Migrate mcintire.me DNS from self-hosted BIND9 to Cloudflare
- Add mcintire.me zone + all 14 DNS records to tofu/cloudflare.tf (A, MX, CNAME, SRV, TXT) - Include zone settings, HSTS, bot management, firewall for mcintire.me - Update Porkbun NS from as393837_ns to cloudflare_ns in tofu/dns.tf - Remove mcintire.me zone from BIND9 master config (group_vars/bind9_servers/) - Delete mcintire.me.yml zone file - Remove mcintire.me secondary zone from git.mcintire.me host_vars
This commit is contained in:
Graham McInitre
parent
a6b99691fb
commit
d644868602
5 changed files with 281 additions and 47 deletions
|
|
@ -25,7 +25,6 @@ bind_allow_transfer:
|
|||
bind_zones:
|
||||
- "{{ beanjar_org_zone }}"
|
||||
- "{{ gridmap_org_zone }}"
|
||||
- "{{ mcintire_me_zone }}"
|
||||
- "{{ manero_org_zone }}"
|
||||
- "{{ ntxarms_com_zone }}"
|
||||
- "{{ towerops_net_zone }}"
|
||||
|
|
|
|||
|
|
@ -1,42 +0,0 @@
|
|||
---
|
||||
# mcintire.me DNS zone configuration
|
||||
mcintire_me_zone:
|
||||
name: mcintire.me
|
||||
type: master
|
||||
create_reverse_zones: false
|
||||
name_servers:
|
||||
- ns1.as393837.net.
|
||||
- ns2.as393837.net.
|
||||
- ns-global.kjsl.com.
|
||||
mail_servers:
|
||||
- name: mail
|
||||
preference: 10
|
||||
- name: mail.nsnw.ca.
|
||||
preference: 20
|
||||
hosts:
|
||||
- name: mail
|
||||
ip: 107.174.178.20
|
||||
- name: photos
|
||||
ip: 204.110.191.8
|
||||
- name: git
|
||||
ip: 172.245.56.83
|
||||
- name: vm1
|
||||
ip: 172.245.56.83
|
||||
other_name_servers:
|
||||
- ha.mcintire.me. IN CNAME q1l09qiycnaagngmjsg1qas0rhqcfoou.ui.nabu.casa.
|
||||
- _acme-challenge.ha.mcintire.me. IN CNAME _acme-challenge.q1l09qiycnaagngmjsg1qas0rhqcfoou.ui.nabu.casa.
|
||||
- autodiscover.mcintire.me. IN CNAME mail.w5isp.com.
|
||||
- autoconfig.mcintire.me. IN CNAME mail.w5isp.com.
|
||||
- em977211.mcintire.me. IN CNAME return.smtp2go.net.
|
||||
- s977211._domainkey.mcintire.me. IN CNAME dkim.smtp2go.net.
|
||||
- link.mcintire.me. IN CNAME track.smtp2go.net.
|
||||
- _autodiscover._tcp.mcintire.me. IN SRV 0 0 443 mail.w5isp.com.
