object({
    admin  = optional(string, "1h")
    portal = optional(string, "8h")
    health = optional(string, "4h")
    api    = optional(string, "1h")
  })

Default: {}

custom_domains

Description: Custom domain configurations beyond default services

Type:

map(object({
    subdomain = string
    target    = string
    type      = optional(string, "CNAME")
    ttl       = optional(number, 300)
    proxied   = optional(bool, true)
    priority  = optional(number)
  }))

Default: {}

email_provider

Description: Email provider for MX/SPF/DKIM/DMARC records. Use microsoft_365_migration during cutover (keeps both SPF includes).

Type: string

Default: "none"

health_checks

Description: Configuration for health checks. Default disabled — each check wakes Cloud Run.

Type:

object({
    enabled             = optional(bool, false)
    regions             = optional(list(string), ["WNAM"])
    interval            = optional(number, 900) # 15 min — never use 60s, it keeps Cloud Run warm 24/7
    timeout             = optional(number, 10)
    retries             = optional(number, 2)
    notification_emails = optional(list(string), [])
  })

Default: {}

kv_namespaces

Description: Additional KV namespaces to create

Type:

map(object({
    title = string
  }))

Default: {}

network_config

Description: Network and connectivity configuration

Type:

object({
    ipv6           = optional(bool, true)
    websockets     = optional(bool, true)
    pseudo_ipv4    = optional(string, "off")
    ip_geolocation = optional(bool, true)
    http3          = optional(bool, true)
  })

Default: {}

notification_config

Description: Notification settings for alerts and health checks

Type:

object({
    email_addresses = optional(list(string), [])
    webhook_urls    = optional(list(string), [])
    slack_webhook   = optional(string, "")
  })

Default: {}

page_rules

Description: Custom page rules for caching and performance

Type:

list(object({
    target   = string
    priority = number
    actions  = map(any)
  }))

Default: []

page_rules_enabled

Description: Enable deprecated page rules (requires zone-scoped API token, not account-owned)

Type: bool

Default: false

performance_config

Description: Performance and caching configuration

Type:

object({
    minify = optional(object({
      css  = optional(bool, true)
      html = optional(bool, true)
      js   = optional(bool, true)
    }), {})
    brotli        = optional(bool, true)
    early_hints   = optional(bool, true)
    rocket_loader = optional(bool, false)
    mirage        = optional(bool, true)
    polish        = optional(string, "lossy")
  })

Default: {}

rate_limits

Description: Custom rate limiting rules

Type:

list(object({
    name      = string
    threshold = number
    period    = number
    match = object({
      request = object({
        url_pattern = string
        schemes     = optional(list(string), ["HTTPS"])
        methods     = optional(list(string), ["GET", "POST"])
      })
    })
    action = object({
      mode    = string
      timeout = optional(number, 300)
    })
  }))

Default: []

security_config

Description: Advanced security configuration

Type:

object({
    challenge_ttl       = optional(number, 1800)
    browser_check       = optional(bool, true)
    always_online       = optional(bool, true)
    ip_geolocation      = optional(bool, true)
    email_obfuscation   = optional(bool, true)
    server_side_exclude = optional(bool, true)
  })

Default: {}

services

Description: Map of services to configure DNS records for

Type:

map(object({
    subdomain = string
    target    = string
    type      = string
    ttl       = number
    priority  = optional(number)
    proxied   = optional(bool, true)
  }))

Default: {}

ssl_config

Description: SSL/TLS configuration options

Type:

object({
    mode            = optional(string, "full_strict")
    min_tls_version = optional(string, "1.2")
    tls_1_3         = optional(string, "on")
    always_https    = optional(bool, true)
    hsts_enabled    = optional(bool, true)
    hsts_max_age    = optional(number, 31536000)
  })

Default: {}

trading_config

Description: Trading platform specific configuration

Type:

object({
    api_rate_limit    = optional(number, 1000)
    websocket_enabled = optional(bool, true)
    ssl_mode          = optional(string, "full_strict")
    security_level    = optional(string, "medium")
    bot_management    = optional(bool, true)
  })

Default: {}

waf_rules

Description: Custom WAF rules for the trading platform

Type:

list(object({
    action      = string
    expression  = string
    description = string
    enabled     = optional(bool, true)
  }))

Default: []

worker_config

Description: Worker script configuration. NOTE: Workers are typically deployed via wrangler CLI, not Terraform.

Type:

object({
    api_gateway_enabled = optional(bool, false) # Disabled by default - workers deployed via wrangler
    dns_manager_enabled = optional(bool, false) # Disabled by default - workers deployed via wrangler
    custom_scripts = optional(map(object({
      content = string
      routes  = list(string)
    })), {})
  })