f00a96c40b
pulumi config set --secret writes ciphertext into Pulumi.dev.yaml, which is
committed, alongside the encryptionsalt. This stack's secrets provider is a
passphrase, and the passphrase is the empty string documented three lines above
it in the README. That combination is not encryption — it is the token spelled
differently, readable by anyone with access to this repo.
pulumi-cloudflare falls back to CLOUDFLARE_API_TOKEN when cloudflare:apiToken
is absent from config, so __main__.py is unchanged and so is pulumi up. The
token simply stops living in git.
The empty passphrase is left as it is. It protects nothing precisely because
nothing secret is in config any more, and that is what makes it harmless; the
notes now say to change the secrets provider before adding a secret at rest.
This does NOT un-expose the existing token. The value is still readable in this
branch's history at 94dd775, and history rewriting would not help either, since
it has been pushed since 2026-09-09. Only rotating the credential closes that;
notes/CLOUDFLARE.md now covers how, including checking Last used before
deleting the token, which is the only record of whether it was ever used.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
1.9 KiB
Cloudflare
Getting the Cloudflare Account ID
-
Log in to the Cloudflare dashboard: https://dash.cloudflare.com
-
Go to Compute > Workers & Pages in the left sidebar.
-
Account ID will be on the right-hand sidebar of the Overview page. It's a 32-character hex string.
Cloudflare Token Creation
-
Go to the token page https://dash.cloudflare.com/profile/api-tokens
-
Click "Create Token"
-
Find "Edit Cloudflare Workers" in the templates list, click "Use template"
-
Name the token.
-
Account Resources: Include: The account
-
Zone Resources: Include: The zone
-
Click "Continue to summary"
-
Click "Create Token"
-
The token will only be displayed once.
Where the token goes
Into the environment, never into pulumi config.
export CLOUDFLARE_API_TOKEN=...
pulumi up
pulumi-cloudflare falls back to CLOUDFLARE_API_TOKEN when cloudflare:apiToken is
not set in config, so this needs no change to __main__.py.
Do not run pulumi config set cloudflare:apiToken --secret. On this stack that writes
ciphertext into the committed Pulumi.dev.yaml, next to a committed salt, unlocked by a
passphrase documented in ../README.md. See ./PASSPHRASE.md.
For anything unattended later, put it in a GitHub Actions secret and export it in the job rather than committing it in any form.
If a token has been exposed
Rotating the value is the only fix — rewriting git history does not help, because anyone with repo access has already been able to read it for as long as it was pushed.
- https://dash.cloudflare.com/profile/api-tokens, signed in as the user who created it (tokens are user-scoped, so only that user sees them).
- Check Last used before doing anything — deleting the token destroys the only record of whether it was used.
- Roll to keep the token and issue a new value, or Delete and create a fresh one from the steps above.