A Pages Project Whose Previews Are Not Public by Accident
Every branch pushed gets a public preview URL by default, the half-finished pricing page included; an environment variable is readable in the dashboard unless stored as a secret; and the production branch is whatever the repository's default was. Previews limited to the branches you list (every branch by name), each variable marked secret or plain, bindings per environment, and custom domains.
Verification
Static-verifiedPassed: validated and lint-clean (provider-schema-validated for AWS/Azure/GCP; Terraform-language lint elsewhere).
Conformance
- Static validation (fmt · validate · tflint)
- No applicable security policies for this provider
- Plan tests (mocked: validation rules · outputs)
Provenance
- SHA-256 checksum
- Signature (pending)
Functional
- Live test pending (no cloud run yet)
Last verified 2026-09-14 · how we verify
Use it from the registry
terraform · opentofumodule "pages_project" {
source = "www.iac-bazaar.com/iac-bazaar/cloudflare-pages-project/cloudflare"
version = "1.0.0"
}Needs a registry token from /account/tokens. The module itself is free; the account is what identifies you. Full setup: registry docs.
Inputs & outputs
Create a free account to read this module's contract
The declared contract - every input name, type, default and description, plus every output - is shown to signed-in accounts, not to anonymous visitors.
A free account sees the contract of every module in the catalogue. There is no subscription and nothing to buy - the modules are free to download, and they run under Vizier.
Documentation
cloudflare-pages-project
A Cloudflare Pages project whose preview deployments are not public by
accident, with a custom domain and bindings per environment. Works with
Terraform and OpenTofu (>= 1.6), cloudflare provider >= 5.0, < 6.0.
Every branch gets a public URL by default. preview_branches lists
the ones that may; previewing every branch needs
accept_public_previews_of_every_branch. Protect previews with a Zero
Trust Access policy (cloudflare-zero-trust-access) if they must not be
public at all.
Environment variables are secrets or they are not; each says which.
The production branch is set deliberately.
Verification
Static validation runs tofu fmt, init, validate, tflint and checkov.
This module has not yet had a live test, so it is published as statically
validated with its live test pending and does not carry the live-tested mark.
Usage code & full reference need an account
The complete copy-paste usage, the full input/output reference, and operational notes are free with an account - shown here and bundled in the download. Sign in and this section fills in.
- Usage
Related modules
cloudflare-workers-platform
Worker with KV/R2/D1 bindings, routes, custom domain, and secrets - full edge app scaffold.
aws-amplify-app
Every branch build is served at a public amplifyapp.com URL, and basic auth, the switch that puts a password on it, is off; auto branch creation builds every branch anyone pushes; the repository token lands in state; and environment variables are plaintext. Basic auth on every non-production branch (public by name), auto creation off, exactly one production branch, the custom domain attached.
azure-static-web-app
Globally distributed hosting for static sites and SPAs on Azure Static Web Apps with optional serverless APIs, free auto-renewing TLS, and a built-in global CDN - defaulting to the cost-free Free SKU.