Installation with Terraform

Prerequisites

• DATADOME_SERVER_SIDE_KEY available in your DataDome dashboard,
• DATADOME_CLIENT_SIDE_KEY available in your DataDome dashboard,
• up-to-date Terraform,
• CLOUDFLARE_API_TOKEN for Workers script and routes edits following this guide,
• CLOUDFLARE_ZONE_ID available in your Domain Overview page in Cloudflare,
• CLOUDFLARE_ACCOUNT_ID available in your Domain Overview page in Cloudflare.

Protect your traffic

1. Download the latest version of our Cloudflare Worker script.
2. Create an empty terraform file, for example datadome_worker.tf and paste the following code:

terraform {
  required_providers {
    cloudflare = {
      source = "cloudflare/cloudflare"
      version = "~> 4"
    }
  }
}

provider "cloudflare" {
  api_token = "<CLOUDFLARE_API_TOKEN>" # update value
}

variable "datadome_server_side_key" {}
variable "datadome_client_side_key" {}

resource "cloudflare_worker_route" "catch_all_route" {
  zone_id = "<CLOUDFLARE_ZONE_ID>" # update value
  pattern = "<CLOUDFLARE_ROUTE_PATTERN>"# update value https://developers.cloudflare.com/workers/configuration/routing/routes/
  script_name = cloudflare_worker_script.datadome_script.name
}

resource "cloudflare_worker_script" "datadome_worker" {
  account_id = "<CLOUDFLARE_ACCOUNT_ID>" # update value
  name       = "datadome_worker"
  content    = file("<PATH_TO_THE_DATADOME.TS_FILE")  # update value

  	  secret_text_binding {
	    name = "DATADOME_SERVER_SIDE_KEY"
	    text = var.datadome_server_side_key
	  }

  	  secret_text_binding {
	    name = "DATADOME_CLIENT_SIDE_KEY"
	    text = var.datadome_client_side_key
	  }

}

3. Update it with your personal values.
4. Create the secret for datadome_server_side_key to hold the value of your DataDome server-side key you can find in your DataDome Dashboard with:

export TF_VAR_datadome_server_side_key=<YOUR DATADOME_SERVER_SIDE_KEY>

5. Create the secret for datadome_client_side_key to hold the value of your DataDome client-side key you can find in your DataDome Dashboard with:

export TF_VAR_datadome_client_side_key=<YOUR DATADOME_CLIENT_SIDE_KEY>

6. Run

terraform init

7. Run

terraform plan

Two ressources will be created: the Worker script and the Worker route.

8. Run

terraform apply

Congrats! You can now see your traffic in your DataDome dashboard.

Configuration

The configuration is done inside the script, using constants.

Server-side settings

 /\.(avi|flv|mka|mkv|mov|mp4|mpeg|mpg|mp3|flac|ogg|ogm|opus|wav|webm|webp|bmp|gif|ico|jpeg|jpg|png|svg|svgz|swf|eot|otf|ttf|woff|woff2|css|less|js|map)$/i

Client-side settings

Update with Terraform

1. Download the latest version of our Cloudflare Worker script.
2. Paste the content of the datadome.ts file into the file used for the content of the script of your Worker.
3. Run

terraform plan

1 ressource will be changed.

4. Run

terraform apply

Uninstallation with Terraform

To delete the DataDome Worker and its script, run from the location of your datadome_worker.tf and terraform.tfstate:

terraform destroy -target cloudflare_worker_script.datadome_worker

Logging

DatDome custom logging

1. Inside the Cloudflare Dashboard, go to the DataDome Worker's page.
2. Click onSettings, go to the Observability section.
3. Click on the pen icon next to Workers Logs.

4. Enable logs.
5. Click on Deploy.
6. You will see the logs inside the Logs tab.
   By default, DataDome logs errors only (such as errors in the configuration). If you want to have detailed logs for debugging, you can set DATADOME_ENABLE_DEBUGGINGto true.

DataDome logs format

The DataDome custom logs have the following format:

{
  "step": "string",
  "result": "string", 
  "reason": "string",
  "details": {
    "key": "value"
  },
  "company": "DataDome",
  "line": 123
}

Logpush

You can use Logpush to send logs to a destination supported by Logpush (Datadog, Splunk, S3 Bucket…).

❗️

Cloudflare plan

Logpush is available to customers on Cloudflare’s Enterprise plan.

Update the Worker’s script

1. Fill the DATADOME_LOGPUSH_CONFIGURATION value with the name of the values you want, as an Array of Strings.
   The possible values are available in the Enriched headers page.

Eg:

DATADOME_LOGPUSH_CONFIGURATION = "["X-DataDome-botname", "X-DataDome-isbot", "x-datadomeresponse"]"

Enable Logpush

2. Inside the Cloudflare Dashboard, go to the DataDome Worker's page.
3. Click onSettings, go to the Observability section.
4. Click on Enable next to Logpush.