From 61ea7eaaefe6b3b1b1da9052323930ef6d3e565f Mon Sep 17 00:00:00 2001
From: Will Anderson <will@neuralplatform.ai>
Date: Thu, 16 Apr 2026 18:36:16 -0500
Subject: [PATCH] add all Cloudflare zones to Terraform, migrate tunnel config
 to non-deprecated resource

---
 servers/legion/fornax-access.tf |  2 +-
 servers/legion/main.tf          |  2 +-
 servers/legion/zones.tf         | 67 +++++++++++++++++++++++++++++++++
 3 files changed, 69 insertions(+), 2 deletions(-)
 create mode 100644 servers/legion/zones.tf

diff --git a/servers/legion/fornax-access.tf b/servers/legion/fornax-access.tf
index 2d91a43..8c25541 100644
--- a/servers/legion/fornax-access.tf
+++ b/servers/legion/fornax-access.tf
@@ -4,7 +4,7 @@
 # are unaffected by this gate.
 
 locals {
-  fornax_zone_id        = "58d3e7ec2a4c1b191e6cfa93dd27c822"
+  fornax_zone_id        = local.zone_neuralplatform_ai
   fornax_allowed_emails = [
     "andersonwilliam85@gmail.com",
     "1timlingo@gmail.com",
diff --git a/servers/legion/main.tf b/servers/legion/main.tf
index 6456fb6..7de5bb1 100644
--- a/servers/legion/main.tf
+++ b/servers/legion/main.tf
@@ -47,7 +47,7 @@ provider "cloudflare" {
 
 # Cloudflare tunnel ingress rules — all hostnames that route through the legion tunnel
 # Catch-all (http_status:404) is implicit and always last; managed by Cloudflare API
-resource "cloudflare_tunnel_config" "legion" {
+resource "cloudflare_zero_trust_tunnel_cloudflared_config" "legion" {
   account_id = var.cloudflare_account_id
   tunnel_id  = var.cloudflare_tunnel_id
 
diff --git a/servers/legion/zones.tf b/servers/legion/zones.tf
new file mode 100644
index 0000000..75cfb05
--- /dev/null
+++ b/servers/legion/zones.tf
@@ -0,0 +1,67 @@
+# ── Cloudflare Zones ──────────────────────────────────────────────────────────
+# All zones are managed here. Reference zone IDs via locals (e.g. local.zone_neuralplatform_ai)
+# rather than hardcoding IDs elsewhere in the config.
+
+resource "cloudflare_zone" "neuralplatform_ai" {
+  account_id = var.cloudflare_account_id
+  zone       = "neuralplatform.ai"
+}
+
+resource "cloudflare_zone" "neuralplatform_dev" {
+  account_id = var.cloudflare_account_id
+  zone       = "neuralplatform.dev"
+}
+
+resource "cloudflare_zone" "neuralplatform_net" {
+  account_id = var.cloudflare_account_id
+  zone       = "neuralplatform.net"
+}
+
+resource "cloudflare_zone" "neuralplatform_org" {
+  account_id = var.cloudflare_account_id
+  zone       = "neuralplatform.org"
+}
+
+resource "cloudflare_zone" "neurontechnologies_ai" {
+  account_id = var.cloudflare_account_id
+  zone       = "neurontechnologies.ai"
+}
+
+resource "cloudflare_zone" "harmonic_framework_com" {
+  account_id = var.cloudflare_account_id
+  zone       = "harmonic-framework.com"
+}
+
+resource "cloudflare_zone" "nook_family" {
+  account_id = var.cloudflare_account_id
+  zone       = "nook.family"
+}
+
+resource "cloudflare_zone" "ilih_life" {
+  account_id = var.cloudflare_account_id
+  zone       = "ilih.life"
+}
+
+resource "cloudflare_zone" "mudcraft_org" {
+  account_id = var.cloudflare_account_id
+  zone       = "mudcraft.org"
+}
+
+resource "cloudflare_zone" "voidstash_xyz" {
+  account_id = var.cloudflare_account_id
+  zone       = "voidstash.xyz"
+}
+
+# ── Zone ID locals ────────────────────────────────────────────────────────────
+locals {
+  zone_neuralplatform_ai      = cloudflare_zone.neuralplatform_ai.id
+  zone_neuralplatform_dev     = cloudflare_zone.neuralplatform_dev.id
+  zone_neuralplatform_net     = cloudflare_zone.neuralplatform_net.id
+  zone_neuralplatform_org     = cloudflare_zone.neuralplatform_org.id
+  zone_neurontechnologies_ai  = cloudflare_zone.neurontechnologies_ai.id
+  zone_harmonic_framework_com = cloudflare_zone.harmonic_framework_com.id
+  zone_nook_family            = cloudflare_zone.nook_family.id
+  zone_ilih_life              = cloudflare_zone.ilih_life.id
+  zone_mudcraft_org           = cloudflare_zone.mudcraft_org.id
+  zone_voidstash_xyz          = cloudflare_zone.voidstash_xyz.id
+}