infrastructure/servers/legion/dns-neurontechnologies.tf

# ── neurontechnologies.ai DNS ─────────────────────────────────────────────────
# Google Workspace MX, SPF, and DMARC records.
# After signing up for Google Workspace, add your verification TXT record below.

# ── Cloudflare tunnel CNAMEs ─────────────────────────────────────────────────
# All three environments route through the legion tunnel to Traefik.
# proxied = true enables Cloudflare proxy (CDN, DDoS, SSL termination).
# ttl = 1 means "auto" when proxied.

resource "cloudflare_record" "nt_tunnel_neuron" {
  zone_id = local.zone_neurontechnologies_ai
  name    = "neuron"
  type    = "CNAME"
  content = "${var.cloudflare_tunnel_id}.cfargotunnel.com"
  proxied = true
  ttl     = 1
}

resource "cloudflare_record" "nt_tunnel_api" {
  zone_id = local.zone_neurontechnologies_ai
  name    = "api"
  type    = "CNAME"
  content = "${var.cloudflare_tunnel_id}.cfargotunnel.com"
  proxied = true
  ttl     = 1
}

resource "cloudflare_record" "nt_tunnel_prod" {
  zone_id = local.zone_neurontechnologies_ai
  name    = "@"
  type    = "CNAME"
  content = "${var.cloudflare_tunnel_id}.cfargotunnel.com"
  proxied = true
  ttl     = 1
}

resource "cloudflare_record" "nt_tunnel_www" {
  zone_id = local.zone_neurontechnologies_ai
  name    = "www"
  type    = "CNAME"
  content = "${var.cloudflare_tunnel_id}.cfargotunnel.com"
  proxied = true
  ttl     = 1
}

# dev.neurontechnologies.ai DNS moved to servers/gcp/marketing-dev.tf
# (Cloud Run-fronted marketing dev environment). The legion-side
# neuron-dev namespace + ingress + tunnel ingress_rule remain in place
# but no longer receive traffic - they're inert until a follow-up
# decision retires them or rehosts under mcp-dev.neurontechnologies.ai.
# See backlog: "Retire or rehost legion neuron-dev namespace".

resource "cloudflare_record" "nt_tunnel_stage" {
  zone_id = local.zone_neurontechnologies_ai
  name    = "stage"
  type    = "CNAME"
  content = "${var.cloudflare_tunnel_id}.cfargotunnel.com"
  proxied = true
  ttl     = 1
}

resource "cloudflare_record" "nt_tunnel_alpha" {
  zone_id = local.zone_neurontechnologies_ai
  name    = "alpha"
  type    = "CNAME"
  content = "${var.cloudflare_tunnel_id}.cfargotunnel.com"
  proxied = true
  ttl     = 1
}

resource "cloudflare_record" "nt_tunnel_ai" {
  zone_id = local.zone_neurontechnologies_ai
  name    = "ai"
  type    = "CNAME"
  content = "${var.cloudflare_tunnel_id}.cfargotunnel.com"
  proxied = true
  ttl     = 1
}

resource "cloudflare_record" "nt_tunnel_beta" {
  zone_id = local.zone_neurontechnologies_ai
  name    = "beta"
  type    = "CNAME"
  content = "${var.cloudflare_tunnel_id}.cfargotunnel.com"
  proxied = true
  ttl     = 1
}

resource "cloudflare_record" "nt_tunnel_gamma" {
  zone_id = local.zone_neurontechnologies_ai
  name    = "gamma"
  type    = "CNAME"
  content = "${var.cloudflare_tunnel_id}.cfargotunnel.com"
  proxied = true
  ttl     = 1
}

resource "cloudflare_record" "nt_tunnel_dharma" {
  zone_id = local.zone_neurontechnologies_ai
  name    = "dharma"
  type    = "CNAME"
  content = "${var.cloudflare_tunnel_id}.cfargotunnel.com"
  proxied = true
  ttl     = 1
}

