule overrides, from the same config file.
export CLOUDFLARE_API_TOKEN="..." export CLOUDFLARE_ZONE_ID="..." export CLOUDFLARE_ACCOUNT_ID="..." # optional, enables Lists API
Nothing set yet? Doorman prompts you for credentials the first time it needs them.
doorman sync --provider cloudflare