ce7cb702218693d08ea6d83464d2457c9250027c

terraform/external/cloudflare/dns.tf

@@ -0,0 +1,162 @@
+data "terraform_remote_state" "oci_relay" {
+  backend = "pg"
+  config = {
+    conn_str    = "postgres://10.234.158.153:5432/tf_state?sslmode=require"
+    schema_name = "ext_oci_relay"
+  }
+}
+
+locals {
+  mta_sts_policy    = "version: STSv1\nmode: testing\nmx: mail.quorate.dev\nmax_age: 86400\n"
+  mta_sts_policy_id = substr(sha256(local.mta_sts_policy), 0, 16)
+}
+
+data "cloudflare_dns_records" "zitadel" {
+  zone_id = var.zone_id
+  match   = "all"
+  name = {
+    exact = "auth.quorate.dev"
+  }
+}
+
+data "cloudflare_dns_records" "forge_git" {
+  zone_id = var.zone_id
+  match   = "all"
+  name = {
+    exact = "git.quorate.dev"
+  }
+}
+
+data "cloudflare_dns_records" "mail" {
+  zone_id = var.zone_id
+  match   = "all"
+  name = {
+    exact = "mail.quorate.dev"
+  }
+}
+
+resource "cloudflare_dns_record" "zitadel" {
+  zone_id = var.zone_id
+  name    = "auth.quorate.dev"
+  type    = "A"
+  content = data.terraform_remote_state.oci_relay.outputs.public_ip
+  ttl     = 120
+  proxied = false
+}
+
+resource "cloudflare_dns_record" "mail" {
+  count = var.mail_a_enabled ? 1 : 0
+
+  zone_id = var.zone_id
+  name    = "mail.quorate.dev"
+  type    = "A"
+  content = data.terraform_remote_state.oci_relay.outputs.public_ip
+  ttl     = 120
+  proxied = false
+}
+
+resource "cloudflare_dns_record" "mail_mx" {
+  count = var.mail_mx_enabled ? 1 : 0
+
+  zone_id  = var.zone_id
+  name     = "quorate.dev"
+  type     = "MX"
+  content  = "mail.quorate.dev"
+  priority = 10
+  ttl      = 120
+}
+
+resource "cloudflare_dns_record" "mail_dkim" {
+  zone_id = var.zone_id
+  name    = trimsuffix(data.terraform_remote_state.oci_relay.outputs.email_dkim_dns_name, ".")
+  type    = "CNAME"
+  content = data.terraform_remote_state.oci_relay.outputs.email_dkim_cname_target
+  ttl     = 120
+  proxied = false
+}
+
+resource "cloudflare_dns_record" "mail_spf" {
+  zone_id = var.zone_id
+  name    = "quorate.dev"
+  type    = "TXT"
+  content = "v=spf1 include:ap.rp.oracleemaildelivery.com ~all"
+  ttl     = 120
+}
+
+resource "cloudflare_dns_record" "google_postmaster" {
+  zone_id = var.zone_id
+  name    = "quorate.dev"
+  type    = "TXT"
+  content = "google-site-verification=********"
+  ttl     = 120
+}
+
+resource "cloudflare_dns_record" "mail_dmarc" {
+  zone_id = var.zone_id
+  name    = "_dmarc.quorate.dev"
+  type    = "TXT"
+  content = "v=DMARC1; p=none; rua=mailto:[email protected]"
+  ttl     = 120
+}
+
+resource "cloudflare_dns_record" "mail_mta_sts" {
+  zone_id = var.zone_id
+  name    = "_mta-sts.quorate.dev"
+  type    = "TXT"
+  content = "v=STSv1; id=${local.mta_sts_policy_id}"
+  ttl     = 120
+}
+
+resource "cloudflare_dns_record" "mail_tlsrpt" {
+  zone_id = var.zone_id
+  name    = "_smtp._tls.quorate.dev"
+  type    = "TXT"
+  content = "v=TLSRPTv1; rua=mailto:[email protected]"
+  ttl     = 120
+}
+
+resource "cloudflare_dns_record" "forge_git" {
+  zone_id = var.zone_id
+  name    = "git.quorate.dev"
+  type    = "A"
+  content = data.terraform_remote_state.oci_relay.outputs.public_ip
+  ttl     = 120
+  proxied = false
+}
+
+check "zitadel_has_no_bypass" {
+  assert {
+    condition = (
+      length([for record in data.cloudflare_dns_records.zitadel.result : record if record.type == "A"]) == 1 &&
+      length([for record in data.cloudflare_dns_records.zitadel.result : record if record.type == "AAAA"]) == 0
+    )
+    error_message = "Zitadel must have exactly one A record and no AAAA record."
+  }
+}
+
+check "forge_git_has_no_bypass" {
+  assert {
+    condition = (
+      length([for record in data.cloudflare_dns_records.forge_git.result : record if record.type == "A"]) <= 1 &&
+      length([for record in data.cloudflare_dns_records.forge_git.result : record if record.type == "AAAA"]) == 0
+    )
+    error_message = "Authenticated public Forgejo must have at most one A record and no AAAA record before reconciliation."
+  }
+}
+
+resource "terraform_data" "mail_dns_activation" {
+  lifecycle {
+    precondition {
+      condition     = !var.mail_mx_enabled || var.mail_a_enabled
+      error_message = "The authoritative MX record requires the mail host A record to remain enabled."
+    }
+
+    precondition {
+      condition = (
+        length([for record in data.cloudflare_dns_records.mail.result : record if record.type == "A"]) <= 1 &&
+        length([for record in data.cloudflare_dns_records.mail.result : record if record.type == "AAAA"]) == 0
+      )
+      error_message = "Stalwart must have at most one A record and no AAAA record before reconciliation."
+    }
+  }
+}