Cache Rules for the Pages a Proxied Zone Does Not Cache

cloudflare-cdn

Cache rules and zone cache settings on Cloudflare. Works with Terraform and OpenTofu (>= 1.6), cloudflare provider >= 5.0, < 6.0.

A proxied zone caches almost nothing by default. Cloudflare caches by file extension, so the hashed JavaScript is cached and the HTML is not, and every page view still reaches the origin while the dashboard reports a healthy hit ratio. A rule with cache = true is what changes that, and a ruleset holding none is refused.

edge_ttl_mode is the whole decision. respect_origin defers to the origin's Cache-Control - which means Cloudflare decides when the origin sends none, as an object store does. override_origin uses your number. origin_decides_ttl_refs lists the rules that took the first answer, so it is visible rather than assumed.

A caching rule whose expression is true will serve one visitor's page to the next. That exact combination is refused unless accepted by name.

The cache key decides who shares a copy. Keep every query string and anyone can miss the cache forever by appending a parameter; drop it entirely and ?page=2 serves page 1. cache_key_query_params is null, [], or the list of parameters that change the response.

Tiered Cache and Cache Reserve are managed in both directions, so turning one off here turns it off on the zone. A resource that is only created when the setting is wanted can never turn it back off. Cache Reserve is separately billed storage and says so before it will switch on.

Verification

Static validation runs tofu fmt, init, validate, tflint and checkov. This module has not yet had a live test, so it is published as statically validated with its live test pending and does not carry the live-tested mark.