Cloudflare.HostnameTlsSetting reference

HostnameTlsSetting

Source: src/Cloudflare/HostnameTlsSetting/HostnameTlsSetting.ts

A per-hostname TLS setting override (/zones/{zone_id}/hostnames/settings/{settingId}/{hostname}) — pins ciphers, min_tls_version, or http2 for a single hostname instead of the whole zone.

Each (settingId, hostname) pair is an independent override with PUT (upsert) / DELETE semantics; deleting the override reverts the hostname to the zone-wide default. Overrides are mostly useful with Cloudflare for SaaS custom hostnames or Advanced Certificate Manager — on zones without that entitlement, writes fail with the typed AdvancedCertificateManagerRequired error (Cloudflare code 1450).

Safety: overrides carry no ownership markers. When there is no prior state, read scans the setting’s hostname list and reports an existing override as Unowned, so the engine refuses to take it over unless --adopt (or adopt(true)) is set.

HostnameTlsSetting: Minimum TLS version

yield* Cloudflare.HostnameTlsSetting.HostnameTlsSetting("ApiMinTls", {
  zoneId: zone.zoneId,
  settingId: "min_tls_version",
  hostname: "api.example.com",
  value: "1.2",
});

HostnameTlsSetting: HTTP/2

yield* Cloudflare.HostnameTlsSetting.HostnameTlsSetting("LegacyHttp2", {
  zoneId: zone.zoneId,
  settingId: "http2",
  hostname: "legacy.example.com",
  value: "off",
});

HostnameTlsSetting: Cipher suites

yield* Cloudflare.HostnameTlsSetting.HostnameTlsSetting("StrictCiphers", {
  zoneId: zone.zoneId,
  settingId: "ciphers",
  hostname: "secure.example.com",
  value: ["ECDHE-RSA-AES128-GCM-SHA256", "AES128-GCM-SHA256"],
});