Cloudflare.Gateway reference

Certificate

Source: src/Cloudflare/Gateway/Certificate.ts

A Cloudflare Zero Trust Gateway certificate — a Cloudflare-generated CA used by Gateway to inspect TLS traffic (HTTPS filtering, antivirus scanning, browser isolation). The certificate body is generated by Cloudflare; you only choose the validity period and whether it is activated (deployed to the edge).

To make Gateway actually intercept with this certificate, reference its certificateId from the Gateway configuration’s certificate setting (see Cloudflare.Gateway.Configuration).

Certificate: Creating a Certificate

Activated certificate (default)

const cert = yield* Cloudflare.Gateway.Certificate("InspectionCa", {});
// cert.bindingStatus === "available" once deployed to the edge

Short-lived, kept inactive

const cert = yield* Cloudflare.Gateway.Certificate("StagedCa", {
  validityPeriodDays: 365,
  activate: false,
});

Certificate: Using the certificate for TLS interception

const cert = yield* Cloudflare.Gateway.Certificate("InspectionCa", {});
yield* Cloudflare.Gateway.Configuration("Gateway", {
  settings: {
    tlsDecrypt: { enabled: true },
    certificate: { id: cert.certificateId },
  },
});

Configuration

Source: src/Cloudflare/Gateway/Configuration.ts

Manages the singleton Cloudflare Zero Trust Gateway configuration for an account (/accounts/{accountId}/gateway/configuration) — account-wide settings like activity logging, TLS decryption, the block page, anti-virus scanning, and browser isolation.

The singleton always exists, so reconcile patches only the settings blocks you declare and never clobbers unmanaged blocks. The pre-management value of each managed block is captured on first touch and restored on destroy (capture-and-restore). Blocks that were unset before Alchemy managed them cannot be restored (Cloudflare’s API has no way to unset a block) — destroy leaves the last managed value and logs a warning.

Configuration: Managing Gateway settings

Enable activity logging and TLS decryption

yield* Cloudflare.Gateway.Configuration("Gateway", {
  settings: {
    activityLog: { enabled: true },
    tlsDecrypt: { enabled: true },
  },
});

Custom block page

yield* Cloudflare.Gateway.Configuration("Gateway", {
  settings: {
    blockPage: {
      enabled: true,
      headerText: "Blocked by IT",
      footerText: "Contact support@example.com",
      backgroundColor: "#1f2937",
    },
  },
});

Configuration: TLS interception

const cert = yield* Cloudflare.Gateway.Certificate("InspectionCa", {});
yield* Cloudflare.Gateway.Configuration("Gateway", {
  settings: {
    tlsDecrypt: { enabled: true },
    certificate: { id: cert.certificateId },
  },
});

List

Source: src/Cloudflare/Gateway/List.ts

A Cloudflare Zero Trust Gateway list — a named set of domains, IPs, URLs, emails, serial numbers, or device IDs referenced from Gateway rule wirefilter expressions by UUID ($<listId>).

The list’s type is immutable (changing it replaces the list); name, description, and items all converge in place. Items are managed as a full set — the provider PUTs the complete desired item set and removes anything not declared.

List: Creating a List

Domain list

const blocked = yield* Cloudflare.Gateway.List("BlockedDomains", {
  type: "DOMAIN",
  description: "domains blocked org-wide",
  items: [
    { value: "badsite.example.com" },
    { value: "malware.example.net", description: "known C2" },
  ],
});

IP list

const egress = yield* Cloudflare.Gateway.List("OfficeEgress", {
  type: "IP",
  items: [{ value: "203.0.113.0/24" }],
});

List: Referencing from a Gateway Rule

yield* Cloudflare.Gateway.Rule("BlockListedDomains", {
  action: "block",
  filters: ["dns"],
  traffic: `any(dns.domains[*] in $${blocked.listId})`,
});

Location

Source: src/Cloudflare/Gateway/Location.ts

A Cloudflare Zero Trust Gateway DNS location — a configured source of DNS traffic (an office, a home network, a device fleet) with its own DNS-over-HTTPS endpoint and optional dedicated destination IPs.

