Cloudflare provider

The Cloudflare provider implements all Protocol53 operations with Cloudflare’s v4 API.

Installation

Until the first release, use the provider’s Git coordinate:

{:deps {com.outskirtslabs/protocol53-cloudflare
        {:git/url "https://github.com/outskirtslabs/protocol53.git"
         :git/sha "4a0ad834256d7e1e1a6a95936ea5e7ca14f13988"
         :deps/root "providers/cloudflare"}}}

The provider module also brings in the shared Protocol53 API.

Authentication

Use scoped API tokens, not legacy global API keys.

For one token, grant Zone:Read and Zone.DNS:Write across the zones you manage:

(require '[ol.protocol53.cloudflare :as cloudflare])

(def dns
  (cloudflare/provider {:api-token "token"}))

For separate read and write credentials, grant Zone:Read to :zone-token and Zone.DNS:Write to :api-token:

(def dns
  (cloudflare/provider {:api-token  "dns-write-token"
                        :zone-token "zone-read-token"}))

Pass a caller-built java.net.http.HttpClient as :http-client when advanced HTTP policy requires Java interop.

Integration Tests

Run the lifecycle suite only against a dedicated disposable zone. It creates, replaces, and deletes DNS records. A provider or testkit defect could affect records outside the reserved names.

Set these variables in the process environment or the repository .env file. Process values take precedence over .env values.

Variable Required Description

Variable	Required	Description
`CLOUDFLARE_API_TOKEN`	yes	Scoped token with DNS write access.
`CLOUDFLARE_TEST_ZONE`	one of	Dedicated absolute zone name.
`CLOUDFLARE_DOMAIN`	one of	Alternative zone name; a trailing dot is added when absent.
`CLOUDFLARE_ZONE_TOKEN`	no	Separate scoped token with zone read access.

CLOUDFLARE_API_TOKEN

yes

Scoped token with DNS write access.

CLOUDFLARE_TEST_ZONE

one of

Dedicated absolute zone name.

CLOUDFLARE_DOMAIN

one of

Alternative zone name; a trailing dot is added when absent.

CLOUDFLARE_ZONE_TOKEN

Separate scoped token with zone read access.

CLOUDFLARE_ZONE_ID is not required because the provider discovers the zone by name. The wrapper sets :skip-empty-txt? true because Cloudflare rejects empty TXT RDATA; it still runs ordinary and wildcard TXT lifecycle checks.

Run every discovered provider integration suite from the repository root:

bb test:integration

The runner discovers providers/*/src/test-integration. Cloudflare is skipped when its credentials are missing; another provider failure does not stop the remaining suites. Cloudflare creates and deletes records whose effective owner starts with p53test-. Integration tests do not run from bb test, bb qa, or bb ci. Do not run concurrent lifecycle suites against one zone.