Will Anderson
8aa01bc840
- Add CNAME records for @, www, dev, stage → legion tunnel - Add tunnel ingress rules for neurontechnologies.ai, www, dev, stage - Add neuron-dev, neuron-stage, neuron-prod k8s namespaces on Legion
130 lines
4.4 KiB
Terraform
130 lines
4.4 KiB
Terraform
# ── neurontechnologies.ai DNS ─────────────────────────────────────────────────
|
|
# Google Workspace MX, SPF, and DMARC records.
|
|
# After signing up for Google Workspace, add your verification TXT record below.
|
|
|
|
# ── Cloudflare tunnel CNAMEs ─────────────────────────────────────────────────
|
|
# All three environments route through the legion tunnel to Traefik.
|
|
# proxied = true enables Cloudflare proxy (CDN, DDoS, SSL termination).
|
|
# ttl = 1 means "auto" when proxied.
|
|
|
|
resource "cloudflare_record" "nt_tunnel_prod" {
|
|
zone_id = local.zone_neurontechnologies_ai
|
|
name = "@"
|
|
type = "CNAME"
|
|
content = "${var.cloudflare_tunnel_id}.cfargotunnel.com"
|
|
proxied = true
|
|
ttl = 1
|
|
}
|
|
|
|
resource "cloudflare_record" "nt_tunnel_www" {
|
|
zone_id = local.zone_neurontechnologies_ai
|
|
name = "www"
|
|
type = "CNAME"
|
|
content = "${var.cloudflare_tunnel_id}.cfargotunnel.com"
|
|
proxied = true
|
|
ttl = 1
|
|
}
|
|
|
|
resource "cloudflare_record" "nt_tunnel_dev" {
|
|
zone_id = local.zone_neurontechnologies_ai
|
|
name = "dev"
|
|
type = "CNAME"
|
|
content = "${var.cloudflare_tunnel_id}.cfargotunnel.com"
|
|
proxied = true
|
|
ttl = 1
|
|
}
|
|
|
|
resource "cloudflare_record" "nt_tunnel_stage" {
|
|
zone_id = local.zone_neurontechnologies_ai
|
|
name = "stage"
|
|
type = "CNAME"
|
|
content = "${var.cloudflare_tunnel_id}.cfargotunnel.com"
|
|
proxied = true
|
|
ttl = 1
|
|
}
|
|
|
|
# ── Google Workspace MX records ──────────────────────────────────────────────
|
|
resource "cloudflare_record" "nt_mx_1" {
|
|
zone_id = local.zone_neurontechnologies_ai
|
|
name = "@"
|
|
type = "MX"
|
|
content = "aspmx.l.google.com"
|
|
priority = 1
|
|
ttl = 3600
|
|
}
|
|
|
|
resource "cloudflare_record" "nt_mx_2" {
|
|
zone_id = local.zone_neurontechnologies_ai
|
|
name = "@"
|
|
type = "MX"
|
|
content = "alt1.aspmx.l.google.com"
|
|
priority = 5
|
|
ttl = 3600
|
|
}
|
|
|
|
resource "cloudflare_record" "nt_mx_3" {
|
|
zone_id = local.zone_neurontechnologies_ai
|
|
name = "@"
|
|
type = "MX"
|
|
content = "alt2.aspmx.l.google.com"
|
|
priority = 5
|
|
ttl = 3600
|
|
}
|
|
|
|
resource "cloudflare_record" "nt_mx_4" {
|
|
zone_id = local.zone_neurontechnologies_ai
|
|
name = "@"
|
|
type = "MX"
|
|
content = "alt3.aspmx.l.google.com"
|
|
priority = 10
|
|
ttl = 3600
|
|
}
|
|
|
|
resource "cloudflare_record" "nt_mx_5" {
|
|
zone_id = local.zone_neurontechnologies_ai
|
|
name = "@"
|
|
type = "MX"
|
|
content = "alt4.aspmx.l.google.com"
|
|
priority = 10
|
|
ttl = 3600
|
|
}
|
|
|
|
# ── SPF ───────────────────────────────────────────────────────────────────────
|
|
resource "cloudflare_record" "nt_spf" {
|
|
zone_id = local.zone_neurontechnologies_ai
|
|
name = "@"
|
|
type = "TXT"
|
|
content = "v=spf1 include:_spf.google.com ~all"
|
|
ttl = 3600
|
|
}
|
|
|
|
# ── DMARC ─────────────────────────────────────────────────────────────────────
|
|
resource "cloudflare_record" "nt_dmarc" {
|
|
zone_id = local.zone_neurontechnologies_ai
|
|
name = "_dmarc"
|
|
type = "TXT"
|
|
content = "v=DMARC1; p=quarantine; rua=mailto:admin@neurontechnologies.ai"
|
|
ttl = 3600
|
|
}
|
|
|
|
# ── Google Workspace domain verification (CNAME method) ──────────────────────
|
|
resource "cloudflare_record" "nt_google_verify" {
|
|
zone_id = local.zone_neurontechnologies_ai
|
|
name = "70280652"
|
|
type = "CNAME"
|
|
content = "google.com"
|
|
ttl = 3600
|
|
}
|
|
|
|
# ── DKIM ──────────────────────────────────────────────────────────────────────
|
|
# Add after Google Workspace generates your DKIM key.
|
|
# Google Admin Console → Apps → Google Workspace → Gmail → Authenticate email
|
|
#
|
|
# resource "cloudflare_record" "nt_dkim" {
|
|
# zone_id = local.zone_neurontechnologies_ai
|
|
# name = "google._domainkey"
|
|
# type = "TXT"
|
|
# content = "v=DKIM1; k=rsa; p=REPLACE_WITH_YOUR_DKIM_PUBLIC_KEY"
|
|
# ttl = 3600
|
|
# }
|