OriginPostQuantumEncryption

Source: src/Cloudflare/OriginPostQuantumEncryption/OriginPostQuantumEncryption.ts

Origin Post-Quantum Encryption for a Cloudflare zone (/zones/{zone_id}/cache/origin_post_quantum_encryption).

Controls whether Cloudflare uses post-quantum (PQ) key agreement on the TLS connections it makes to your origin. Despite living under the /cache/ API path, this is an SSL/origin-connection setting, not a caching one.

The setting is a singleton — it always exists on every zone with a Cloudflare default of "supported", so this resource never creates or deletes anything physical. Reconcile updates the setting when the observed value differs from the desired one; destroy restores the value the setting had before Alchemy first managed it (captured as initialValue).

Managing the setting

Prefer post-quantum key agreement to the origin

const zone = yield* Cloudflare.Zone.Zone("Site", { name: "example.com" });

yield* Cloudflare.OriginPostQuantumEncryption.OriginPostQuantumEncryption("OriginPqe", {
  zoneId: zone.zoneId,
  value: "preferred",
});

Disable post-quantum key agreement to the origin

yield* Cloudflare.OriginPostQuantumEncryption.OriginPostQuantumEncryption("OriginPqe", {
  zoneId: zone.zoneId,
  value: "off",
});

Pin the Cloudflare default explicitly

yield* Cloudflare.OriginPostQuantumEncryption.OriginPostQuantumEncryption("OriginPqe", {
  zoneId: zone.zoneId,
  value: "supported",
});