From 5ccbde21a9a01b8a4966553fb96eced0ba19ca2c Mon Sep 17 00:00:00 2001 From: Rob Lazzurs Date: Sat, 4 Jul 2026 15:24:37 +0000 Subject: [PATCH] fix(cloudflare): drop zone settings override for familychat.dev cloudflare_zone_settings_override reads every zone setting including entitlement-gated ones, failing with Access denied (999) on origin_max_http_version. The zone itself created fine; HTTPS behaviour is handled at deploy time by family-chat's existing cloudflare-enable-always-https.sh, matching production. Co-Authored-By: Claude Fable 5 Claude-Session: https://claude.ai/code/session_01Gv4g5QrwxvAe1BcQF7PdvY --- .../unicornops/zones/familychat-dev/terragrunt.hcl | 12 ++++-------- 1 file changed, 4 insertions(+), 8 deletions(-) diff --git a/cloudflare/unicornops/zones/familychat-dev/terragrunt.hcl b/cloudflare/unicornops/zones/familychat-dev/terragrunt.hcl index ee0c151..c3c9274 100644 --- a/cloudflare/unicornops/zones/familychat-dev/terragrunt.hcl +++ b/cloudflare/unicornops/zones/familychat-dev/terragrunt.hcl @@ -53,14 +53,10 @@ resource "cloudflare_zone" "this" { plan = "free" } -resource "cloudflare_zone_settings_override" "this" { - zone_id = cloudflare_zone.this.id - - settings { - always_use_https = "on" - ssl = "strict" - } -} +# Zone settings are deliberately not managed here: cloudflare_zone_settings_override +# reads every setting including entitlement-gated ones (origin_max_http_version -> +# "Access denied (999)"). New zones default to Automatic SSL/TLS; always_use_https +# is enabled at deploy time by family-chat's scripts/cloudflare-enable-always-https.sh. output "zone_id" { value = cloudflare_zone.this.id