add all Cloudflare zones to Terraform, migrate tunnel config to non-deprecated resource

servers/legion/fornax-access.tf

@@ -4,7 +4,7 @@
 # are unaffected by this gate.
 
 locals {
-  fornax_zone_id        = "58d3e7ec2a4c1b191e6cfa93dd27c822"
+  fornax_zone_id        = local.zone_neuralplatform_ai
   fornax_allowed_emails = [
     "andersonwilliam85@gmail.com",
     "1timlingo@gmail.com",

servers/legion/main.tf

@@ -47,7 +47,7 @@ provider "cloudflare" {
 
 # Cloudflare tunnel ingress rules — all hostnames that route through the legion tunnel
 # Catch-all (http_status:404) is implicit and always last; managed by Cloudflare API
-resource "cloudflare_tunnel_config" "legion" {
+resource "cloudflare_zero_trust_tunnel_cloudflared_config" "legion" {
   account_id = var.cloudflare_account_id
   tunnel_id  = var.cloudflare_tunnel_id
 

servers/legion/zones.tf

@@ -0,0 +1,67 @@
+# ── Cloudflare Zones ──────────────────────────────────────────────────────────
+# All zones are managed here. Reference zone IDs via locals (e.g. local.zone_neuralplatform_ai)
+# rather than hardcoding IDs elsewhere in the config.
+
+resource "cloudflare_zone" "neuralplatform_ai" {
+  account_id = var.cloudflare_account_id
+  zone       = "neuralplatform.ai"
+}
+
+resource "cloudflare_zone" "neuralplatform_dev" {
+  account_id = var.cloudflare_account_id
+  zone       = "neuralplatform.dev"
+}
+
+resource "cloudflare_zone" "neuralplatform_net" {
+  account_id = var.cloudflare_account_id
+  zone       = "neuralplatform.net"
+}
+
+resource "cloudflare_zone" "neuralplatform_org" {
+  account_id = var.cloudflare_account_id
+  zone       = "neuralplatform.org"
+}
+
+resource "cloudflare_zone" "neurontechnologies_ai" {
+  account_id = var.cloudflare_account_id
+  zone       = "neurontechnologies.ai"
+}
+
+resource "cloudflare_zone" "harmonic_framework_com" {
+  account_id = var.cloudflare_account_id
+  zone       = "harmonic-framework.com"
+}
+
+resource "cloudflare_zone" "nook_family" {
+  account_id = var.cloudflare_account_id
+  zone       = "nook.family"
+}
+
+resource "cloudflare_zone" "ilih_life" {
+  account_id = var.cloudflare_account_id
+  zone       = "ilih.life"
+}
+
+resource "cloudflare_zone" "mudcraft_org" {
+  account_id = var.cloudflare_account_id
+  zone       = "mudcraft.org"
+}
+
+resource "cloudflare_zone" "voidstash_xyz" {
+  account_id = var.cloudflare_account_id
+  zone       = "voidstash.xyz"
+}
+
+# ── Zone ID locals ────────────────────────────────────────────────────────────
+locals {
+  zone_neuralplatform_ai      = cloudflare_zone.neuralplatform_ai.id
+  zone_neuralplatform_dev     = cloudflare_zone.neuralplatform_dev.id
+  zone_neuralplatform_net     = cloudflare_zone.neuralplatform_net.id
+  zone_neuralplatform_org     = cloudflare_zone.neuralplatform_org.id
+  zone_neurontechnologies_ai  = cloudflare_zone.neurontechnologies_ai.id
+  zone_harmonic_framework_com = cloudflare_zone.harmonic_framework_com.id
+  zone_nook_family            = cloudflare_zone.nook_family.id
+  zone_ilih_life              = cloudflare_zone.ilih_life.id
+  zone_mudcraft_org           = cloudflare_zone.mudcraft_org.id
+  zone_voidstash_xyz          = cloudflare_zone.voidstash_xyz.id
+}