voidstash.xyz: add Cloudflare zone, CNAME records, and tunnel ingress rules

Register voidstash.xyz as the private media stack domain.
- DNS delegated from Porkbun to Cloudflare nameservers
- stash.voidstash.xyz and whisparr.voidstash.xyz CNAME to legion tunnel
- Tunnel ingress rules added for both subdomains → Traefik

servers/legion/main.tf

@@ -93,6 +93,23 @@ resource "cloudflare_tunnel_config" "legion" {
       }
     }
 
+    # voidstash.xyz — private media stack
+    ingress_rule {
+      hostname = "stash.voidstash.xyz"
+      service  = "https://traefik.kube-system.svc:443"
+      origin_request {
+        no_tls_verify = true
+      }
+    }
+
+    ingress_rule {
+      hostname = "whisparr.voidstash.xyz"
+      service  = "https://traefik.kube-system.svc:443"
+      origin_request {
+        no_tls_verify = true
+      }
+    }
+
     # Catch-all — must be last
     ingress_rule {
       service = "http_status:404"

servers/legion/voidstash.tf

@@ -0,0 +1,24 @@
+# voidstash.xyz — private media stack (Stash + Whisparr)
+# Zone created via API: ba74d72edbea8023ff4ed6cb27487154
+# Nameservers delegated to Cloudflare from Porkbun
+
+data "cloudflare_zone" "voidstash" {
+  name = "voidstash.xyz"
+}
+
+# CNAME records → Cloudflare tunnel (proxied)
+resource "cloudflare_record" "stash" {
+  zone_id = data.cloudflare_zone.voidstash.id
+  name    = "stash"
+  type    = "CNAME"
+  content = "${var.cloudflare_tunnel_id}.cfargotunnel.com"
+  proxied = true
+}
+
+resource "cloudflare_record" "whisparr" {
+  zone_id = data.cloudflare_zone.voidstash.id
+  name    = "whisparr"
+  type    = "CNAME"
+  content = "${var.cloudflare_tunnel_id}.cfargotunnel.com"
+  proxied = true
+}