Will Anderson
48106b27ec
- dns-neuralplatform.tf: add vault.neuralplatform.ai A record → 34.54.164.21 (GCP LB) DNS-only (not proxied) so GCP managed TLS cert can provision correctly - main.tf: remove vault.neuralplatform.ai from Cloudflare tunnel ingress (now served directly via GCP Global HTTPS LB) - main.tf: remove watch.nook.family, jellyfin.nook.family, bazarr.nook.family from tunnel ingress (nook.family media stack retired; infra is Neuron-focused) GCE Vault cluster already initialized and running (3-node Raft, active since 2026-05-04T16:05). Secrets migrated 48/48 from k3s vault. ESO ClusterSecretStore validated against new vault. k3s vault-0 is now superseded.
39 lines
1.5 KiB
Terraform
39 lines
1.5 KiB
Terraform
# ── neuralplatform.ai DNS ─────────────────────────────────────────────────────
|
|
# Infrastructure and platform service subdomains.
|
|
# All route through the legion Cloudflare tunnel to Traefik unless noted.
|
|
|
|
# vpn.neuralplatform.ai — Headscale coordination server (Tailscale control plane)
|
|
resource "cloudflare_record" "np_vpn" {
|
|
zone_id = local.zone_neuralplatform_ai
|
|
name = "vpn"
|
|
type = "CNAME"
|
|
content = "${var.cloudflare_tunnel_id}.cfargotunnel.com"
|
|
proxied = true
|
|
ttl = 1
|
|
}
|
|
|
|
# web-stage.neuralplatform.ai — Phase 1 Legion deploy of neuron-web (the El
|
|
# native landing server). Coexists with the Cloud Run prod marketing site
|
|
# at neurontechnologies.ai; this lets us iterate on the native build.
|
|
resource "cloudflare_record" "np_web_stage" {
|
|
zone_id = local.zone_neuralplatform_ai
|
|
name = "web-stage"
|
|
type = "CNAME"
|
|
content = "${var.cloudflare_tunnel_id}.cfargotunnel.com"
|
|
proxied = true
|
|
ttl = 1
|
|
}
|
|
|
|
# vault.neuralplatform.ai — GCE Raft HA Vault cluster via GCP Global HTTPS LB.
|
|
# DNS-only (not proxied) — GCP managed TLS cert terminates at the LB.
|
|
# Vault nodes listen on plain HTTP 8200 internally; LB does TLS.
|
|
# IP: terraform output vault_lb_ip from servers/gcp workspace = 34.54.164.21
|
|
resource "cloudflare_record" "np_vault" {
|
|
zone_id = local.zone_neuralplatform_ai
|
|
name = "vault"
|
|
type = "A"
|
|
content = "34.54.164.21"
|
|
proxied = false
|
|
ttl = 60
|
|
}
|