$ show sefinek/Cloudflare-WAF-Expressions
This is a Node.js automation tool that deploys and maintains Cloudflare Web Application Firewall (WAF) custom rules across all zones in a Cloudflare account. It runs as a long-lived daemon (via PM2) with scheduled cron jobs: one fetches the latest expressions from the repository (git pull) and another updates the WAF rules via the Cloudflare Rulesets API. The service parses rule expressions from a markdown file, applies user configuration (PHP/WordPress support, custom allowlist/blocklist per zone, external IP threat feeds from SniffCat and AbuseIPDB), and syncs the resulting custom rules and IP lists to Cloudflare. It includes robust error notification via email and Discord webhooks with batched alert delivery. The codebase is well-structured, thoroughly tested (Jest), and actively maintained with frequent updates.
The LLM identified 3 files worth highlighting for reuse:
Implements a batched alert queue with independent per-channel retry logic for email and Discord notifications. Alerts are buffered and flushed after a configurable delay (30s) or on process shutdown. If one delivery channel fails, it retries only that channel without resending to the already-successful channel. The module also exports a `flush()` function for graceful shutdown and a `notify()` for update-type messages. This pattern is reusable in any Node.js service needing reliable multi-channel notification with atomic batching.
Exports pure utility constants and functions for managing Cloudflare WAF custom rules: the phase name, managed rule description detection (isManagedDescription, isPartDescription), rule cap per plan, expression length limit, and a helper to build per-zone expressions from scoped allowlist/blocklist entries. This module is self-contained and could be extracted as a standalone library for any Cloudflare WAF automation project.
A clean, generic parser for text-based lists that support per-zone scoping with `[zone.com]` and `[!zone.com]` prefixes. It reads a file, skips comments, and returns an array of entries with `expression`, `zone`, and `exclude` fields. This pattern is reusable for any configuration file where rules need to be applied or excluded per entity, not just Cloudflare zones.