Allow configuring a custom http endpoint

[tamirFireFly]

Current Terraform and Cloudflare provider version

3.35.0

Description

Missing the ability to add http proxy server because when address being edited https added to it.

Use cases

It could want to add it for caching porpuses and unit testing.

Potential Terraform configuration

Environment variable that will be called httpProxy with similar behavior as in okta provider for example (adding it to reference)

References

okta/terraform-provider-okta#1142

[github-actions]

Community Note

Voting for Prioritization

• Please vote on this issue by adding a 👍 reaction to the original post to help the community and maintainers prioritize this request.
• Please do not leave "+1" or other comments that do not add relevant new information or questions, they generate extra noise for issue followers and do not help prioritize the request.

Volunteering to Work on This Issue

• If you are interested in working on this issue, please leave a comment.
• If this would be your first contribution, please review the contribution guide.

[jacobbednarz]

if I understand the ask here, this is already supported. you can configure the base path (https://registry.terraform.io/providers/cloudflare/cloudflare/latest/docs#api_base_path) and hostname (https://registry.terraform.io/providers/cloudflare/cloudflare/latest/docs#api_hostname).

additionally we pass through proxy environment variables that are set using HTTPS_PROXY to the HTTP clients by default (I use this on a daily basis).

[tamirFireFly]

@jacobbednarz so if for example my proxy is http://localhost:5151 which env variables should i set?

[jacobbednarz]

HTTPS_PROXY="localhost:5151" should get you there (at least it does for MITM proxying). usual caveats will apply around ensuring your TLS chain, etc is correctly setup.

[jacobbednarz]

if that doesn't work, drop in more specific details about what you're trying to do with what tools and I can take a look at how we can get it going. I know (correctly setup) MITM and static proxies work but haven't had a need for caching.

[tamirFireFly]

Im trying to list some cloudflare resources for example zones and save responses in the cache and then perform on each one from the list terraform read from the proxy. The list from proxy works and returns whats need. The provider when going through the proxy failing. If I want to run the proxy as http server that will redirect to https of cloudflare api is it possible?

[jacobbednarz]

savings responses like that is a really difficult thing to get right and I highly advise against it. the way terraform works, it expects to be able to save the remote state after each call and you're quickly going to run into cache negotiation issues.

if you have a correctly setup MITM proxy, the HTTPS_PROXY is the way to go. using this approach, all requests HTTPS requests (which are the default) pass through the proxy so you can theoretically do caching or replaying there.

you can also try setting the other environment variables I mentioned further up to make calls directly to your caching service however, that isn't the intended usage and you'll likely hit issues since it isn't an instance of the Cloudflare API. you'll need to run your proxy using HTTPS though, not plain HTTP.

[tamirFireFly]

So if im doing the proxy server as https should i still use api_hostname and api_base_name?

[tamirFireFly]

There is documentation for what you said you doing daily with the HTTPS_PROXY?

[jacobbednarz]

So if im doing the proxy server as https should i still use api_hostname and api_base_name?

it shouldn't need to change if the proxy is already intercepting handling the response.

There is documentation for what you said you doing daily with the HTTPS_PROXY?

not publicly, sorry. my use is debugging network and API issues which generally involves adding the HTTPS_PROXY value and that is all that is required. i use Proxyman (https://proxyman.io) and mitmproxy (https://mitmproxy.org/) depending on the deployment context but once setup, both of these work fine for intercepting traffic.

again, if you have something specific that isn't working, i need more specific details to troubleshoot. tools, versions, setup, etc. without it, the advice is all general and best effort.

[jacobbednarz]

marking this as a support issue for now as there isn't currently anything we need to change on the provider side to enable this sort of usage.

[jacobbednarz]

closing this one out as there isn't anything for us to do in the provider to enable this sort of functionality. the options are either set the HTTPS_PROXY value or configure the API hostname + base path (untested for this particular case).