> For the complete documentation index, see [llms.txt](https://faction-os.gitbook.io/faction-os-docs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://faction-os.gitbook.io/faction-os-docs/docs/runbooks/cloudflare-waf.md). # Cloudflare WAF Runbook This runbook covers the shared Cloudflare WAF posture for FactionOS. The current zone and account configuration is dashboard-managed. No WAF secrets, tokens, or API credentials are stored in the repository. ## Current Posture * Public DNS and zone-level WAF are managed in the Cloudflare dashboard. * Managed/OWASP WAF rules are preferred when the account plan supports them. * The War Room Worker has an app-level rate limiter in the application layer. * The existing zone rate-limit rule slot is occupied by `Leaked credential check`. ## Preferred Rule Set When the Cloudflare account plan allows additional WAF coverage, use: * Managed WAF / OWASP core rules enabled for the zone. * A hostname-specific zone rate-limit rule for `http.host eq "warroom.faction-os.com"` that matches the Worker app limiter budget of 240 requests per 60 seconds per client IP. Do not replace the existing leaked-credential rule unless that tradeoff has been explicitly approved. ## Validation Validate the security bundle with both application and hosted checks: ```bash npm --workspace @factionos/warroom run typecheck curl --fail --show-error --max-time 8 http://127.0.0.1:8790/health npm run release:hosted-smoke -- --target warroom-worker-custom --target warroom-worker-workers-dev ``` The hosted smoke output must stay sanitized. It should report only compact status metadata, rate-limit state, safe hostnames, issue codes, and docs paths. ## Manual Dashboard Steps If the Cloudflare plan or dashboard changes, record the exact state in the deployment notes rather than in tracked secrets: * confirm whether managed/OWASP WAF is entitled * confirm whether the zone rate-limit slot is available * confirm whether the hostname-specific rule matches the Worker budget * keep the leaked-credential rule unless an approved replacement is made --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://faction-os.gitbook.io/faction-os-docs/docs/runbooks/cloudflare-waf.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.