Cloudflare

Status: available · package wg-flow-plugin-cloudflare 0.1.1 · provider cloudflare · category dns.

The plugin calls the Cloudflare API v4 and sends zones, DNS, storage, databases and load balancers into inventory. It needs an API Token. A Global API Key is not accepted. The token stays in the agent YAML.

Token permissions: Zone Read and DNS Read for zones. Storage, databases and load balancers also need Account → Workers R2 Storage → Read, Workers KV Storage → Read, D1 → Read and Load Balancing → Read. A missing permission (often 403 on R2) skips that product; the rest of the collect continues.

Workers, Pages, Tunnels and Queues are not emitted in 0.1.1.

Install

The agent must be connected to the API.

docker compose exec agent wg-flow-agent plugin install cloudflare
# or
wg-flow-agent plugin install cloudflare

Then the local UI → Connections → cloudflare, or YAML.

What lands in inventory

Cloudflare object	resource_type	Notes
Zone	domain	apex, provider_resource_id is the zone name. paused → stopped
Hostname from A / AAAA / CNAME	domain	child FQDN such as www.example.com. Apex, *, and _dmarc are not duplicated as domains
DNS record	dns	provider_resource_id = dns:{record_id}
R2 bucket	storage	r2:{account_id}:{name}
Workers KV	storage	kv:{namespace_id}
D1	database	d1:{uuid}, engine sqlite
Hyperdrive	database	hyperdrive:{id}, origin host and database name
Zone load balancer	load_balancer	lb:{id}. enabled: false → stopped
Load balancer pool	load_balancer	lb-pool:{id}

In the console, domains are grouped by apex, same as SpaceWeb and Prometheus.

Collection pieces can be turned off separately: zones, DNS, storage, databases, load balancers. If zones are off and DNS or LB is on, the zone list is still fetched so records and balancers can be walked, but apex domains are not stored. An error on one zone or product does not stop the rest of the collect.

An empty account_id means every zone and account the token can see. Several Cloudflare accounts are several sources.

YAML

plugins:
  cloudflare:
    enabled: true
    sources:
      - id: account
        provider_account: "cf-main"
        sync_interval_seconds: 300
        url: "https://api.cloudflare.com/client/v4"
        token: "…"
        account_id: ""
        collect_zones: true
        collect_dns: true
        collect_storage: true
        collect_databases: true
        collect_load_balancers: true

Source fields

Field	Required	Description
id	yes	Log key (cloudflare/account)
provider_account	yes	Account label in inventory
url	no	Default https://api.cloudflare.com/client/v4
token	yes	API Token; masked in the UI
account_id	no	Limit collection to one account
collect_zones / collect_dns / collect_storage / collect_databases / collect_load_balancers	no	Default true
sync_interval_seconds	no	Minimum 300

Check

wg-flow-agent status
wg-flow-agent dry-run

JSON shows provider: cloudflare. Health calls GET /user/tokens/verify and treats the token as live only when status=active. The token itself is not stored in inventory.

Common errors

Symptom	What to check
401 / 403 on zones	API Token, not a Global API Key; Zone Read and DNS Read
403 on R2, empty storage	Account → Workers R2 Storage → Read
Token is not active	the token is disabled in Cloudflare
Empty zones	account_id belongs to this token; collect_zones is not off
No subdomains	collect_dns is on; the record is A/AAAA/CNAME, not a wildcard or _label
No storage / database / LB	the product exists on the account; the matching collect_* is on; token permissions
Sync accepted>0, created=0, seen=0	SaaS quota or read-only subscription; the payload reached the API but upsert did not create rows
Duplicates with SpaceWeb / Prometheus	different provider is expected; merge in the console