1import { getKlusterCtx } from '../k8sF/ctxF/klusterCtxF.mts'
2import { cfFetch, getCfHeaders } from './cfFetchAI.mts'
3import { throPtErr } from '../../sharedF/throwErrorF/sharedErrF.mts'
4import { betLog } from '../../sharedF/betterConsLogF.mts'
5
6const targetSslMode = 'strict' // Full (Strict) - requires valid LE cert on origin
7
8export const cfensuressl = async () => {
9  const {cfApiKeySecretName, domainNames} = getKlusterCtx()
10
11  const headers = getCfHeaders({cfApiKeySecretName})
12
13  const zones = await cfFetch('/zones', headers)
14
15  for (const domainName of domainNames!) {
16    const zone = zones.find((z: any) => z.name === domainName)
17    if (!zone) { console.log(`⚠️  zone not found: ${domainName}`); continue }
18
19    const sslSetting = await cfFetch(`/zones/${zone.id}/settings/ssl`, headers)
20    const currentValue = sslSetting.value
21
22    if (currentValue === targetSslMode) {
23      console.log(`✓ ${domainName} ssl=${currentValue}`)
24      continue
25    }
26
27    await cfFetch(`/zones/${zone.id}/settings/ssl`, headers, {
28      method: 'PATCH',
29      body: JSON.stringify({value: targetSslMode}),
30    })
31    betLog({domainName, sslMode: `${currentValue} → ${targetSslMode}`})
32  }
33}
34
35cfensuressl.cliDescript = 'ensure CF zone SSL mode is Full (Strict) for all cluster domains'
36