infrastructure/servers/legion/dns-neurontechnologies.tf

# ── neurontechnologies.ai DNS ─────────────────────────────────────────────────
# Google Workspace MX, SPF, and DMARC records.
# After signing up for Google Workspace, add your verification TXT record below.

# ── Cloudflare tunnel CNAMEs ─────────────────────────────────────────────────
# All three environments route through the legion tunnel to Traefik.
# proxied = true enables Cloudflare proxy (CDN, DDoS, SSL termination).
# ttl = 1 means "auto" when proxied.

resource "cloudflare_record" "nt_tunnel_prod" {
  zone_id = local.zone_neurontechnologies_ai
  name    = "@"
  type    = "CNAME"
  content = "${var.cloudflare_tunnel_id}.cfargotunnel.com"
  proxied = true
  ttl     = 1
}

resource "cloudflare_record" "nt_tunnel_www" {
  zone_id = local.zone_neurontechnologies_ai
  name    = "www"
  type    = "CNAME"
  content = "${var.cloudflare_tunnel_id}.cfargotunnel.com"
  proxied = true
  ttl     = 1
}

resource "cloudflare_record" "nt_tunnel_dev" {
  zone_id = local.zone_neurontechnologies_ai
  name    = "dev"
  type    = "CNAME"
  content = "${var.cloudflare_tunnel_id}.cfargotunnel.com"
  proxied = true
  ttl     = 1
}

resource "cloudflare_record" "nt_tunnel_stage" {
  zone_id = local.zone_neurontechnologies_ai
  name    = "stage"
  type    = "CNAME"
  content = "${var.cloudflare_tunnel_id}.cfargotunnel.com"
  proxied = true
  ttl     = 1
}

resource "cloudflare_record" "nt_tunnel_alpha" {
  zone_id = local.zone_neurontechnologies_ai
  name    = "alpha"
  type    = "CNAME"
  content = "${var.cloudflare_tunnel_id}.cfargotunnel.com"
  proxied = true
  ttl     = 1
}

resource "cloudflare_record" "nt_tunnel_beta" {
  zone_id = local.zone_neurontechnologies_ai
  name    = "beta"
  type    = "CNAME"
  content = "${var.cloudflare_tunnel_id}.cfargotunnel.com"
  proxied = true
  ttl     = 1
}

resource "cloudflare_record" "nt_tunnel_gamma" {
  zone_id = local.zone_neurontechnologies_ai
  name    = "gamma"
  type    = "CNAME"
  content = "${var.cloudflare_tunnel_id}.cfargotunnel.com"
  proxied = true
  ttl     = 1
}

# ── Google Workspace MX records ──────────────────────────────────────────────
resource "cloudflare_record" "nt_mx_1" {
  zone_id  = local.zone_neurontechnologies_ai
  name     = "@"
  type     = "MX"
  content  = "aspmx.l.google.com"
  priority = 1
  ttl      = 3600
}

resource "cloudflare_record" "nt_mx_2" {
  zone_id  = local.zone_neurontechnologies_ai
  name     = "@"
  type     = "MX"
  content  = "alt1.aspmx.l.google.com"
  priority = 5
  ttl      = 3600
}

resource "cloudflare_record" "nt_mx_3" {
  zone_id  = local.zone_neurontechnologies_ai
  name     = "@"
  type     = "MX"
  content  = "alt2.aspmx.l.google.com"
  priority = 5
  ttl      = 3600
}

resource "cloudflare_record" "nt_mx_4" {
  zone_id  = local.zone_neurontechnologies_ai
  name     = "@"
  type     = "MX"
  content  = "alt3.aspmx.l.google.com"
  priority = 10
  ttl      = 3600
}

resource "cloudflare_record" "nt_mx_5" {
  zone_id  = local.zone_neurontechnologies_ai
  name     = "@"
  type     = "MX"
  content  = "alt4.aspmx.l.google.com"
  priority = 10
  ttl      = 3600
}

# ── SPF ───────────────────────────────────────────────────────────────────────
resource "cloudflare_record" "nt_spf" {
  zone_id = local.zone_neurontechnologies_ai
  name    = "@"
  type    = "TXT"
  content = "v=spf1 include:_spf.google.com ~all"
  ttl     = 3600
}

# ── DMARC ─────────────────────────────────────────────────────────────────────
resource "cloudflare_record" "nt_dmarc" {
  zone_id = local.zone_neurontechnologies_ai
  name    = "_dmarc"
  type    = "TXT"
  content = "v=DMARC1; p=quarantine; rua=mailto:admin@neurontechnologies.ai"
  ttl     = 3600
}

# ── Google Workspace domain verification (CNAME method) ──────────────────────
resource "cloudflare_record" "nt_google_verify" {
  zone_id = local.zone_neurontechnologies_ai
  name    = "70280652"
  type    = "CNAME"
  content = "google.com"
  ttl     = 3600
}

# ── DKIM ──────────────────────────────────────────────────────────────────────
resource "cloudflare_record" "nt_dkim" {
  zone_id = local.zone_neurontechnologies_ai
  name    = "google._domainkey"
  type    = "TXT"
  content = "v=DKIM1;k=rsa;p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA3CbdL8/TV2cklPmt/qb5cjtNYZwWQEOe2xIDDDnNTW/MkJfW7JTQP8v/OAOPACmJqEAG/fPdb8qwAn7S3YrYoPR2QG+CkBym3dq55IWEcMondfKVX2URnoelLlwt7juLwk6115Tgn0m0sGcqZvvF662xygrGb3SLkF6aeeO4fc6u5TsgkxBS5W2DngprbtlUmj+PjpIY5T3Jb6EWB3O2zbnKHKvDbYtaMq2P+fDr/EVM+qERdUyFjIFR41N7dbTHIP60+Sv4lbm5yd6FA8HCGFdeF6q2gTwxwh9bVMpe6oqHzGr1Z14qtwNohRdKWiwhYzowswIOPTK5VV2FwnKu9QIDAQAB"
  ttl     = 3600
}