cf-waf-blocklist

Manage Cloudflare WAF access rules to block/challenge traffic from cloud and VPS provider ASNs.

What it does

Creates js_challenge rules for 70 ASNs (cloud/VPS/hosting providers) and TOR exit nodes. Visitors from these networks will see a JavaScript challenge before accessing your site.

Why Cloudflare Python SDK instead of Terraform/CDKTF?

This project previously used CDKTF (Cloud Development Kit for Terraform) to manage Cloudflare access rules. We migrated to the official Cloudflare Python SDK for these reasons:

• CDKTF is no longer maintained — the project has been deprecated
• Simpler architecture — this project just creates access rules in a loop; Terraform's state management and infrastructure-as-code abstractions add unnecessary complexity
• Fewer dependencies — CDKTF required Terraform, CDKTF CLI, JSII runtime, and provider bindings; the SDK is a single pip install cloudflare
• No state files — Terraform state files were being committed to git (security risk); the SDK makes direct API calls without local state
• Idempotency without state — the script checks existing rules before creating new ones, achieving the same safety as Terraform's plan/apply cycle

Requirements

• Python 3.10+
• Cloudflare API token with Zone:WAF permission

Installation

pip install -e ".[dev]"

Configuration

Set environment variables:

export CLOUDFLARE_API_TOKEN="your_api_token"
export CLOUDFLARE_ZONE_ID="your_zone_id"

Or copy .env.example to .env and fill in the values.

Usage

python main.py

The script is idempotent — running it multiple times won't create duplicate rules.

Testing

pytest tests/ -v

License

MIT