Adds universal_ssl to cloudflare_zone_settings_override

cloudflare/resource_cloudflare_zone_settings_override.go

@@ -364,6 +364,13 @@ var resourceCloudflareZoneSettingsSchema = map[string]*schema.Schema{
 		ValidateFunc: validation.StringInSlice([]string{"off", "flexible", "full", "strict", "origin_pull"}, false), // depends on plan
 	},
 
+	"universal_ssl": {
+		Type:         schema.TypeString,
+		Optional:     true,
+		Computed:     true,
+		ValidateFunc: validation.StringInSlice([]string{"on", "off"}, false),
+	},
+
 	"tls_client_auth": {
 		Type:         schema.TypeString,
 		ValidateFunc: validation.StringInSlice([]string{"on", "off"}, false),
@@ -502,11 +509,17 @@ func resourceCloudflareZoneSettingsOverrideCreate(d *schema.ResourceData, meta i
 		return err
 	}
 
+	// pulling USSL status and wrapping it into a cloudflare.ZoneSetting that we can set initial_settings
+	if err = updateZoneSettingsResponseWithUniversalSSLSettings(zoneSettings, d.Id(), client); err != nil {
+		return err
+	}
+
 	log.Printf("[DEBUG] Read CloudflareZone initial settings: %#v", zoneSettings)
 
 	if err := d.Set("initial_settings", flattenZoneSettings(d, zoneSettings.Result, true)); err != nil {
 		log.Printf("[WARN] Error setting initial_settings for zone %q: %s", d.Id(), err)
 	}
+
 	d.Set("initial_settings_read_at", time.Now().UTC().Format(time.RFC3339Nano))
 
 	// set readonly setting so that update can behave correctly
@@ -530,6 +543,23 @@ func updateZoneSettingsResponseWithSingleZoneSettings(zoneSettings *cloudflare.Z
 	return nil
 }
 
+func updateZoneSettingsResponseWithUniversalSSLSettings(zoneSettings *cloudflare.ZoneSettingResponse, zoneId string, client *cloudflare.API) error {
+	ussl, err := client.UniversalSSLSettingDetails(zoneId)
+	if err != nil {
+		return errors.Wrap(err, fmt.Sprintf("Error reading initial Universal SSL settings for zone %q", zoneId))
+	}
+
+	usslToZoneSetting := cloudflare.ZoneSetting{
+		ID:       "universal_ssl",
+		Value:    stringFromBool(ussl.Enabled),
+		Editable: true,
+	}
+
+	zoneSettings.Result = append(zoneSettings.Result, usslToZoneSetting)
+
+	return nil
+}
+
 func resourceCloudflareZoneSettingsOverrideRead(d *schema.ResourceData, meta interface{}) error {
 	client := meta.(*cloudflare.API)
 
@@ -557,6 +587,10 @@ func resourceCloudflareZoneSettingsOverrideRead(d *schema.ResourceData, meta int
 		return err
 	}
 
+	if err = updateZoneSettingsResponseWithUniversalSSLSettings(zoneSettings, d.Id(), client); err != nil {
+		return err
+	}
+
 	log.Printf("[DEBUG] Read CloudflareZone Settings: %#v", zoneSettings)
 
 	d.Set("status", zone.Status)
@@ -652,6 +686,25 @@ func updateSingleZoneSettings(zoneSettings []cloudflare.ZoneSetting, client *clo
 	return zoneSettings, nil
 }
 
+func updateUniversalSSLSetting(zoneSettings []cloudflare.ZoneSetting, client *cloudflare.API, zoneID string) ([]cloudflare.ZoneSetting, error) {
+	indexToCut := -1
+	for i, setting := range zoneSettings {
+		if setting.ID == "universal_ssl" {
+			_, err := client.EditUniversalSSLSetting(zoneID, cloudflare.UniversalSSLSetting{Enabled: boolFromString(setting.Value.(string))})
+			if err != nil {
+				return zoneSettings, err
+			}
+			indexToCut = i
+		}
+	}
+
+	if indexToCut != -1 {
+		zoneSettings = append(zoneSettings[:indexToCut], zoneSettings[indexToCut+1:]...)
+	}
+
+	return zoneSettings, nil
+}
+
 func resourceCloudflareZoneSettingsOverrideUpdate(d *schema.ResourceData, meta interface{}) error {
 	client := meta.(*cloudflare.API)
 
