security-headers.tf

# SPDX-License-Identifier: MPL-2.0
# Security headers via Cloudflare Transform Rules
#
# ✅ FREE TIER - Transform Rules are FREE with unlimited requests!
# This is more cost-effective than using Workers for headers.

# Security headers ruleset for all domains
resource "cloudflare_ruleset" "security_headers" {
  for_each = local.domains

  zone_id     = data.cloudflare_zones.all[each.key].zones[0].id
  name        = "Security Headers (FREE)"
  description = "Add security headers to all responses - Transform Rules are FREE!"
  kind        = "zone"
  phase       = "http_response_headers_transform"

  rules {
    action = "rewrite"
    action_parameters {
      headers {
        name      = "Strict-Transport-Security"
        operation = "set"
        value     = "max-age=31536000; includeSubDomains; preload"
      }
      headers {
        name      = "Content-Security-Policy"
        operation = "set"
        value     = "default-src 'self'; script-src 'self' 'unsafe-inline' https://cdn.jsdelivr.net; style-src 'self' 'unsafe-inline'; img-src 'self' data: https:; font-src 'self' data:; connect-src 'self'; frame-ancestors 'none'; base-uri 'self'; form-action 'self'"
      }
      headers {
        name      = "X-Frame-Options"
        operation = "set"
        value     = "DENY"
      }
      headers {
        name      = "X-Content-Type-Options"
        operation = "set"
        value     = "nosniff"
      }
      headers {
        name      = "Referrer-Policy"
        operation = "set"
        value     = "strict-origin-when-cross-origin"
      }
      headers {
        name      = "Permissions-Policy"
        operation = "set"
        value     = "geolocation=(), microphone=(), camera=(), payment=(), usb=(), magnetometer=(), gyroscope=(), accelerometer=()"
      }
      headers {
        name      = "X-XSS-Protection"
        operation = "set"
        value     = "1; mode=block"
      }
      headers {
        name      = "Cross-Origin-Embedder-Policy"
        operation = "set"
        value     = "require-corp"
      }
      headers {
        name      = "Cross-Origin-Opener-Policy"
        operation = "set"
        value     = "same-origin"
      }
      headers {
        name      = "Cross-Origin-Resource-Policy"
        operation = "set"
        value     = "same-origin"
      }
    }

    expression  = "(http.host eq \"${each.value.domain}\" or http.host eq \"www.${each.value.domain}\")"
    description = "Set security headers for ${each.value.domain}"
    enabled     = true
  }
}