Will Anderson
5f2720ae4e
Tunnel routes were being managed ad-hoc via Cloudflare API. Now codified in Terraform so they can't drift — neuron.neuralplatform.ai was missing from the tunnel config, causing 404s for Neuron MCP connections. Also fix mcp.json: type http → sse (Neuron uses SSE transport, not streamable HTTP). CF-Access headers were already present and correct.
102 lines
2.4 KiB
Terraform
102 lines
2.4 KiB
Terraform
terraform {
|
|
required_version = ">= 1.5"
|
|
|
|
required_providers {
|
|
kubernetes = {
|
|
source = "hashicorp/kubernetes"
|
|
version = "~> 2.30"
|
|
}
|
|
helm = {
|
|
source = "hashicorp/helm"
|
|
version = "~> 2.14"
|
|
}
|
|
cloudflare = {
|
|
source = "cloudflare/cloudflare"
|
|
version = "~> 4.0"
|
|
}
|
|
}
|
|
|
|
backend "s3" {
|
|
bucket = "legion-terraform-state"
|
|
key = "legion/terraform.tfstate"
|
|
region = "auto"
|
|
endpoint = "https://651161e0a3d321561b4c90b5bcd5f15b.r2.cloudflarestorage.com"
|
|
|
|
# R2 is S3-compatible but not AWS — skip AWS-specific checks
|
|
skip_credentials_validation = true
|
|
skip_metadata_api_check = true
|
|
skip_region_validation = true
|
|
force_path_style = true
|
|
}
|
|
}
|
|
|
|
provider "kubernetes" {
|
|
config_path = var.kubeconfig_path
|
|
}
|
|
|
|
provider "helm" {
|
|
kubernetes {
|
|
config_path = var.kubeconfig_path
|
|
}
|
|
}
|
|
|
|
provider "cloudflare" {
|
|
email = var.cloudflare_email
|
|
api_key = var.cloudflare_api_key
|
|
}
|
|
|
|
# Cloudflare tunnel ingress rules — all hostnames that route through the legion tunnel
|
|
# Catch-all (http_status:404) is implicit and always last; managed by Cloudflare API
|
|
resource "cloudflare_tunnel_config" "legion" {
|
|
account_id = var.cloudflare_account_id
|
|
tunnel_id = var.cloudflare_tunnel_id
|
|
|
|
config {
|
|
# neuron.neuralplatform.ai — MCP server (SSE transport, requires CF-Access headers)
|
|
ingress_rule {
|
|
hostname = "neuron.neuralplatform.ai"
|
|
service = "https://traefik.kube-system.svc:443"
|
|
origin_request {
|
|
no_tls_verify = true
|
|
}
|
|
}
|
|
|
|
ingress_rule {
|
|
hostname = "vault.neuralplatform.ai"
|
|
service = "https://traefik.kube-system.svc:443"
|
|
origin_request {
|
|
no_tls_verify = true
|
|
}
|
|
}
|
|
|
|
ingress_rule {
|
|
hostname = "watch.nook.family"
|
|
service = "https://traefik.kube-system.svc:443"
|
|
origin_request {
|
|
no_tls_verify = true
|
|
}
|
|
}
|
|
|
|
ingress_rule {
|
|
hostname = "jellyfin.nook.family"
|
|
service = "https://traefik.kube-system.svc:443"
|
|
origin_request {
|
|
no_tls_verify = true
|
|
}
|
|
}
|
|
|
|
ingress_rule {
|
|
hostname = "bazarr.nook.family"
|
|
service = "https://traefik.kube-system.svc:443"
|
|
origin_request {
|
|
no_tls_verify = true
|
|
}
|
|
}
|
|
|
|
# Catch-all — must be last
|
|
ingress_rule {
|
|
service = "http_status:404"
|
|
}
|
|
}
|
|
}
|