quorate/terraform/external/cloudflare/dns.tf

data "terraform_remote_state" "oci_relay" {
  backend = "pg"
  config = {
    conn_str    = "postgres://10.234.158.153:5432/tf_state?sslmode=require"
    schema_name = "ext_oci_relay"
  }
}

locals {
  mta_sts_policy    = "version: STSv1\nmode: testing\nmx: mail.quorate.dev\nmax_age: 86400\n"
  mta_sts_policy_id = substr(sha256(local.mta_sts_policy), 0, 16)
}

data "cloudflare_dns_records" "zitadel" {
  zone_id = var.zone_id
  match   = "all"
  name = {
    exact = "auth.quorate.dev"
  }
}

data "cloudflare_dns_records" "forge_git" {
  zone_id = var.zone_id
  match   = "all"
  name = {
    exact = "git.quorate.dev"
  }
}

data "cloudflare_dns_records" "mail" {
  zone_id = var.zone_id
  match   = "all"
  name = {
    exact = "mail.quorate.dev"
  }
}

resource "cloudflare_dns_record" "zitadel" {
  zone_id = var.zone_id
  name    = "auth.quorate.dev"
  type    = "A"
  content = data.terraform_remote_state.oci_relay.outputs.public_ip
  ttl     = 120
  proxied = false
}

resource "cloudflare_dns_record" "mail" {
  count = var.mail_a_enabled ? 1 : 0

  zone_id = var.zone_id
  name    = "mail.quorate.dev"
  type    = "A"
  content = data.terraform_remote_state.oci_relay.outputs.public_ip
  ttl     = 120
  proxied = false
}

resource "cloudflare_dns_record" "mail_mx" {
  count = var.mail_mx_enabled ? 1 : 0

  zone_id  = var.zone_id
  name     = "quorate.dev"
  type     = "MX"
  content  = "mail.quorate.dev"
  priority = 10
  ttl      = 120
}

resource "cloudflare_dns_record" "mail_dkim" {
  zone_id = var.zone_id
  name    = trimsuffix(data.terraform_remote_state.oci_relay.outputs.email_dkim_dns_name, ".")
  type    = "CNAME"
  content = data.terraform_remote_state.oci_relay.outputs.email_dkim_cname_target
  ttl     = 120
  proxied = false
}

resource "cloudflare_dns_record" "mail_spf" {
  zone_id = var.zone_id
  name    = "quorate.dev"
  type    = "TXT"
  content = "v=spf1 include:ap.rp.oracleemaildelivery.com ~all"
  ttl     = 120
}

resource "cloudflare_dns_record" "google_postmaster" {
  zone_id = var.zone_id
  name    = "quorate.dev"
  type    = "TXT"
  content = "google-site-verification=********"
  ttl     = 120
}

resource "cloudflare_dns_record" "mail_dmarc" {
  zone_id = var.zone_id
  name    = "_dmarc.quorate.dev"
  type    = "TXT"
  content = "v=DMARC1; p=none; rua=mailto:[email protected]"
  ttl     = 120
}

resource "cloudflare_dns_record" "mail_mta_sts" {
  zone_id = var.zone_id
  name    = "_mta-sts.quorate.dev"
  type    = "TXT"
  content = "v=STSv1; id=${local.mta_sts_policy_id}"
  ttl     = 120
}

resource "cloudflare_dns_record" "mail_tlsrpt" {
  zone_id = var.zone_id
  name    = "_smtp._tls.quorate.dev"
  type    = "TXT"
  content = "v=TLSRPTv1; rua=mailto:[email protected]"
  ttl     = 120
}

resource "cloudflare_dns_record" "forge_git" {
  zone_id = var.zone_id
  name    = "git.quorate.dev"
  type    = "A"
  content = data.terraform_remote_state.oci_relay.outputs.public_ip
  ttl     = 120
  proxied = false
}

check "zitadel_has_no_bypass" {
  assert {
    condition = (
      length([for record in data.cloudflare_dns_records.zitadel.result : record if record.type == "A"]) == 1 &&
      length([for record in data.cloudflare_dns_records.zitadel.result : record if record.type == "AAAA"]) == 0
    )
    error_message = "Zitadel must have exactly one A record and no AAAA record."
  }
}

check "forge_git_has_no_bypass" {
  assert {
    condition = (
      length([for record in data.cloudflare_dns_records.forge_git.result : record if record.type == "A"]) <= 1 &&
      length([for record in data.cloudflare_dns_records.forge_git.result : record if record.type == "AAAA"]) == 0
    )
    error_message = "Authenticated public Forgejo must have at most one A record and no AAAA record before reconciliation."
  }
}

resource "terraform_data" "mail_dns_activation" {
  lifecycle {
    precondition {
      condition     = !var.mail_mx_enabled || var.mail_a_enabled
      error_message = "The authoritative MX record requires the mail host A record to remain enabled."
    }

    precondition {
      condition = (
        length([for record in data.cloudflare_dns_records.mail.result : record if record.type == "A"]) <= 1 &&
        length([for record in data.cloudflare_dns_records.mail.result : record if record.type == "AAAA"]) == 0
      )
      error_message = "Stalwart must have at most one A record and no AAAA record before reconciliation."
    }
  }
}