From 816d79760d9e686329175f02a8f1d57703ea44ec Mon Sep 17 00:00:00 2001
From: Will Anderson <will@neuralplatform.ai>
Date: Fri, 24 Apr 2026 01:12:55 -0500
Subject: [PATCH] add alpha/beta/gamma subdomains on neurontechnologies.ai

- Tunnel ingress rules for alpha/beta/gamma.neurontechnologies.ai
- DNS CNAME records pointing to legion tunnel
- k8s ingress rules routing to neuron-alpha/beta/gamma services (port 8001)
- TLS certs via cert-manager for new hostnames
---
 servers/legion/dns-neurontechnologies.tf | 44 ++++++++++++++++++------
 servers/legion/k8s/neuron/ingress.yaml   | 33 ++++++++++++++++++
 servers/legion/main.tf                   | 27 +++++++++++++++
 3 files changed, 94 insertions(+), 10 deletions(-)

diff --git a/servers/legion/dns-neurontechnologies.tf b/servers/legion/dns-neurontechnologies.tf
index b7e9b10..2323c90 100644
--- a/servers/legion/dns-neurontechnologies.tf
+++ b/servers/legion/dns-neurontechnologies.tf
@@ -43,6 +43,33 @@ resource "cloudflare_record" "nt_tunnel_stage" {
   ttl     = 1
 }
 
+resource "cloudflare_record" "nt_tunnel_alpha" {
+  zone_id = local.zone_neurontechnologies_ai
+  name    = "alpha"
+  type    = "CNAME"
+  content = "${var.cloudflare_tunnel_id}.cfargotunnel.com"
+  proxied = true
+  ttl     = 1
+}
+
+resource "cloudflare_record" "nt_tunnel_beta" {
+  zone_id = local.zone_neurontechnologies_ai
+  name    = "beta"
+  type    = "CNAME"
+  content = "${var.cloudflare_tunnel_id}.cfargotunnel.com"
+  proxied = true
+  ttl     = 1
+}
+
+resource "cloudflare_record" "nt_tunnel_gamma" {
+  zone_id = local.zone_neurontechnologies_ai
+  name    = "gamma"
+  type    = "CNAME"
+  content = "${var.cloudflare_tunnel_id}.cfargotunnel.com"
+  proxied = true
+  ttl     = 1
+}
+
 # ── Google Workspace MX records ──────────────────────────────────────────────
 resource "cloudflare_record" "nt_mx_1" {
   zone_id  = local.zone_neurontechnologies_ai
@@ -117,13 +144,10 @@ resource "cloudflare_record" "nt_google_verify" {
 }
 
 # ── DKIM ──────────────────────────────────────────────────────────────────────
-# Add after Google Workspace generates your DKIM key.
-# Google Admin Console → Apps → Google Workspace → Gmail → Authenticate email
-#
-# resource "cloudflare_record" "nt_dkim" {
-#   zone_id = local.zone_neurontechnologies_ai
-#   name    = "google._domainkey"
-#   type    = "TXT"
-#   content = "v=DKIM1; k=rsa; p=REPLACE_WITH_YOUR_DKIM_PUBLIC_KEY"
-#   ttl     = 3600
-# }
+resource "cloudflare_record" "nt_dkim" {
+  zone_id = local.zone_neurontechnologies_ai
+  name    = "google._domainkey"
+  type    = "TXT"
+  content = "v=DKIM1;k=rsa;p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA3CbdL8/TV2cklPmt/qb5cjtNYZwWQEOe2xIDDDnNTW/MkJfW7JTQP8v/OAOPACmJqEAG/fPdb8qwAn7S3YrYoPR2QG+CkBym3dq55IWEcMondfKVX2URnoelLlwt7juLwk6115Tgn0m0sGcqZvvF662xygrGb3SLkF6aeeO4fc6u5TsgkxBS5W2DngprbtlUmj+PjpIY5T3Jb6EWB3O2zbnKHKvDbYtaMq2P+fDr/EVM+qERdUyFjIFR41N7dbTHIP60+Sv4lbm5yd6FA8HCGFdeF6q2gTwxwh9bVMpe6oqHzGr1Z14qtwNohRdKWiwhYzowswIOPTK5VV2FwnKu9QIDAQAB"
+  ttl     = 3600
+}
diff --git a/servers/legion/k8s/neuron/ingress.yaml b/servers/legion/k8s/neuron/ingress.yaml
index 7c416d1..f499be5 100644
--- a/servers/legion/k8s/neuron/ingress.yaml
+++ b/servers/legion/k8s/neuron/ingress.yaml
@@ -15,12 +15,15 @@ spec:
     - secretName: neuron-alpha-tls
       hosts:
         - neuron-alpha.neuralplatform.ai
+        - alpha.neurontechnologies.ai
     - secretName: neuron-beta-tls
       hosts:
         - neuron-beta.neuralplatform.ai
+        - beta.neurontechnologies.ai
     - secretName: neuron-gamma-tls
       hosts:
         - neuron-gamma.neuralplatform.ai
+        - gamma.neurontechnologies.ai
   rules:
     - host: neuron.neuralplatform.ai
       http:
@@ -42,6 +45,16 @@ spec:
                 name: neuron-alpha
                 port:
                   number: 8001
+    - host: alpha.neurontechnologies.ai
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: neuron-alpha
+                port:
+                  number: 8001
     - host: neuron-beta.neuralplatform.ai
       http:
         paths:
@@ -52,6 +65,16 @@ spec:
                 name: neuron-beta
                 port:
                   number: 8001
+    - host: beta.neurontechnologies.ai
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: neuron-beta
+                port:
+                  number: 8001
     - host: neuron-gamma.neuralplatform.ai
       http:
         paths:
@@ -62,3 +85,13 @@ spec:
                 name: neuron-gamma
                 port:
                   number: 8001
+    - host: gamma.neurontechnologies.ai
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: neuron-gamma
+                port:
+                  number: 8001
diff --git a/servers/legion/main.tf b/servers/legion/main.tf
index e02a6a7..b0f01ec 100644
--- a/servers/legion/main.tf
+++ b/servers/legion/main.tf
@@ -180,6 +180,33 @@ resource "cloudflare_zero_trust_tunnel_cloudflared_config" "legion" {
       }
     }
 
+    # alpha.neurontechnologies.ai — experiment zone 1 (CI auto-deploys here)
+    ingress_rule {
+      hostname = "alpha.neurontechnologies.ai"
+      service  = "https://traefik.kube-system.svc:443"
+      origin_request {
+        no_tls_verify = true
+      }
+    }
+
+    # beta.neurontechnologies.ai — experiment zone 2
+    ingress_rule {
+      hostname = "beta.neurontechnologies.ai"
+      service  = "https://traefik.kube-system.svc:443"
+      origin_request {
+        no_tls_verify = true
+      }
+    }
+
+    # gamma.neurontechnologies.ai — experiment zone 3
+    ingress_rule {
+      hostname = "gamma.neurontechnologies.ai"
+      service  = "https://traefik.kube-system.svc:443"
+      origin_request {
+        no_tls_verify = true
+      }
+    }
+
     # sign.neurontechnologies.ai — Docuseal e-signature
     ingress_rule {
       hostname = "sign.neurontechnologies.ai"