From 075a25fb10330f5bf59baee6685e86413a149870 Mon Sep 17 00:00:00 2001
From: Will Anderson <will@neuralplatform.ai>
Date: Wed, 22 Apr 2026 01:34:26 -0500
Subject: [PATCH] fix vpn.neuralplatform.ai: replace A record with proxied
 CNAME through Cloudflare tunnel

---
 servers/legion/dns-neuralplatform.tf | 13 +++++++++++++
 1 file changed, 13 insertions(+)
 create mode 100644 servers/legion/dns-neuralplatform.tf

diff --git a/servers/legion/dns-neuralplatform.tf b/servers/legion/dns-neuralplatform.tf
new file mode 100644
index 0000000..9d2e070
--- /dev/null
+++ b/servers/legion/dns-neuralplatform.tf
@@ -0,0 +1,13 @@
+# ── neuralplatform.ai DNS ─────────────────────────────────────────────────────
+# Infrastructure and platform service subdomains.
+# All route through the legion Cloudflare tunnel to Traefik unless noted.
+
+# vpn.neuralplatform.ai — Headscale coordination server (Tailscale control plane)
+resource "cloudflare_record" "np_vpn" {
+  zone_id = local.zone_neuralplatform_ai
+  name    = "vpn"
+  type    = "CNAME"
+  content = "${var.cloudflare_tunnel_id}.cfargotunnel.com"
+  proxied = true
+  ttl     = 1
+}