@@ -669,6 +722,10 @@ func resourceCloudflareZoneSettingsOverrideUpdate(d *schema.ResourceData, meta i
 			return err
 		}
 
+		if zoneSettings, err = updateUniversalSSLSetting(zoneSettings, client, d.Id()); err != nil {
+			return err
+		}
+
 		if len(zoneSettings) > 0 {
 			_, err = client.UpdateZoneSettings(d.Id(), zoneSettings)
 			if err != nil {
@@ -778,6 +835,10 @@ func resourceCloudflareZoneSettingsOverrideDelete(d *schema.ResourceData, meta i
 			return err
 		}
 
+		if zoneSettings, err = updateUniversalSSLSetting(zoneSettings, client, d.Id()); err != nil {
+			return err
+		}
+
 		if len(zoneSettings) > 0 {
 			_, err = client.UpdateZoneSettings(d.Id(), zoneSettings)
 			if err != nil {
@@ -834,3 +895,17 @@ func schemaValueEquals(a, b interface{}) bool {
 
 	return reflect.DeepEqual(a, b)
 }
+
+func boolFromString(status string) bool {
+	if status == "on" {
+		return true
+	}
+	return false
+}
+
+func stringFromBool(status bool) string {
+	if status {
+		return "on"
+	}
+	return "off"
+}

cloudflare/resource_cloudflare_zone_settings_override_test.go

@@ -60,6 +60,8 @@ func TestAccCloudflareZoneSettingsOverride_Full(t *testing.T) {
 						name, "settings.0.h2_prioritization", "on"),
 					resource.TestCheckResourceAttr(
 						name, "settings.0.zero_rtt", "off"),
+					resource.TestCheckResourceAttr(
+						name, "settings.0.universal_ssl", "off"),
 				),
 			},
 		},
@@ -181,6 +183,10 @@ func testAccGetInitialZoneSettings(t *testing.T, zoneID string, settings map[str
 			return err
 		}
 
+		if err = updateZoneSettingsResponseWithUniversalSSLSettings(foundZone, zoneID, client); err != nil {
+			return err
+		}
+
 		for _, zs := range foundZone.Result {
 			settings[zs.ID] = zs.Value
 		}
@@ -205,6 +211,10 @@ func testAccCheckInitialZoneSettings(zoneID string, initialSettings map[string]i
 			return err
 		}
 
+		if err = updateZoneSettingsResponseWithUniversalSSLSettings(foundZone, zoneID, client); err != nil {
+			return err
+		}
+
 		for _, zs := range foundZone.Result {
 			if !reflect.DeepEqual(zs.Value, initialSettings[zs.ID]) {
 				return fmt.Errorf("Final setting for %q: %+v not equal to initial setting: %+v", zs.ID, zs.Value, initialSettings[zs.ID])
@@ -232,6 +242,7 @@ resource "cloudflare_zone_settings_override" "test" {
 		opportunistic_encryption = "on"
 		automatic_https_rewrites = "on"
 		h2_prioritization = "on"
+		universal_ssl = "off"
 		minify {
 			css = "on"
 			js = "off"

website/docs/r/zone_settings_override.html.markdown

@@ -72,6 +72,7 @@ These can be specified as "on" or "off" string. Similar to boolean values, but h
 * `sort_query_string_for_cache` (default: `off`)
 * `tls_client_auth` (default: `on`)
 * `true_client_ip_header` (default: `off`)
+* `universal_ssl` (default: `on`)
 * `waf` (default: `off`)
 * `webp` (default: `off`). Note that the value specified will be ignored unless `polish` is turned on (i.e. is "lossless" or "lossy")
 * `websockets` (default: `off`)