update some dns and cloudflare

ansible/group_vars/bind9_servers/aprs.me.yml

@@ -10,5 +10,4 @@ aprs_me_zone:
   hosts:
     - name: "@"
       ip: 172.245.56.83
-  other_name_servers:
-    - aprs.me. IN CAA 0 issue "letsencrypt.org"
+  other_name_servers: []

ansible/group_vars/bind9_servers/towerops.net.yml

@@ -18,6 +18,9 @@ towerops_net_zone:
       ip: 172.245.56.83
   other_name_servers:
     - towerops.net. IN CAA 0 issue "letsencrypt.org"
+    - towerops.net. IN CAA 0 issue "pki.goog"
+    - towerops.net. IN CAA 0 issue "ssl.com"
+    - towerops.net. IN CAA 0 issue "sectigo.com"
     - autodiscover.towerops.net. IN CNAME mail.mcintire.me.
     - autoconfig.towerops.net. IN CNAME mail.mcintire.me.
     - _autodiscover._tcp.towerops.net. IN SRV 0 0 443 mail.mcintire.me.

ansible/group_vars/bind9_servers/w5isp.com.yml

@@ -36,6 +36,7 @@ w5isp_com_zone:
     - em40.w5isp.com. IN CNAME u177982.wl233.sendgrid.net.
     - s1._domainkey.w5isp.com. IN CNAME s1.domainkey.u177982.wl233.sendgrid.net.
     - s2._domainkey.w5isp.com. IN CNAME s2.domainkey.u177982.wl233.sendgrid.net.
+    - uptime.w5isp.com. IN CNAME stats.uptimerobot.com.
     - _autodiscover._tcp.w5isp.com. IN SRV 0 0 443 mail.w5isp.com.
   text:
     - name: "@"

tofu/cloudflare.tf

@@ -247,6 +247,37 @@ resource "cloudflare_record" "gridmap_org_tunnel" {
   proxied = true
 }
 
+# =============================================================================
+# DNS Records (CAA) - restrict certificate issuance to Cloudflare CAs
+# =============================================================================
+
+locals {
+  cloudflare_cas = ["letsencrypt.org", "pki.goog", "ssl.com", "sectigo.com"]
+  caa_zones      = ["aprs.me", "gridmap.org"]
+  caa_records = merge([
+    for zone in local.caa_zones : {
+      for ca in local.cloudflare_cas : "${zone}-${ca}" => {
+        zone = zone
+        ca   = ca
+      }
+    }
+  ]...)
+}
+
+resource "cloudflare_record" "caa" {
+  for_each = local.caa_records
+
+  zone_id = cloudflare_zone.zones[each.value.zone].id
+  type    = "CAA"
+  name    = each.value.zone
+
+  data {
+    flags = "0"
+    tag   = "issue"
+    value = each.value.ca
+  }
+}
+
 # =============================================================================
 # DNS Records (SRV) - separate due to data block
 # =============================================================================
@@ -262,9 +293,6 @@ resource "cloudflare_record" "towerops_srv_autodiscover" {
   name    = "_autodiscover._tcp"
 
   data {
-    service  = "_autodiscover"
-    proto    = "_tcp"
-    name     = "towerops.net"
     priority = 0
     weight   = 0
     port     = 443
@@ -275,19 +303,88 @@ resource "cloudflare_record" "towerops_srv_autodiscover" {
 # =============================================================================
 # Zone Settings
 #
-# cloudflare_zone_settings_override doesn't support import, so zone settings
-# are not managed here. Current non-default settings on towerops.net:
-#   - zero_rtt: on
-#   - always_use_https: on
-#   - min_tls_version: 1.2
-#   - pseudo_ipv4: add_header
-#   - tls_1_3: zrt (0-RTT)
-#   - HSTS: enabled, max_age=15552000, preload=true, nosniff=true
+# Zone security settings: TLS hardening and HSTS
+# =============================================================================
+resource "cloudflare_zone_settings_override" "aprs_me" {
+  zone_id = cloudflare_zone.zones["aprs.me"].id
+
+  settings {
+    min_tls_version  = "1.2"
+    always_use_https = "on"
+    tls_1_3          = "zrt"
+    zero_rtt         = "on"
+    ssl              = "strict"
+
+    security_header {
+      enabled            = true
+      max_age            = 15552000
+      include_subdomains = true
+      preload            = true
+      nosniff            = true
+    }
+  }
+}
+
+resource "cloudflare_zone_settings_override" "towerops_net" {
+  zone_id = cloudflare_zone.zones["towerops.net"].id
+
+  settings {
+    min_tls_version  = "1.2"
+    always_use_https = "on"
+    tls_1_3          = "zrt"
+    zero_rtt         = "on"
+    ssl              = "strict"
+
+    security_header {
+      enabled            = true
+      max_age            = 15552000
+      include_subdomains = true
+      preload            = true
+      nosniff            = true
+    }
+  }
+}
+
+resource "cloudflare_zone_settings_override" "gridmap_org" {
+  zone_id = cloudflare_zone.zones["gridmap.org"].id
+
+  settings {
+    min_tls_version  = "1.2"
+    always_use_https = "on"
+    tls_1_3          = "zrt"
+    zero_rtt         = "on"
+    ssl              = "strict"
+
+    security_header {
+      enabled            = true
+      max_age            = 15552000
+      include_subdomains = true
+      preload            = true
+      nosniff            = true
+    }
+  }
+}
+# =============================================================================
+# Firewall - custom rules (applied to all zones)
 # =============================================================================
 
