Set minimum TLS version on all Cloudflare zones

set_min_tls_version.rb

#!/usr/bin/env ruby

# Usage: CLOUDFLARE_TOKEN=[...] ./set_min_tls_version.rb
# Supplied token requires permissions zone:read and zone_settings:edit.

require 'faraday'
require 'json'

# ultra-minimal cloudflare api wrapper to make it easy to follow API docs: https://api.cloudflare.com/
CLOUDFLARE_API_HOST = 'api.cloudflare.com'
CLOUDFLARE_API_BASE = '/client/v4/'

def call_cloudflare_api(method, endpoint, params = {}, headers = {})
  default_headers = { 'Authorization': 'Bearer ' + ENV['CLOUDFLARE_TOKEN'], 'Content-Type': 'application/json' }
  stringify_params = ['put', 'post', 'patch'].include?(method.to_s.downcase)

  conn = Faraday.new("https://#{CLOUDFLARE_API_HOST}/")
  response = conn.send(method, CLOUDFLARE_API_BASE + endpoint, stringify_params ? params.to_json : params, default_headers.merge(headers))
  if response.status == 200
    json = JSON.parse(response.body)
  else
    raise StandardError, "Status: #{response.status} != 200"
  end
end

# iterate over all domains
page = 1
per_page = 40

loop do
  json = call_cloudflare_api(:get, 'zones', page: page, per_page: per_page)

  if json['success'] == true
    result = json['result']
    result.each do |zone|
      puts "#{zone['name']} / #{zone['id']}"

      json = call_cloudflare_api(:get, "zones/#{zone['id']}/settings/min_tls_version")
      if json['success'] == true && (version = json['result']['value'])
        print " - Minimum TLS Version: #{version}"
        if version != '1.2'
          json = call_cloudflare_api(:patch, "zones/#{zone['id']}/settings/min_tls_version", value: '1.2')
          if json['success'] == true && (version = json['result']['value'])
            print " ==> #{version} (updated)"
          end
        end
      else
        puts "Error(s): #{errors.join('; ')}"
      end
      puts "\n"
    end

    break if result.size < per_page
  else
    puts "Error(s): #{errors.join('; ')}"
    break
  end

  page += 1
end