From 8aa01bc840c83de658b89cfcb9a3056860c23fc6 Mon Sep 17 00:00:00 2001
From: Will Anderson <will@neuralplatform.ai>
Date: Thu, 16 Apr 2026 21:55:19 -0500
Subject: [PATCH] infra: add neurontechnologies.ai Cloudflare routing and k8s
 namespaces
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- Add CNAME records for @, www, dev, stage → legion tunnel
- Add tunnel ingress rules for neurontechnologies.ai, www, dev, stage
- Add neuron-dev, neuron-stage, neuron-prod k8s namespaces on Legion
---
 servers/legion/dns-neurontechnologies.tf | 41 ++++++++++++++++++++++++
 servers/legion/main.tf                   | 35 ++++++++++++++++++++
 servers/legion/neuron-technologies.tf    | 39 ++++++++++++++++++++++
 3 files changed, 115 insertions(+)
 create mode 100644 servers/legion/neuron-technologies.tf

diff --git a/servers/legion/dns-neurontechnologies.tf b/servers/legion/dns-neurontechnologies.tf
index 8f2a600..b7e9b10 100644
--- a/servers/legion/dns-neurontechnologies.tf
+++ b/servers/legion/dns-neurontechnologies.tf
@@ -2,6 +2,47 @@
 # Google Workspace MX, SPF, and DMARC records.
 # After signing up for Google Workspace, add your verification TXT record below.
 
+# ── Cloudflare tunnel CNAMEs ─────────────────────────────────────────────────
+# All three environments route through the legion tunnel to Traefik.
+# proxied = true enables Cloudflare proxy (CDN, DDoS, SSL termination).
+# ttl = 1 means "auto" when proxied.
+
+resource "cloudflare_record" "nt_tunnel_prod" {
+  zone_id = local.zone_neurontechnologies_ai
+  name    = "@"
+  type    = "CNAME"
+  content = "${var.cloudflare_tunnel_id}.cfargotunnel.com"
+  proxied = true
+  ttl     = 1
+}
+
+resource "cloudflare_record" "nt_tunnel_www" {
+  zone_id = local.zone_neurontechnologies_ai
+  name    = "www"
+  type    = "CNAME"
+  content = "${var.cloudflare_tunnel_id}.cfargotunnel.com"
+  proxied = true
+  ttl     = 1
+}
+
+resource "cloudflare_record" "nt_tunnel_dev" {
+  zone_id = local.zone_neurontechnologies_ai
+  name    = "dev"
+  type    = "CNAME"
+  content = "${var.cloudflare_tunnel_id}.cfargotunnel.com"
+  proxied = true
+  ttl     = 1
+}
+
+resource "cloudflare_record" "nt_tunnel_stage" {
+  zone_id = local.zone_neurontechnologies_ai
+  name    = "stage"
+  type    = "CNAME"
+  content = "${var.cloudflare_tunnel_id}.cfargotunnel.com"
+  proxied = true
+  ttl     = 1
+}
+
 # ── Google Workspace MX records ──────────────────────────────────────────────
 resource "cloudflare_record" "nt_mx_1" {
   zone_id  = local.zone_neurontechnologies_ai
diff --git a/servers/legion/main.tf b/servers/legion/main.tf
index 7de5bb1..e2c4a50 100644
--- a/servers/legion/main.tf
+++ b/servers/legion/main.tf
@@ -118,6 +118,41 @@ resource "cloudflare_zero_trust_tunnel_cloudflared_config" "legion" {
       service  = "ssh://localhost:30022"
     }
 
+    # neurontechnologies.ai — Neuron Technologies prod (neuron-prod namespace)
+    ingress_rule {
+      hostname = "neurontechnologies.ai"
+      service  = "https://traefik.kube-system.svc:443"
+      origin_request {
+        no_tls_verify = true
+      }
+    }
+
+    ingress_rule {
+      hostname = "www.neurontechnologies.ai"
+      service  = "https://traefik.kube-system.svc:443"
+      origin_request {
+        no_tls_verify = true
+      }
+    }
+
+    # dev.neurontechnologies.ai — Neuron Technologies dev (neuron-dev namespace)
+    ingress_rule {
+      hostname = "dev.neurontechnologies.ai"
+      service  = "https://traefik.kube-system.svc:443"
+      origin_request {
+        no_tls_verify = true
+      }
+    }
+
+    # stage.neurontechnologies.ai — Neuron Technologies stage (neuron-stage namespace)
+    ingress_rule {
+      hostname = "stage.neurontechnologies.ai"
+      service  = "https://traefik.kube-system.svc:443"
+      origin_request {
+        no_tls_verify = true
+      }
+    }
+
     # Catch-all — must be last
     ingress_rule {
       service = "http_status:404"
diff --git a/servers/legion/neuron-technologies.tf b/servers/legion/neuron-technologies.tf
new file mode 100644
index 0000000..8e6cba7
--- /dev/null
+++ b/servers/legion/neuron-technologies.tf
@@ -0,0 +1,39 @@
+# Neuron Technologies — dev / stage / prod namespaces
+# All other resources (Deployments, Services, IngressRoutes, ExternalSecrets, PVCs)
+# are managed by Argo CD from k8s/neuron-technologies/{env}/
+
+resource "kubernetes_namespace" "neuron_dev" {
+  metadata {
+    name = "neuron-dev"
+    labels = {
+      managed-by  = "terraform"
+      tier        = "apps"
+      environment = "dev"
+      app         = "neuron-technologies"
+    }
+  }
+}
+
+resource "kubernetes_namespace" "neuron_stage" {
+  metadata {
+    name = "neuron-stage"
+    labels = {
+      managed-by  = "terraform"
+      tier        = "apps"
+      environment = "stage"
+      app         = "neuron-technologies"
+    }
+  }
+}
+
+resource "kubernetes_namespace" "neuron_prod" {
+  metadata {
+    name = "neuron-prod"
+    labels = {
+      managed-by  = "terraform"
+      tier        = "apps"
+      environment = "prod"
+      app         = "neuron-technologies"
+    }
+  }
+}