|
||||
text:
|
||||
- name: "@"
|
||||
text: '"v=spf1 mx a ip4:107.174.178.20 ~all"'
|
||||
- name: _dmarc
|
||||
text: '"v=DMARC1; p=quarantine; rua=mailto:postmaster@mcintire.me; ruf=mailto:postmaster@mcintire.me; fo=1"'
|
||||
- name: dkim._domainkey
|
||||
text: '"v=DKIM1;k=rsa;t=s;s=email;p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA0rQie7Hz5AmDbVUX+rKNgp6Hf7crtWyfy6qKbqnrxmmernz1rQ6HyOrHhFAlc8nVLNKr8XP2DOROb1jAnrjndZo9I/ymbrrrCBsi9w6zAht2BheijO/R9k5CDRjeSafm6bg0oMKihtNMIdXvEj9ND8hDpZZKxtOrKFH7zLm4CPmm7jf0gqZH2yK+AA3OYUGSYa1OT0LtdMXadk0IVOI2VYf37Hzb3RUvGOYMVkT0xi+23DiyFk7AyCiyv3LQVBMT+/bwyd4k3yVVn2cr9+Nor+HXVjqASLtqcFLMf1SuX0ezSAjBG7BbqQr5G6Jz+n5YglqEIUKVYzJFE7JdDmqQYQIDAQAB"'
|
||||
- name: "@"
|
||||
text: '"yahoo-verification-key=Pt59XUhQSd7dbVc0x6TQD+mBEtOOTMHFRV1ZG78h4Ug="'
|
||||
|
|
@ -31,9 +31,6 @@ bind_zones:
|
|||
- name: aprs.me
|
||||
type: secondary
|
||||
primaries: [204.110.191.222]
|
||||
- name: mcintire.me
|
||||
type: secondary
|
||||
primaries: [204.110.191.222]
|
||||
- name: manero.org
|
||||
type: secondary
|
||||
primaries: [204.110.191.222]
|
||||
|
|
|
|||
|
|
@ -1174,3 +1174,283 @@ resource "cloudflare_zero_trust_tunnel_cloudflared_config" "towerops_dev" {
|
|||
]
|
||||
}
|
||||
}
|
||||
|
||||
# =============================================================================
|
||||
# mcintire.me Zone
|
||||
#
|
||||
# Migrated from self-hosted BIND9 (ns1.as393837.net) to Cloudflare.
|
||||
#
|
||||
# IMPORTANT: The zone is created fresh (no import block). After the first
|
||||
# `tofu apply`, run `tofu state show cloudflare_zone.mcintire_me` to get the
|
||||
# assigned name_servers, then update tofu/dns.tf with those values before
|
||||
# running `tofu apply` a second time to update Porkbun's NS records.
|
||||
# =============================================================================
|
||||
|
||||
resource "cloudflare_zone" "mcintire_me" {
|
||||
account = {
|
||||
id = local.cloudflare_account_id
|
||||
}
|
||||
name = "mcintire.me"
|
||||
}
|
||||
|
||||
# =============================================================================
|
||||
# mcintire.me - A records
|
||||
# =============================================================================
|
||||
|
||||
resource "cloudflare_dns_record" "mcintire_me_a_mail" {
|
||||
zone_id = cloudflare_zone.mcintire_me.id
|
||||
type = "A"
|
||||
name = "mail"
|
||||
content = "107.174.178.20"
|
||||
proxied = false
|
||||
ttl = 86400
|
||||
}
|
||||
|
||||
resource "cloudflare_dns_record" "mcintire_me_a_photos" {
|
||||
zone_id = cloudflare_zone.mcintire_me.id
|
||||
type = "A"
|
||||
name = "photos"
|
||||
content = "204.110.191.8"
|
||||
proxied = false
|
||||
ttl = 86400
|
||||
}
|
||||
|
||||
resource "cloudflare_dns_record" "mcintire_me_a_git" {
|
||||
zone_id = cloudflare_zone.mcintire_me.id
|
||||
type = "A"
|
||||
name = "git"
|
||||
content = "172.245.56.83"
|
||||
proxied = false
|
||||
ttl = 86400
|
||||
}
|
||||
|
||||
resource "cloudflare_dns_record" "mcintire_me_a_vm1" {
|
||||
zone_id = cloudflare_zone.mcintire_me.id
|
||||
type = "A"
|
||||
name = "vm1"
|
||||
content = "172.245.56.83"
|
||||
proxied = false
|
||||
ttl = 86400
|
||||
}
|
||||
|
||||
