# ── neuralplatform.ai DNS ─────────────────────────────────────────────────────
# Infrastructure and platform service subdomains.
# All route through the legion Cloudflare tunnel to Traefik unless noted.

# vpn.neuralplatform.ai — Headscale coordination server (Tailscale control plane)
resource "cloudflare_record" "np_vpn" {
  zone_id = local.zone_neuralplatform_ai
  name    = "vpn"
  type    = "CNAME"
  content = "${var.cloudflare_tunnel_id}.cfargotunnel.com"
  proxied = true
  ttl     = 1
}

# web-stage.neuralplatform.ai — Phase 1 Legion deploy of neuron-web (the El
# native landing server). Coexists with the Cloud Run prod marketing site
# at neurontechnologies.ai; this lets us iterate on the native build.
resource "cloudflare_record" "np_web_stage" {
  zone_id = local.zone_neuralplatform_ai
  name    = "web-stage"
  type    = "CNAME"
  content = "${var.cloudflare_tunnel_id}.cfargotunnel.com"
  proxied = true
  ttl     = 1
}

# vault.neuralplatform.ai — GCP Global HTTPS LB with managed cert.
# DNS-only (not proxied) — GCP managed TLS cert terminates at the LB.
# Backend is now GKE container-native NEGs (cut over from GCE instance groups).
# IP: terraform output vault_lb_ip from servers/gcp workspace = 34.54.164.21
resource "cloudflare_record" "np_vault" {
  zone_id = local.zone_neuralplatform_ai
  name    = "vault"
  type    = "A"
  content = "34.54.164.21"
  proxied = false
  ttl     = 60
}

# git.neuralplatform.ai — Gitea on GKE via GCP Network LB.
# Cloudflare proxied (provides TLS termination). Gitea listens on port 80 internally.
# IP: external IP of the GKE LoadBalancer service in namespace gitea.
# Get it with:
#   kubectl --context=gke_neuron-785695_us-central1_neuron-platform -n gitea get svc gitea
# Update content below with the actual IP, then terraform apply.
resource "cloudflare_record" "np_gitea" {
  zone_id = local.zone_neuralplatform_ai
  name    = "git"
  type    = "A"
  content = "34.31.145.131"  # GKE LoadBalancer external IP — gitea svc in namespace gitea
  proxied = true
  ttl     = 1
}