# ── neurontechnologies.ai DNS ─────────────────────────────────────────────────
# Google Workspace MX, SPF, and DMARC records.
# After signing up for Google Workspace, add your verification TXT record below.

# ── Cloudflare tunnel CNAMEs ─────────────────────────────────────────────────
# All three environments route through the legion tunnel to Traefik.
# proxied = true enables Cloudflare proxy (CDN, DDoS, SSL termination).
# ttl = 1 means "auto" when proxied.

resource "cloudflare_record" "nt_tunnel_prod" {
  zone_id = local.zone_neurontechnologies_ai
  name    = "@"
  type    = "CNAME"
  content = "${var.cloudflare_tunnel_id}.cfargotunnel.com"
  proxied = true
  ttl     = 1
}

resource "cloudflare_record" "nt_tunnel_www" {
  zone_id = local.zone_neurontechnologies_ai
  name    = "www"
  type    = "CNAME"
  content = "${var.cloudflare_tunnel_id}.cfargotunnel.com"
  proxied = true
  ttl     = 1
}

resource "cloudflare_record" "nt_tunnel_dev" {
  zone_id = local.zone_neurontechnologies_ai
  name    = "dev"
  type    = "CNAME"
  content = "${var.cloudflare_tunnel_id}.cfargotunnel.com"
  proxied = true
  ttl     = 1
}

resource "cloudflare_record" "nt_tunnel_stage" {
  zone_id = local.zone_neurontechnologies_ai
  name    = "stage"
  type    = "CNAME"
  content = "${var.cloudflare_tunnel_id}.cfargotunnel.com"
  proxied = true
  ttl     = 1
}

# ── Google Workspace MX records ──────────────────────────────────────────────
resource "cloudflare_record" "nt_mx_1" {
  zone_id  = local.zone_neurontechnologies_ai
  name     = "@"
  type     = "MX"
  content  = "aspmx.l.google.com"
  priority = 1
  ttl      = 3600
}

resource "cloudflare_record" "nt_mx_2" {
  zone_id  = local.zone_neurontechnologies_ai
  name     = "@"
  type     = "MX"
  content  = "alt1.aspmx.l.google.com"
  priority = 5
  ttl      = 3600
}

resource "cloudflare_record" "nt_mx_3" {
  zone_id  = local.zone_neurontechnologies_ai
  name     = "@"
  type     = "MX"
  content  = "alt2.aspmx.l.google.com"
  priority = 5
  ttl      = 3600
}

resource "cloudflare_record" "nt_mx_4" {
  zone_id  = local.zone_neurontechnologies_ai
  name     = "@"
  type     = "MX"
  content  = "alt3.aspmx.l.google.com"
  priority = 10
  ttl      = 3600
}

resource "cloudflare_record" "nt_mx_5" {
  zone_id  = local.zone_neurontechnologies_ai
  name     = "@"
  type     = "MX"
  content  = "alt4.aspmx.l.google.com"
  priority = 10
  ttl      = 3600
}

# ── SPF ───────────────────────────────────────────────────────────────────────
resource "cloudflare_record" "nt_spf" {
  zone_id = local.zone_neurontechnologies_ai
  name    = "@"
  type    = "TXT"
  content = "v=spf1 include:_spf.google.com ~all"
  ttl     = 3600
}

# ── DMARC ─────────────────────────────────────────────────────────────────────
resource "cloudflare_record" "nt_dmarc" {
  zone_id = local.zone_neurontechnologies_ai
  name    = "_dmarc"
  type    = "TXT"
  content = "v=DMARC1; p=quarantine; rua=mailto:admin@neurontechnologies.ai"
  ttl     = 3600
}

# ── Google Workspace domain verification (CNAME method) ──────────────────────
resource "cloudflare_record" "nt_google_verify" {
  zone_id = local.zone_neurontechnologies_ai
  name    = "70280652"
  type    = "CNAME"
  content = "google.com"
  ttl     = 3600
}

# ── DKIM ──────────────────────────────────────────────────────────────────────
# Add after Google Workspace generates your DKIM key.
# Google Admin Console → Apps → Google Workspace → Gmail → Authenticate email
#
# resource "cloudflare_record" "nt_dkim" {
#   zone_id = local.zone_neurontechnologies_ai
#   name    = "google._domainkey"
#   type    = "TXT"
#   content = "v=DKIM1; k=rsa; p=REPLACE_WITH_YOUR_DKIM_PUBLIC_KEY"
#   ttl     = 3600
# }