infrastructure/servers/legion/main.tf

terraform {
  required_version = ">= 1.5"

  required_providers {
    kubernetes = {
      source  = "hashicorp/kubernetes"
      version = "~> 2.30"
    }
    helm = {
      source  = "hashicorp/helm"
      version = "~> 2.14"
    }
    cloudflare = {
      source  = "cloudflare/cloudflare"
      version = "~> 4.0"
    }
  }

  backend "s3" {
    bucket   = "legion-terraform-state"
    key      = "legion/terraform.tfstate"
    region   = "auto"
    endpoint = "https://651161e0a3d321561b4c90b5bcd5f15b.r2.cloudflarestorage.com"

    # R2 is S3-compatible but not AWS — skip AWS-specific checks
    skip_credentials_validation = true
    skip_metadata_api_check     = true
    skip_region_validation      = true
    force_path_style            = true
  }
}

provider "kubernetes" {
  config_path = var.kubeconfig_path
}

provider "helm" {
  kubernetes {
    config_path = var.kubeconfig_path
  }
}

provider "cloudflare" {
  email   = var.cloudflare_email
  api_key = var.cloudflare_api_key
}

# Cloudflare tunnel ingress rules — all hostnames that route through the legion tunnel
# Catch-all (http_status:404) is implicit and always last; managed by Cloudflare API
resource "cloudflare_tunnel_config" "legion" {
  account_id = var.cloudflare_account_id
  tunnel_id  = var.cloudflare_tunnel_id

  config {
    # neuron.neuralplatform.ai — MCP server (SSE transport, requires CF-Access headers)
    ingress_rule {
      hostname = "neuron.neuralplatform.ai"
      service  = "https://traefik.kube-system.svc:443"
      origin_request {
        no_tls_verify = true
      }
    }

    ingress_rule {
      hostname = "vault.neuralplatform.ai"
      service  = "https://traefik.kube-system.svc:443"
      origin_request {
        no_tls_verify = true
      }
    }

    ingress_rule {
      hostname = "watch.nook.family"
      service  = "https://traefik.kube-system.svc:443"
      origin_request {
        no_tls_verify = true
      }
    }

    ingress_rule {
      hostname = "jellyfin.nook.family"
      service  = "https://traefik.kube-system.svc:443"
      origin_request {
        no_tls_verify = true
      }
    }

    ingress_rule {
      hostname = "bazarr.nook.family"
      service  = "https://traefik.kube-system.svc:443"
      origin_request {
        no_tls_verify = true
      }
    }

    # voidstash.xyz — private media stack
    ingress_rule {
      hostname = "stash.voidstash.xyz"
      service  = "https://traefik.kube-system.svc:443"
      origin_request {
        no_tls_verify = true
      }
    }

    ingress_rule {
      hostname = "whisparr.voidstash.xyz"
      service  = "https://traefik.kube-system.svc:443"
      origin_request {
        no_tls_verify = true
      }
    }

    ingress_rule {
      hostname = "prowlarr.voidstash.xyz"
      service  = "https://traefik.kube-system.svc:443"
      origin_request {
        no_tls_verify = true
      }
    }

    # Catch-all — must be last
    ingress_rule {
      service = "http_status:404"
    }
  }
}