# ── Google Workspace MX records ──────────────────────────────────────────────
resource "cloudflare_record" "nt_mx_1" {
  zone_id  = local.zone_neurontechnologies_ai
  name     = "@"
  type     = "MX"
  content  = "aspmx.l.google.com"
  priority = 1
  ttl      = 3600
}

resource "cloudflare_record" "nt_mx_2" {
  zone_id  = local.zone_neurontechnologies_ai
  name     = "@"
  type     = "MX"
  content  = "alt1.aspmx.l.google.com"
  priority = 5
  ttl      = 3600
}

resource "cloudflare_record" "nt_mx_3" {
  zone_id  = local.zone_neurontechnologies_ai
  name     = "@"
  type     = "MX"
  content  = "alt2.aspmx.l.google.com"
  priority = 5
  ttl      = 3600
}

resource "cloudflare_record" "nt_mx_4" {
  zone_id  = local.zone_neurontechnologies_ai
  name     = "@"
  type     = "MX"
  content  = "alt3.aspmx.l.google.com"
  priority = 10
  ttl      = 3600
}

resource "cloudflare_record" "nt_mx_5" {
  zone_id  = local.zone_neurontechnologies_ai
  name     = "@"
  type     = "MX"
  content  = "alt4.aspmx.l.google.com"
  priority = 10
  ttl      = 3600
}

# ── SPF ───────────────────────────────────────────────────────────────────────
resource "cloudflare_record" "nt_spf" {
  zone_id = local.zone_neurontechnologies_ai
  name    = "@"
  type    = "TXT"
  content = "v=spf1 include:_spf.google.com ~all"
  ttl     = 3600
}

# ── DMARC ─────────────────────────────────────────────────────────────────────
resource "cloudflare_record" "nt_dmarc" {
  zone_id = local.zone_neurontechnologies_ai
  name    = "_dmarc"
  type    = "TXT"
  content = "v=DMARC1; p=quarantine; rua=mailto:admin@neurontechnologies.ai"
  ttl     = 3600
}

# ── Google Workspace domain verification (CNAME method) ──────────────────────
resource "cloudflare_record" "nt_google_verify" {
  zone_id = local.zone_neurontechnologies_ai
  name    = "70280652"
  type    = "CNAME"
  content = "google.com"
  ttl     = 3600
}

# ── DKIM ──────────────────────────────────────────────────────────────────────
resource "cloudflare_record" "nt_dkim" {
  zone_id = local.zone_neurontechnologies_ai
  name    = "google._domainkey"
  type    = "TXT"
  content = "v=DKIM1;k=rsa;p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA3CbdL8/TV2cklPmt/qb5cjtNYZwWQEOe2xIDDDnNTW/MkJfW7JTQP8v/OAOPACmJqEAG/fPdb8qwAn7S3YrYoPR2QG+CkBym3dq55IWEcMondfKVX2URnoelLlwt7juLwk6115Tgn0m0sGcqZvvF662xygrGb3SLkF6aeeO4fc6u5TsgkxBS5W2DngprbtlUmj+PjpIY5T3Jb6EWB3O2zbnKHKvDbYtaMq2P+fDr/EVM+qERdUyFjIFR41N7dbTHIP60+Sv4lbm5yd6FA8HCGFdeF6q2gTwxwh9bVMpe6oqHzGr1Z14qtwNohRdKWiwhYzowswIOPTK5VV2FwnKu9QIDAQAB"
  ttl     = 3600
}

# ── Resend DKIM ───────────────────────────────────────────────────────────────
resource "cloudflare_record" "nt_resend_dkim" {
  zone_id = local.zone_neurontechnologies_ai
  name    = "resend._domainkey"
  type    = "TXT"
  content = "p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC0/2NCH7IEgwYlRsL6ZFGqis2DU63LlWP4Cw6QFBgxVPDto9Le9Tqi6doHZuP/ijwoyDz4Ra68cV/bB1klrTHb4B6r8b3xDy8XcGShA45HljxYa22z2r4BUnmsFG5cXGT8pccYlix0LnVaXIVKPVprofznLNNv0T4/4v2x8ezh5wIDAQAB"
  ttl     = 3600
}

# ── Resend SPF (send subdomain) ───────────────────────────────────────────────
resource "cloudflare_record" "nt_resend_spf_mx" {
  zone_id  = local.zone_neurontechnologies_ai
  name     = "send"
  type     = "MX"
  content  = "feedback-smtp.us-east-1.amazonses.com"
  priority = 10
  ttl      = 3600
}

resource "cloudflare_record" "nt_resend_spf_txt" {
  zone_id = local.zone_neurontechnologies_ai
  name    = "send"
  type    = "TXT"
  content = "v=spf1 include:amazonses.com ~all"
  ttl     = 3600
}