Manage CDN resources with Terraform v2

Documentation Index

Fetch the complete documentation index at: https://gcore.com/docs/llms.txt

Use this file to discover all available pages before exploring further.

​

Key differences from provider v0

​

Workflow

terraform plan

terraform apply

​

Provider configuration

terraform {
  required_providers {
    gcore = {
      source  = "G-Core/gcore"
      version = "~> 2.0"
    }
  }
}

provider "gcore" {
  api_key = var.api_key
}

​

Manage origin groups

​

Create an origin group with host origins

1. Open the main.tf file with the Gcore provider configuration.
2. Copy the code below and customize the values:

resource "gcore_cdn_origin_group" "example" {
  name     = "example-group"
  use_next = true
  sources = [
    {
      source  = "origin.example.com"
      enabled = true
    },
    {
      source  = "backup.example.com"
      enabled = true
      backup  = true
    }
  ]
}

3. Configure the origin group.

• Specify name — the display name in the Customer Portal.
• Set use_next:
  • true — if the first active origin fails, CDN tries remaining active origins in order, then backup origins.
  • false — if the first active origin fails, CDN skips remaining active origins and immediately uses backup origins.
• For each object in sources:
  • Specify source — the domain or IP of the origin. The domain must resolve in DNS.
  • Set enabled = true to make the origin active.
  • (optional) Set backup = true to designate the origin as a backup.
  • (optional) Set host_header_override — custom Host header for this specific origin.
• (optional) Set proxy_next_upstream — a list of conditions that trigger failover to the next origin. Accepted values: error, timeout, invalid_header, http_403, http_404, http_429, http_500, http_502, http_503, http_504. Default: ["error", "timeout"].

​

Create an origin group with an S3 origin

1. Open the main.tf file.
2. Copy the code below and customize the values:

resource "gcore_cdn_origin_group" "s3_example" {
  name                   = "s3-example-group"
  use_next               = false
  s3_credentials_version = 1

  sources = [
    {
      enabled     = true
      origin_type = "s3"
      config = {
        s3_type              = "amazon"
        s3_bucket_name       = "my-bucket"
        s3_region            = "us-east-1"
        s3_access_key_id     = "AKIAIOSFODNN7EXAMPLE"
        s3_secret_access_key = "wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY"
      }
    }
  ]
}

3. Configure the S3 origin.

• Set s3_credentials_version — an integer incremented each time credentials are rotated, which forces Terraform to re-send the write-only values. Required when any source has origin_type = "s3".
• For each S3 source object in sources:
  • Set origin_type = "s3".
  • In the nested config object:
    • Set s3_type: "amazon" for Amazon S3, "other" for S3-compatible storage.
    • Specify s3_bucket_name.
    • Specify s3_region — required when s3_type = "amazon".
    • Specify s3_storage_hostname — required when s3_type = "other".
    • Specify s3_access_key_id and s3_secret_access_key — these are write-only and will not appear in Terraform state.

​

Manage CDN resources

​

Create a basic CDN resource

resource "gcore_cdn_resource" "example" {
  cname           = "cdn.example.com"
  origin_group    = gcore_cdn_origin_group.example.id
  origin_protocol = "HTTPS"
}

• Specify cname — the custom domain for content delivery. After applying, create a CNAME DNS record pointing this domain to the Gcore CDN zone shown in the Portal setup guide.
• Specify either origin_group (ID of an origin group) or origin (a single origin domain or IP).
• Set origin_protocol:
  • "MATCH" — CDN uses the same protocol as the client request.
  • "HTTP" — CDN always requests the origin over HTTP.
  • "HTTPS" — CDN always requests the origin over HTTPS.
• (optional) Add secondary_hostnames — a set of additional CNAMEs.
• (optional) Add name — a display name for the resource in the Portal.
• (optional) Add description — a free-text label.
• (optional) Set active = false to suspend delivery. Defaults to true.

