# ── Cloudflare DNS — GCP-backed services ─────────────────────────────────────
# A records pointing to the GCP global load balancer IP.
# All subdomains share the same anycast IP (google_compute_global_address.prod).
#
# Cloudflare provider reads CLOUDFLARE_API_TOKEN from env.
# Zone ID for neurontechnologies.ai is set in terraform.tfvars.

# ── neuron.neurontechnologies.ai → Soma inference gateway ────────────────────

resource "cloudflare_record" "soma_neuron" {
  zone_id = var.cloudflare_zone_id_neurontechnologies
  name    = "neuron"
  type    = "A"
  content = google_compute_global_address.prod.address
  proxied = true
  ttl     = 1
}

# ── *.neurontechnologies.ai → Customer org subdomains ────────────────────────
# Enterprise customers get {org}.neurontechnologies.ai routed to soma.
# Soma reads the Host header to identify the tenant.

resource "cloudflare_record" "soma_wildcard" {
  zone_id = var.cloudflare_zone_id_neurontechnologies
  name    = "*"
  type    = "A"
  content = google_compute_global_address.prod.address
  proxied = true
  ttl     = 1
}

# ── Email authentication (managed via Cloudflare API, NOT Terraform) ─────────
# Transactional email goes through Resend (smtp.resend.com) using the
# `send.neurontechnologies.ai` subdomain as envelope-from. Workspace mail
# flows through Google MX. Both signing domains (resend, google) DKIM-align
# with the apex via the d= header so DMARC passes regardless of route.
#
# These records are intentionally NOT defined as Terraform resources:
#   - The Cloudflare provider canonicalises `name = "@"` differently than the
#     API's stored `name = "neurontechnologies.ai"`, which forces replacement
#     of SPF on every `terraform apply` and would create a propagation gap.
#   - Workspace MX/DKIM and the Resend records are stable enough that
#     out-of-band Cloudflare-API management is safer than risking deletion
#     during a routine apply.
#
# Current records (as of 2026-05-01):
#   TXT  @                      v=spf1 include:_spf.google.com ~all
#   TXT  send                   v=spf1 include:amazonses.com ~all
#   MX   send                   feedback-smtp.us-east-1.amazonses.com (10)
#   TXT  resend._domainkey      Resend DKIM key (verified in Resend dash)
#   TXT  google._domainkey      Workspace DKIM key
#   TXT  _dmarc                 v=DMARC1; p=quarantine; rua=mailto:admin@…
#   MX   @ (x5)                 aspmx.l.google.com + 4 alt MX (Workspace)
#
# To change any of these, use the Cloudflare API directly:
#   set -a; source ~/Secrets/credentials/infrastructure.env; set +a
#   ZONE_ID=e844374f203dca4944d77d40ca0710ae
#   curl -X PATCH "https://api.cloudflare.com/client/v4/zones/$ZONE_ID/dns_records/<id>" \
#     -H "X-Auth-Email: $CF_EMAIL" -H "X-Auth-Key: $CF_API_KEY" \
#     -d '{"content":"..."}'
#
# DO NOT remove or modify SPF / DKIM / DMARC without verifying replacements
# first — losing any one will cause Gmail to junk transactional mail.