cloudflare

package
v0.1.7 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: May 22, 2026 License: MIT Imports: 14 Imported by: 0

Documentation

Overview

Package cloudflare provides Cloudflare API client for labelgate.

Index

Constants

This section is empty.

Variables

This section is empty.

Functions

This section is empty.

Types

type AccessClient 

type AccessClient struct {
	// contains filtered or unexported fields
}

AccessClient provides Cloudflare Zero Trust Access management operations.

func NewAccessClient 

func NewAccessClient(client *Client, accountID string) *AccessClient

NewAccessClient creates a new Access client wrapper.

func (*AccessClient) CheckAccessPermissions 

func (a *AccessClient) CheckAccessPermissions(ctx context.Context) error

CheckAccessPermissions probes the Cloudflare Access API to verify the token has sufficient permissions. It does a lightweight List Applications call. Returns nil if permissions are valid, error with details otherwise.

func (*AccessClient) DeleteAccessApplication 

func (a *AccessClient) DeleteAccessApplication(ctx context.Context, appID string) error

DeleteAccessApplication deletes an Access Application and its linked policies.

func (*AccessClient) EnsureAccessForHostname 

func (a *AccessClient) EnsureAccessForHostname(ctx context.Context, hostname string, policyDef *types.AccessPolicyDef, existingAppID string) (string, error)

EnsureAccessForHostname creates or updates an Access Application + Policies for a hostname. This is the main entry point used by the Access Operator.

Flow:

  1. Find or create account-level reusable policies
  2. Create or update the Access Application, linking policies via the Policies field
  3. Clean up old unreferenced policies from the previous app state

func (*AccessClient) FindExistingAccessApp 

func (a *AccessClient) FindExistingAccessApp(ctx context.Context, hostname string) (string, string, error)

FindExistingAccessApp searches for an existing Access Application by hostname. Returns the app ID if found, empty string if not found. This is used to detect pre-existing apps not managed by labelgate.

type Client 

type Client struct {
	// contains filtered or unexported fields
}

Client wraps the Cloudflare API client with caching and credential management.

func NewClient 

func NewClient(apiToken string) *Client

NewClient creates a new Cloudflare client with API token authentication.

func (*Client) API 

func (c *Client) API() *cf.Client

API returns the underlying Cloudflare API client.

func (*Client) AccountID 

func (c *Client) AccountID() string

AccountID returns the configured account ID.

func (*Client) GetZoneID 

func (c *Client) GetZoneID(ctx context.Context, hostname string) (string, error)

GetZoneID retrieves the zone ID for a given hostname. It loads and caches all available zones from the API, then performs longest-suffix matching to find the correct zone. This avoids the need to guess root domains from TLD structure.

func (*Client) InvalidateZoneCache 

func (c *Client) InvalidateZoneCache()

InvalidateZoneCache clears the zone cache, forcing a reload on next GetZoneID call. Useful when zones may have been added or removed from the Cloudflare account.

func (*Client) SetAccountID 

func (c *Client) SetAccountID(accountID string)

SetAccountID sets the account ID for tunnel operations.

func (*Client) Validate 

func (c *Client) Validate(ctx context.Context) error

Validate verifies the API token is valid. Uses /user/tokens/verify endpoint which only requires the token to be valid, without needing additional User:Read permissions.

type Credential 

type Credential struct {
	Name     string   // Credential name for reference
	APIToken string   // API token
	Zones    []string // Zones this credential applies to
	Default  bool     // Whether this is the default credential
}

Credential represents a Cloudflare API credential.

type CredentialManager 

type CredentialManager struct {
	// contains filtered or unexported fields
}

CredentialManager manages multiple Cloudflare credentials.

Credentials are stored as pointer slices so that defaultCredential and any caller holding a *Credential remain valid after additional credentials are appended (a value slice would invalidate addresses on reallocation).

func NewCredentialManager 

func NewCredentialManager(cfg *config.Config) (*CredentialManager, error)

NewCredentialManager creates a new credential manager from config.

func (*CredentialManager) GetClient 

func (cm *CredentialManager) GetClient(cred *Credential) (*Client, error)

GetClient returns a cached Cloudflare client for the given credential.

func (*CredentialManager) GetClientForHostname 

func (cm *CredentialManager) GetClientForHostname(hostname string, explicitCredName string) (*Client, error)

GetClientForHostname returns a client suitable for operations on the given hostname.

func (*CredentialManager) GetCredentialForZone 

func (cm *CredentialManager) GetCredentialForZone(hostname string, explicitCredName string) (*Credential, error)

GetCredentialForZone returns the appropriate credential for a given hostname. Priority: explicit label > zone matching > default

func (*CredentialManager) GetDefaultClient 

func (cm *CredentialManager) GetDefaultClient() (*Client, error)

