From 598131f655bd9edae46fe02c037762c003a51e4d Mon Sep 17 00:00:00 2001
From: Grant Slater <github@firefishy.com>
Date: Sat, 22 Nov 2025 22:13:25 +0000
Subject: [PATCH] web: ignore faulty Cloudflare rum posts

---
 cookbooks/web/templates/default/apache.frontend.erb | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/cookbooks/web/templates/default/apache.frontend.erb b/cookbooks/web/templates/default/apache.frontend.erb
index 9c6d41888..59325bd29 100644
--- a/cookbooks/web/templates/default/apache.frontend.erb
+++ b/cookbooks/web/templates/default/apache.frontend.erb
@@ -119,6 +119,10 @@ ErrorLog /var/log/apache2/error.log
   RewriteCond %{HTTP_USER_AGENT} "GoogleAssociationService"
   RewriteRule "^/\.well-known/assetlinks\.json$" - [R=429,L]
 
+  # Drop faulty Cloudflare POST /cdn-cgi/rum submissions reaching us
+  RewriteCond %{REQUEST_METHOD} =POST
+  RewriteRule ^/cdn-cgi/rum$ - [F,L]
+
   #
   # Force special MIME type for crossdomain.xml files
   #
-- 
2.39.5