From b8b33e870fc9e39399470065b055e6cf16aaa1d4 Mon Sep 17 00:00:00 2001
From: Will Anderson <will@neuralplatform.ai>
Date: Sat, 11 Apr 2026 12:47:38 -0500
Subject: [PATCH] voidstash.xyz: add Cloudflare zone, CNAME records, and tunnel
 ingress rules
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Register voidstash.xyz as the private media stack domain.
- DNS delegated from Porkbun to Cloudflare nameservers
- stash.voidstash.xyz and whisparr.voidstash.xyz CNAME to legion tunnel
- Tunnel ingress rules added for both subdomains → Traefik
---
 servers/legion/main.tf      | 17 +++++++++++++++++
 servers/legion/voidstash.tf | 24 ++++++++++++++++++++++++
 2 files changed, 41 insertions(+)
 create mode 100644 servers/legion/voidstash.tf

diff --git a/servers/legion/main.tf b/servers/legion/main.tf
index 764ca3b..7a97028 100644
--- a/servers/legion/main.tf
+++ b/servers/legion/main.tf
@@ -93,6 +93,23 @@ resource "cloudflare_tunnel_config" "legion" {
       }
     }
 
+    # voidstash.xyz — private media stack
+    ingress_rule {
+      hostname = "stash.voidstash.xyz"
+      service  = "https://traefik.kube-system.svc:443"
+      origin_request {
+        no_tls_verify = true
+      }
+    }
+
+    ingress_rule {
+      hostname = "whisparr.voidstash.xyz"
+      service  = "https://traefik.kube-system.svc:443"
+      origin_request {
+        no_tls_verify = true
+      }
+    }
+
     # Catch-all — must be last
     ingress_rule {
       service = "http_status:404"
diff --git a/servers/legion/voidstash.tf b/servers/legion/voidstash.tf
new file mode 100644
index 0000000..008f5fe
--- /dev/null
+++ b/servers/legion/voidstash.tf
@@ -0,0 +1,24 @@
+# voidstash.xyz — private media stack (Stash + Whisparr)
+# Zone created via API: ba74d72edbea8023ff4ed6cb27487154
+# Nameservers delegated to Cloudflare from Porkbun
+
+data "cloudflare_zone" "voidstash" {
+  name = "voidstash.xyz"
+}
+
+# CNAME records → Cloudflare tunnel (proxied)
+resource "cloudflare_record" "stash" {
+  zone_id = data.cloudflare_zone.voidstash.id
+  name    = "stash"
+  type    = "CNAME"
+  content = "${var.cloudflare_tunnel_id}.cfargotunnel.com"
+  proxied = true
+}
+
+resource "cloudflare_record" "whisparr" {
+  zone_id = data.cloudflare_zone.voidstash.id
+  name    = "whisparr"
+  type    = "CNAME"
+  content = "${var.cloudflare_tunnel_id}.cfargotunnel.com"
+  proxied = true
+}