From 538bba323d90c360b14dca11d4fcd88e276cc19c Mon Sep 17 00:00:00 2001
From: Will Anderson <will@neuralplatform.ai>
Date: Sun, 12 Apr 2026 02:34:35 -0500
Subject: [PATCH] feat: add prowlarr.voidstash.xyz DNS + tunnel rule

---
 servers/legion/main.tf      |  8 ++++++++
 servers/legion/voidstash.tf | 10 +++++++++-
 2 files changed, 17 insertions(+), 1 deletion(-)

diff --git a/servers/legion/main.tf b/servers/legion/main.tf
index 7a97028..60e5ccd 100644
--- a/servers/legion/main.tf
+++ b/servers/legion/main.tf
@@ -110,6 +110,14 @@ resource "cloudflare_tunnel_config" "legion" {
       }
     }
 
+    ingress_rule {
+      hostname = "prowlarr.voidstash.xyz"
+      service  = "https://traefik.kube-system.svc:443"
+      origin_request {
+        no_tls_verify = true
+      }
+    }
+
     # Catch-all — must be last
     ingress_rule {
       service = "http_status:404"
diff --git a/servers/legion/voidstash.tf b/servers/legion/voidstash.tf
index 008f5fe..a9e4370 100644
--- a/servers/legion/voidstash.tf
+++ b/servers/legion/voidstash.tf
@@ -1,4 +1,4 @@
-# voidstash.xyz — private media stack (Stash + Whisparr)
+# voidstash.xyz — private media stack (Stash + Whisparr + Prowlarr)
 # Zone created via API: ba74d72edbea8023ff4ed6cb27487154
 # Nameservers delegated to Cloudflare from Porkbun
 
@@ -22,3 +22,11 @@ resource "cloudflare_record" "whisparr" {
   content = "${var.cloudflare_tunnel_id}.cfargotunnel.com"
   proxied = true
 }
+
+resource "cloudflare_record" "prowlarr_voidstash" {
+  zone_id = data.cloudflare_zone.voidstash.id
+  name    = "prowlarr"
+  type    = "CNAME"
+  content = "${var.cloudflare_tunnel_id}.cfargotunnel.com"
+  proxied = true
+}