​

Configure delivery options

resource "gcore_cdn_resource" "example" {
  cname           = "cdn.example.com"
  origin_group    = gcore_cdn_origin_group.example.id
  origin_protocol = "HTTPS"

  options = {
    edge_cache_settings = {
      enabled = true
      value   = "86400s"
      custom_values = {
        "403" = "1000s"
        "404" = "50s"
      }
    }

    browser_cache_settings = {
      enabled = true
      value   = "3600s"
    }

    gzip_on = {
      enabled = true
      value   = true
    }

    redirect_http_to_https = {
      enabled = true
      value   = true
    }

    allowed_http_methods = {
      enabled = true
      value   = ["GET", "HEAD"]
    }

    cors = {
      enabled = true
      value   = ["*"]
      always  = true
    }

    tls_versions = {
      enabled = true
      value   = ["TLSv1.2", "TLSv1.3"]
    }
  }
}

​

Enable SSL delivery

resource "gcore_cdn_resource" "example" {
  cname           = "cdn.example.com"
  origin_group    = gcore_cdn_origin_group.example.id
  origin_protocol = "HTTPS"
  ssl_enabled     = true
  ssl_data        = gcore_cdn_certificate.example.id
}

• Set ssl_enabled = true to deliver content over HTTPS.
• Set ssl_data to the ID of a gcore_cdn_certificate resource.

​

Enable origin SSL verification

resource "gcore_cdn_resource" "example" {
  cname             = "cdn.example.com"
  origin_group      = gcore_cdn_origin_group.example.id
  origin_protocol   = "HTTPS"
  proxy_ssl_enabled = true
  proxy_ssl_ca      = gcore_cdn_trusted_ca_certificate.example.id
  proxy_ssl_data    = gcore_cdn_certificate.client_cert.id
}

• proxy_ssl_enabled = true — verifies the origin server’s SSL certificate.
• proxy_ssl_ca — ID of the CA certificate used to verify the origin. References gcore_cdn_trusted_ca_certificate.
• proxy_ssl_data — ID of a client certificate presented to the origin for mTLS. Must be a manually uploaded gcore_cdn_certificate (not automated).

​

Manage SSL certificates

​

Issue a Let’s Encrypt certificate automatically

resource "gcore_cdn_certificate" "example" {
  name      = "example-cert"
  automated = true
}

• Specify name — must be unique within the account.
• Set automated = true to request a Let’s Encrypt certificate.

​

Upload a custom SSL certificate

resource "gcore_cdn_certificate" "custom" {
  name                       = "my-custom-cert"
  ssl_certificate_wo         = file("cert.pem")
  ssl_private_key_wo         = file("key.pem")
  ssl_certificate_wo_version = 1
}

• ssl_certificate_wo — the public certificate in PEM format. Include the full chain.
• ssl_private_key_wo — the private key in PEM format.
• ssl_certificate_wo_version — increment this value to force Terraform to re-send the certificate to the API. Required when using write-only certificate fields.
• (optional) Set validate_root_ca = true to verify that the certificate chain is trusted by a CA.

​

Manage CA certificates for origin verification

resource "gcore_cdn_trusted_ca_certificate" "example" {
  name            = "my-origin-ca"
  ssl_certificate = file("ca.pem")
}

• Specify name — must be unique within the account.
• Specify ssl_certificate — the CA certificate in PEM format. Each certificate in the chain must end with a newline character.

​

Manage CDN resource rules

​

Create a rule

resource "gcore_cdn_resource_rule" "images" {
  resource_id = gcore_cdn_resource.example.id
  name        = "PNG images"
  rule        = "/images/*.png"
  rule_type   = 0

  options = {
    edge_cache_settings = {
      enabled = true
      value   = "604800s"
    }
    gzip_on = {
      enabled = true
      value   = true
    }
  }
}

• Specify resource_id — the ID of the CDN resource the rule belongs to.
• Specify name — the display name in the Customer Portal.
• Specify rule — the path pattern. Must start with /.
• Set rule_type:
  • 0 — path pattern with wildcards (e.g., /images/*.png).
  • 1 — regular expression (must start with ^/).
• (optional) Add an options map with the same options available on the CDN resource.
• (optional) Set active = false to disable the rule without deleting it.
• (optional) Set weight — rule execution priority. Lower number = higher priority.
• (optional) Set origin_group — ID of an alternative origin group for requests matched by this rule.
• (optional) Set override_origin_protocol — override the origin protocol for matched requests ("HTTP", "HTTPS", or "MATCH").

​

Manage rule templates

resource "gcore_cdn_rule_template" "static_assets" {
  name      = "static-assets-template"
  rule      = "/static/*"
  rule_type = 0

  options = {
    edge_cache_settings = {
      enabled = true
      value   = "604800s"
    }
    gzip_on = {
      enabled = true
      value   = true
    }
  }
}

• (optional) Specify name — the template display name.
• Specify rule — the path pattern.
• Set rule_type — 0 for path patterns, 1 for regular expressions.
• Add an options map with the delivery options to apply.
• (optional) Set weight — execution priority.
• (optional) Set override_origin_protocol — override the origin protocol.