70 lines
1.9 KiB
HCL
70 lines
1.9 KiB
HCL
# The DNS records that point at the HEAD VPS, and only those: infomaniak_record manages single
|
|
# records, so the rest of each zone (mail, the apex, other subdomains) is never read or changed.
|
|
#
|
|
# Applied by the VPS itself: doco-cd runs this folder's compose.yaml (apply.sh) whenever it changes.
|
|
# INFOMANIAK_TOKEN (API token, scopes dns:read dns:write) and TF_VAR_state_passphrase come from
|
|
# fnox.toml (recipients: Elias, the VPS). The state lives on the VPS (volume dns_state), encrypted.
|
|
|
|
terraform {
|
|
required_version = ">= 1.8"
|
|
# Path given at init: /state/terraform.tfstate on the VPS (apply.sh).
|
|
backend "local" {}
|
|
required_providers {
|
|
infomaniak = {
|
|
source = "Infomaniak/infomaniak"
|
|
version = "= 1.4.1"
|
|
}
|
|
}
|
|
|
|
encryption {
|
|
key_provider "pbkdf2" "state" {
|
|
passphrase = var.state_passphrase
|
|
}
|
|
method "aes_gcm" "state" {
|
|
keys = key_provider.pbkdf2.state
|
|
}
|
|
state {
|
|
method = method.aes_gcm.state
|
|
enforced = true
|
|
}
|
|
plan {
|
|
method = method.aes_gcm.state
|
|
enforced = true
|
|
}
|
|
}
|
|
}
|
|
|
|
variable "state_passphrase" {
|
|
type = string
|
|
sensitive = true
|
|
}
|
|
|
|
provider "infomaniak" {}
|
|
|
|
locals {
|
|
vps = {
|
|
A = "185.143.103.191"
|
|
AAAA = "2001:1600:13:101::1295"
|
|
}
|
|
|
|
# zone => names (relative to the zone, "." for the apex) served by the VPS.
|
|
names = {
|
|
"fuckingtech.ch" = [".", "storytellurx", "v1.storytellurx", "git", "s3", "assets", "sharp"]
|
|
}
|
|
|
|
records = merge([
|
|
for zone, names in local.names : {
|
|
for pair in setproduct(names, keys(local.vps)) :
|
|
"${pair[0] == "." ? zone : "${pair[0]}.${zone}"} ${pair[1]}" => { zone = zone, source = pair[0], type = pair[1] }
|
|
}
|
|
]...)
|
|
}
|
|
|
|
resource "infomaniak_record" "vps" {
|
|
for_each = local.records
|
|
zone_fqdn = each.value.zone
|
|
source = each.value.source
|
|
type = each.value.type
|
|
target = local.vps[each.value.type]
|
|
ttl = 3600
|
|
}
|