-# =============================================================================
-# Firewall - towerops.net custom rules
-# =============================================================================
+locals {
+  firewall_expression = join(" or ", [
+    "(ip.src.country in {\"KP\" \"RU\" \"CN\" \"SY\" \"MM\" \"VE\" \"IQ\" \"LY\" \"SO\" \"YE\" \"SS\"})",
+    "(http.request.uri.path contains \".php\")",
+    "(http.request.uri.path contains \"/wp-content\")",
+    "(http.request.uri.path contains \"/wp-login\")",
+    "(http.request.uri.path contains \"/wp-admin\")",
+    "(http.request.uri.path contains \"/wp-includes\")",
+    "(http.request.uri.path contains \"/xmlrpc.php\")",
+    "(http.request.uri.path contains \"wlwmanifest.xml\")",
+    "(http.request.uri.path contains \"/.env\")",
+    "(http.request.uri.path contains \"/.git\")",
+    "(http.request.uri.path contains \"/phpmyadmin\")",
+    "(http.request.uri.path contains \"/cgi-bin\")",
+    "(not http.user_agent ne \"\")",
+  ])
+}
 
 import {
   to = cloudflare_ruleset.towerops_firewall
@@ -302,8 +399,41 @@ resource "cloudflare_ruleset" "towerops_firewall" {
 
   rules {
     action      = "block"
-    expression  = "(http.request.uri.path wildcard r\"/wp-content/*\") or (http.request.uri.path wildcard r\"/wp-admin/*\") or (http.request.uri.path wildcard r\"/*.php\")"
-    description = "wordpress"
+    expression  = local.firewall_expression
+    description = "block abusers"
+    enabled     = true
+  }
+}
+
+import {
+  to = cloudflare_ruleset.gridmap_firewall
+  id = "zone/${local.cloudflare_zones["gridmap.org"]}/7dfc79c24a22439ea501865479822df8"
+}
+
+resource "cloudflare_ruleset" "gridmap_firewall" {
+  zone_id = cloudflare_zone.zones["gridmap.org"].id
+  name    = "default"
+  kind    = "zone"
+  phase   = "http_request_firewall_custom"
+
+  rules {
+    action      = "block"
+    expression  = local.firewall_expression
+    description = "block abusers"
+    enabled     = true
+  }
+}
+
+resource "cloudflare_ruleset" "aprs_me_firewall" {
+  zone_id = cloudflare_zone.zones["aprs.me"].id
+  name    = "default"
+  kind    = "zone"
+  phase   = "http_request_firewall_custom"
+
+  rules {
+    action      = "block"
+    expression  = local.firewall_expression
+    description = "block abusers"
     enabled     = true
   }
 }

tofu/dns.tf

@@ -1,8 +1,8 @@
 locals {
   as393837_ns = [
     "ns1.as393837.net",
-    "ns2.as393837.net",
     "ns-global.kjsl.com",
+    "ns2.as393837.net",
   ]
 
   cloudflare_ns = [
@@ -11,10 +11,10 @@ locals {
   ]
 
   porkbun_ns = [
-    "curitiba.ns.porkbun.com",
-    "fortaleza.ns.porkbun.com",
     "maceio.ns.porkbun.com",
     "salvador.ns.porkbun.com",
+    "fortaleza.ns.porkbun.com",
+    "curitiba.ns.porkbun.com",
   ]
 
   domains = {
@@ -42,5 +42,5 @@ resource "porkbun_nameservers" "domains" {
   for_each = local.domains
 
   domain      = each.key
-  nameservers = each.value
+  nameservers = sort(each.value)
 }