# ── neuralplatform.ai DNS ─────────────────────────────────────────────────────
# Infrastructure and platform service subdomains.
# All route through the legion Cloudflare tunnel to Traefik unless noted.

# vpn.neuralplatform.ai — Headscale coordination server (Tailscale control plane)
resource "cloudflare_record" "np_vpn" {
  zone_id = local.zone_neuralplatform_ai
  name    = "vpn"
  type    = "CNAME"
  content = "${var.cloudflare_tunnel_id}.cfargotunnel.com"
  proxied = true
  ttl     = 1
}

# web-stage.neuralplatform.ai — Phase 1 Legion deploy of neuron-web (the El
# native landing server). Coexists with the Cloud Run prod marketing site
# at neurontechnologies.ai; this lets us iterate on the native build.
resource "cloudflare_record" "np_web_stage" {
  zone_id = local.zone_neuralplatform_ai
  name    = "web-stage"
  type    = "CNAME"
  content = "${var.cloudflare_tunnel_id}.cfargotunnel.com"
  proxied = true
  ttl     = 1
}

# vault.neuralplatform.ai — GCE Raft HA Vault cluster via GCP Global HTTPS LB.
# DNS-only (not proxied) — GCP managed TLS cert terminates at the LB.
# Vault nodes listen on plain HTTP 8200 internally; LB does TLS.
# IP: terraform output vault_lb_ip from servers/gcp workspace = 34.54.164.21
resource "cloudflare_record" "np_vault" {
  zone_id = local.zone_neuralplatform_ai
  name    = "vault"
  type    = "A"
  content = "34.54.164.21"
  proxied = false
  ttl     = 60
}