Cloudflare Migration

⚠️ Not yet available: doorman migrate does not exist in the current CLI. It's a spec'd, unbuilt roadmap item ("Phase 6" in RELEASE-2.0.md). Running any doorman migrate ... command shown below will fail with unknown command: migrate.

This page documents the planned automated migration workflow so you know what's coming. For migrating today, see Manual Migration (Available Now) below — you'll use doorman download, hand-edit the config using the Configuration reference and the compatibility matrix below, then doorman validate/doorman sync --provider cloudflare.

Guide for migrating firewall rules from Vercel Firewall to Cloudflare WAF using Doorman.

Before You Begin

• Complete the Cloudflare Setup guide first
• Back up your current Vercel configuration
• Review the compatibility matrix below — some features don't translate 1:1

Important: Always test in a staging environment before applying to production.

Compatibility Matrix

Manual Migration (Available Now)

Until doorman migrate ships, migrate by hand using commands that exist today:

1. Back Up and Download Your Current Vercel Config

doorman backup
doorman download --provider vercel --config vercel-current.json

2. Hand-Translate to a Cloudflare Config

Open vercel-current.json and, using the Configuration reference and the compatibility matrix above, write out the equivalent rules in a new file (e.g. cloudflare.config.json) with "provider": "cloudflare" and Cloudflare-shaped conditions/actions. This is the step the planned migrate command will eventually automate.

3. Validate and Preview

doorman validate --config cloudflare.config.json
doorman sync --config cloudflare.config.json --provider cloudflare --dry-run

4. Sync to a Staging Zone, Then Production

doorman sync --config cloudflare.config.json --provider cloudflare

Verify in the Cloudflare dashboard under Security → WAF → Custom rules, first against a staging zone/token if you have one, then repeat against production once you're confident.

Migration Steps (Planned — Not Yet Available)

The rest of this page describes the automated doorman migrate workflow once it ships (see the roadmap warning at the top of this page).

1. Back Up

doorman backup
doorman export --format json --output vercel-backup.json

2. Preview the Migration

doorman migrate --from vercel --to cloudflare --dry-run

This shows which rules will migrate perfectly, which will be modified, and which can't migrate. No changes are made.

3. Generate the Cloudflare Config

doorman migrate --from vercel --to cloudflare --output cloudflare.config.json

The generated file includes:

• Translated rules with Cloudflare provider settings
• Migration metadata (source, date, warnings)
• Notes on any rules that were modified

4. Review and Validate

Open cloudflare.config.json and review the translated rules, then:

doorman validate --config cloudflare.config.json
doorman status --config cloudflare.config.json

5. Test in Staging

doorman sync --config cloudflare.config.json --provider cloudflare

Verify in the Cloudflare dashboard under Security → WAF → Custom rules.

6. Deploy to Production

doorman sync --config cloudflare.config.json --provider cloudflare
doorman status --config cloudflare.config.json

7. Monitor

• Check Security → Events in the Cloudflare dashboard
• Watch for false positives in the first few days
• Adjust rules based on real traffic patterns

Handling Common Translation Changes

Regex → Simple Matching

Regex patterns are converted to simpler operators on non-Enterprise plans:

// Vercel (regex)
{ "type": "path", "op": "re", "value": "\\.(php|asp|jsp)$" }

// Cloudflare (converted to multiple suffix conditions)
[
  { "type": "path", "op": "suf", "value": ".php" },
  { "type": "path", "op": "suf", "value": ".asp" },
  { "type": "path", "op": "suf", "value": ".jsp" }
]

Review these conversions to ensure they still cover your intended traffic patterns.

Environment Conditions Removed

Cloudflare doesn't have an equivalent to Vercel's environment condition. Options:

• Use separate config files per environment
• Use zone-based separation (different Cloudflare zones for staging vs production)

Rate Limiting Format Differences

Rate limiting translates automatically, but review thresholds — Cloudflare's rate limiting behavior may differ slightly from Vercel's.

Rollback

Restore from Backup

doorman backup --list
doorman backup --restore backup-file.json
doorman sync --provider vercel

Reverse Migration

Not automated yet either (same doorman migrate roadmap item). Use the same manual approach as the forward migration: doorman download --provider cloudflare --config cloudflare-current.json, hand-translate to a Vercel-shaped config, then doorman validate/doorman sync --provider vercel.

Note: Cloudflare → Vercel translation has some limitations. Review the output carefully.

Gradual Migration

For large rule sets, consider migrating in phases:

1. Critical security rules (bot blocking, IP blocking)
2. Rate limiting rules
3. Remaining rules
4. Optimize for Cloudflare-specific features

Post-Migration Checklist

• All critical rules active in Cloudflare
• IP blocking working correctly
• Rate limiting functioning as expected
• No false positives in legitimate traffic
• Cloudflare Analytics showing expected rule triggers
• Team trained on Cloudflare-specific workflows
• CI/CD pipelines updated for Cloudflare provider
• Backup procedures updated

Related Pages

• Cloudflare Setup — Credentials, environment, and initial configuration
• Configuration — Configuration file reference
• Commands Overview — Full CLI reference