# Cloudflare provider

The [Cloudflare](https://cloudflare.com) provider implements all
[Protocol53](https://github.com/outskirtslabs/protocol53) operations with
Cloudflare’s v4 API.

## Installation

Until the first release, use the provider’s Git coordinate:

```clojure
{:deps {com.outskirtslabs/protocol53-cloudflare
        {:git/url "https://github.com/outskirtslabs/protocol53.git"
         :git/sha "4a0ad834256d7e1e1a6a95936ea5e7ca14f13988"
         :deps/root "providers/cloudflare"}}}
```

The provider module also brings in the shared Protocol53 API.

## Authentication

Use scoped API tokens, not legacy global API keys.

For one token, grant `Zone:Read` and `Zone.DNS:Write` across the zones you
manage:

```clojure
(require '[ol.protocol53.cloudflare :as cloudflare])

(def dns
  (cloudflare/provider {:api-token "token"}))
```

For separate read and write credentials, grant `Zone:Read` to `:zone-token`
and `Zone.DNS:Write` to `:api-token`:

```clojure
(def dns
  (cloudflare/provider {:api-token  "dns-write-token"
                        :zone-token "zone-read-token"}))
```

Pass a caller-built `java.net.http.HttpClient` as `:http-client` when advanced
HTTP policy requires Java interop.

## Integration Tests

<dl><dt><strong>⚠️ WARNING</strong></dt><dd>

Run the lifecycle suite only against a dedicated disposable zone. It creates,
replaces, and deletes DNS records. A provider or testkit defect could affect
records outside the reserved names.
</dd></dl>

Set these variables in the process environment or the repository `.env` file.
Process values take precedence over `.env` values.

|     |     |     |
| --- | --- | --- |
| Variable | Required | Description |
| `CLOUDFLARE_API_TOKEN` | yes | Scoped token with DNS write access. |
| `CLOUDFLARE_TEST_ZONE` | one of | Dedicated absolute zone name. |
| `CLOUDFLARE_DOMAIN` | one of | Alternative zone name; a trailing dot is added when absent. |
| `CLOUDFLARE_ZONE_TOKEN` | no | Separate scoped token with zone read access. |

`CLOUDFLARE_ZONE_ID` is not required because the provider discovers the zone
by name. The wrapper sets `:skip-empty-txt? true` because Cloudflare rejects
empty TXT RDATA; it still runs ordinary and wildcard TXT lifecycle checks.

Run every discovered provider integration suite from the repository root:

```shell
bb test:integration
```

The runner discovers `providers/*/src/test-integration`. Cloudflare is skipped
when its credentials are missing; another provider failure does not stop the
remaining suites. Cloudflare creates and deletes records whose effective owner
starts with `p53test-`. Integration tests do not run from `bb test`, `bb qa`, or
`bb ci`. Do not run concurrent lifecycle suites against one zone.