noisypigeon.garden

cloudflare/r2-custom-domain v0.1.0

By noisypigeon.garden

Two module changes for LIB-0051 ยง2, so a site workload can serve its R2 bucket on its host and deploy to it with a token scoped to that bucket.

New: cloudflare/r2-custom-domain

  • What it is. One cloudflare_r2_custom_domain: an R2 bucket served on one hostname of a Cloudflare zone.
  • The zone is looked up by its apex (zone), as dns-record does, so a leaf needs no zone ID.
  • The bucket is addressed in R2's eu jurisdiction, where every family bucket is (LIB-0006). There's no input to change it.
  • domain must be the zone's apex or a name under it.
  • The other inputs: enabled defaults to true, and min_tls to 1.2.
  • Outputs: domain and zone_id.
module "custom_domain" {
  source = "https://noisypigeon.garden/terraform/cloudflare/r2-custom-domain/v0.1.0"

  account_id  = local.cloudflare_account_id
  zone        = "example.com"
  bucket_name = "example.com"
  domain      = "example.com"
}

cloudflare/api-token: policies can name R2 buckets

  • The new resource. A policy can name r2_buckets (bucket names, eu jurisdiction) as its one resource, instead of zones, all_zones or account. Its permission groups resolve at the R2 bucket scope. For example, { permission_groups = ["Workers R2 Storage Bucket Item Write"], r2_buckets = ["example.com"] } writes one bucket's objects.
  • New outputs s3_access_key_id and s3_secret_access_key (sensitive) sign in to R2's S3 API as the token: its ID, and the SHA-256 of its value.
  • Existing callers change nothing: r2_buckets defaults to empty.

Generated by Claude Code

PR: https://github.com/noisypigeon/runway/pull/165