GetDefaultClient returns the default Cloudflare client.

func (*CredentialManager) GetTunnelClient 

func (cm *CredentialManager) GetTunnelClient(tunnelIDOrName string) (*Client, *TunnelCredential, error)

GetTunnelClient returns a client configured for tunnel operations.

func (*CredentialManager) GetTunnelCredential 

func (cm *CredentialManager) GetTunnelCredential(tunnelIDOrName string) (*TunnelCredential, error)

GetTunnelCredential returns the tunnel credential for a given tunnel ID or name.

func (*CredentialManager) HealthCheck 

func (cm *CredentialManager) HealthCheck(ctx context.Context) *HealthResult

HealthCheck returns a cached health check result for the Cloudflare API. Results are cached for 30 seconds to avoid excessive API calls.

func (*CredentialManager) ListTunnels 

func (cm *CredentialManager) ListTunnels() []string

ListTunnels returns all tunnel names.

func (*CredentialManager) Validate 

func (cm *CredentialManager) Validate(ctx context.Context) error

Validate validates all configured credentials.

type DNSClient 

type DNSClient struct {
	// contains filtered or unexported fields
}

DNSClient provides DNS record management operations.

func NewDNSClient 

func NewDNSClient(client *Client) *DNSClient

NewDNSClient creates a new DNS client wrapper.

func (*DNSClient) CreateRecord 

func (d *DNSClient) CreateRecord(ctx context.Context, record *types.DNSRecord) (*types.DNSRecord, error)

CreateRecord creates a new DNS record.

func (*DNSClient) DeleteRecord 

func (d *DNSClient) DeleteRecord(ctx context.Context, zoneID, recordID string) error

DeleteRecord deletes a DNS record.

func (*DNSClient) GetRecord 

func (d *DNSClient) GetRecord(ctx context.Context, zoneID, recordID string) (*types.DNSRecord, error)

GetRecord retrieves a DNS record by ID.

func (*DNSClient) GetRecordByName 

func (d *DNSClient) GetRecordByName(ctx context.Context, hostname string, recordType types.DNSRecordType) (*types.DNSRecord, error)

GetRecordByName retrieves a DNS record by hostname and type.

func (*DNSClient) ListRecords 

func (d *DNSClient) ListRecords(ctx context.Context, zoneID string) ([]*types.DNSRecord, error)

ListRecords lists DNS records for a zone.

func (*DNSClient) UpdateRecord 

func (d *DNSClient) UpdateRecord(ctx context.Context, record *types.DNSRecord) (*types.DNSRecord, error)

UpdateRecord updates an existing DNS record.

type HealthResult 

type HealthResult struct {
	Reachable bool
	LastCheck time.Time
	Error     string
}

HealthResult holds the result of a Cloudflare API health check.

type TunnelClient 

type TunnelClient struct {
	// contains filtered or unexported fields
}

TunnelClient provides Cloudflare Tunnel management operations.

func NewTunnelClient 

func NewTunnelClient(client *Client, accountID string) *TunnelClient

NewTunnelClient creates a new Tunnel client wrapper.

func (*TunnelClient) AddIngressRule 

func (t *TunnelClient) AddIngressRule(ctx context.Context, tunnelID string, rule *types.TunnelIngress) error

AddIngressRule adds an ingress rule to the tunnel configuration.

func (*TunnelClient) GetTunnel 

func (t *TunnelClient) GetTunnel(ctx context.Context, tunnelID string) (*types.Tunnel, error)

GetTunnel retrieves a tunnel by ID.

func (*TunnelClient) GetTunnelConfiguration 

func (t *TunnelClient) GetTunnelConfiguration(ctx context.Context, tunnelID string) (*types.TunnelConfiguration, error)

GetTunnelConfiguration retrieves the ingress configuration for a tunnel.

func (*TunnelClient) ListTunnels 

func (t *TunnelClient) ListTunnels(ctx context.Context) ([]*types.Tunnel, error)

ListTunnels lists all tunnels for the account.

func (*TunnelClient) RemoveIngressRule 

func (t *TunnelClient) RemoveIngressRule(ctx context.Context, tunnelID string, hostname string) error

RemoveIngressRule removes an ingress rule from the tunnel configuration.

func (*TunnelClient) UpdateTunnelConfiguration 

func (t *TunnelClient) UpdateTunnelConfiguration(ctx context.Context, tunnelID string, ingresses []*types.TunnelIngress) error

UpdateTunnelConfiguration updates the entire ingress configuration for a tunnel.

type TunnelCredential 

type TunnelCredential struct {
	TunnelID   string // Tunnel ID
	TunnelName string // Tunnel name for reference
	AccountID  string // Account ID
	Credential string // Credential name to use for API calls
}

TunnelCredential represents credentials for a Cloudflare Tunnel.

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.