Cloudflare assigns each location a stable dohSubdomain; point your network’s DoH resolver at https://<dohSubdomain>.cloudflare-gateway.com/dns-query and Gateway DNS policies apply to its traffic. All declared properties converge in place — nothing on a location forces a replacement.

Location: Creating a Location

DoH-only location

const office = yield* Cloudflare.Gateway.Location("Office", {
  ecsSupport: false,
});
// Point your resolver at the assigned DoH endpoint:
const doh = office.dohSubdomain;

Location with IPv4 source networks

const office = yield* Cloudflare.Gateway.Location("Office", {
  networks: [{ network: "203.0.113.0/24" }],
  endpoints: {
    doh: { enabled: true },
    dot: { enabled: false },
    ipv4: { enabled: true },
    ipv6: { enabled: false },
  },
});

Logging

Source: src/Cloudflare/Gateway/Logging.ts

Manages the singleton Cloudflare Zero Trust Gateway logging settings for an account (/accounts/{accountId}/gateway/logging) — PII redaction and per-rule-type (DNS / HTTP / L4) activity-log toggles.

The singleton always exists, so reconcile converges only the fields you declare (merging them over the observed state before the PUT, since the API is PUT-only). The pre-management snapshot is captured on first touch and restored on destroy (capture-and-restore).

Logging: Managing logging settings

Log everything, keep PII

yield* Cloudflare.Gateway.Logging("Logging", {
  redactPii: false,
  settingsByRuleType: {
    dns: { logAll: true, logBlocks: true },
    http: { logAll: true, logBlocks: true },
    l4: { logAll: true, logBlocks: true },
  },
});

Only log blocked DNS queries, redacting PII

yield* Cloudflare.Gateway.Logging("Logging", {
  redactPii: true,
  settingsByRuleType: {
    dns: { logAll: false, logBlocks: true },
  },
});

ProxyEndpoint

Source: src/Cloudflare/Gateway/ProxyEndpoint.ts

A Cloudflare Zero Trust Gateway proxy endpoint — an agentless HTTP proxy for forwarding traffic to Gateway without installing the WARP client, typically wired up via a PAC file pointing at the endpoint’s server-assigned subdomain.

ip-kind endpoints admit traffic from a source-CIDR allowlist and require an Enterprise plan (Cloudflare error code 2009 otherwise); identity-kind endpoints authenticate individual users and work on all Zero Trust plans. The kind is immutable; name and ips converge in place. Accounts are limited to a small number of proxy endpoints, so prefer reusing one per account.

ProxyEndpoint: Creating a Proxy Endpoint

Identity-based endpoint (all plans)

const proxy = yield* Cloudflare.Gateway.ProxyEndpoint("UserProxy", {
  kind: "identity",
});
// PAC file target:
const host = `${proxy.subdomain}.proxy.cloudflare-gateway.com`;

IP allowlist endpoint (Enterprise)

const proxy = yield* Cloudflare.Gateway.ProxyEndpoint("OfficeProxy", {
  kind: "ip",
  ips: ["203.0.113.1/32"],
});

Rule

Source: src/Cloudflare/Gateway/Rule.ts

A Cloudflare Zero Trust Gateway rule.

Gateway rules sit on the WARP/Gateway data plane and run before Access: they decide whether to allow, block, override, isolate, or redirect a request based on wirefilter expressions over the request traffic, the authenticated identity, and the device posture. The most common companion to Application with a private destination is a dns rule with action: "override" that points an internal hostname at a Cloudflare Tunnel — without it, WARP intercepts the lookup but has nowhere to send the answer.

Rule: DNS override for a private app

const adminDns = yield* Cloudflare.Gateway.Rule("AdminMicroagiDns", {
  name: "research-admin-microagi-dns-override",
  action: "override",
  filters: ["dns"],
  traffic: 'any(dns.domains[*] == "cluster-admin.microagi")',
  ruleSettings: {
    overrideHost: `${tunnel.tunnelId}.cfargotunnel.com`,
  },
  enabled: true,
});

Rule: Block a category

yield* Cloudflare.Gateway.Rule("BlockPhishing", {
  name: "block-phishing",
  action: "block",
  filters: ["http"],
  traffic: "any(http.request.uri.content_category[*] in {178})",
});