# =============================================================================
|
||||
# mcintire.me - MX records
|
||||
# =============================================================================
|
||||
|
||||
resource "cloudflare_dns_record" "mcintire_me_mx_root_primary" {
|
||||
zone_id = cloudflare_zone.mcintire_me.id
|
||||
type = "MX"
|
||||
name = "mcintire.me"
|
||||
content = "mail.mcintire.me"
|
||||
priority = 10
|
||||
ttl = 86400
|
||||
}
|
||||
|
||||
resource "cloudflare_dns_record" "mcintire_me_mx_root_backup" {
|
||||
zone_id = cloudflare_zone.mcintire_me.id
|
||||
type = "MX"
|
||||
name = "mcintire.me"
|
||||
content = "mail.nsnw.ca"
|
||||
priority = 20
|
||||
ttl = 86400
|
||||
}
|
||||
|
||||
# =============================================================================
|
||||
# mcintire.me - CNAME records
|
||||
# =============================================================================
|
||||
|
||||
resource "cloudflare_dns_record" "mcintire_me_cname_ha" {
|
||||
zone_id = cloudflare_zone.mcintire_me.id
|
||||
type = "CNAME"
|
||||
name = "ha"
|
||||
content = "q1l09qiycnaagngmjsg1qas0rhqcfoou.ui.nabu.casa"
|
||||
proxied = false
|
||||
ttl = 86400
|
||||
}
|
||||
|
||||
resource "cloudflare_dns_record" "mcintire_me_cname_acme_ha" {
|
||||
zone_id = cloudflare_zone.mcintire_me.id
|
||||
type = "CNAME"
|
||||
name = "_acme-challenge.ha"
|
||||
content = "_acme-challenge.q1l09qiycnaagngmjsg1qas0rhqcfoou.ui.nabu.casa"
|
||||
proxied = false
|
||||
ttl = 86400
|
||||
}
|
||||
|
||||
resource "cloudflare_dns_record" "mcintire_me_cname_autodiscover" {
|
||||
zone_id = cloudflare_zone.mcintire_me.id
|
||||
type = "CNAME"
|
||||
name = "autodiscover"
|
||||
content = "mail.w5isp.com"
|
||||
proxied = false
|
||||
ttl = 86400
|
||||
}
|
||||
|
||||
resource "cloudflare_dns_record" "mcintire_me_cname_autoconfig" {
|
||||
zone_id = cloudflare_zone.mcintire_me.id
|
||||
type = "CNAME"
|
||||
name = "autoconfig"
|
||||
content = "mail.w5isp.com"
|
||||
proxied = false
|
||||
ttl = 86400
|
||||
}
|
||||
|
||||
resource "cloudflare_dns_record" "mcintire_me_cname_em977211" {
|
||||
zone_id = cloudflare_zone.mcintire_me.id
|
||||
type = "CNAME"
|
||||
name = "em977211"
|
||||
content = "return.smtp2go.net"
|
||||
proxied = false
|
||||
ttl = 86400
|
||||
}
|
||||
|
||||
resource "cloudflare_dns_record" "mcintire_me_cname_dkim_s977211" {
|
||||
zone_id = cloudflare_zone.mcintire_me.id
|
||||
type = "CNAME"
|
||||
name = "s977211._domainkey"
|
||||
content = "dkim.smtp2go.net"
|
||||
proxied = false
|
||||
ttl = 86400
|
||||
}
|
||||
|
||||
resource "cloudflare_dns_record" "mcintire_me_cname_link" {
|
||||
zone_id = cloudflare_zone.mcintire_me.id
|
||||
type = "CNAME"
|
||||
name = "link"
|
||||
content = "track.smtp2go.net"
|
||||
proxied = false
|
||||
ttl = 86400
|
||||
}
|
||||
|
||||
# =============================================================================
|
||||
# mcintire.me - SRV records
|
||||
# =============================================================================
|
||||
|
||||
resource "cloudflare_dns_record" "mcintire_me_srv_autodiscover" {
|
||||
zone_id = cloudflare_zone.mcintire_me.id
|
||||
type = "SRV"
|
||||
name = "_autodiscover._tcp"
|
||||
ttl = 86400
|
||||
|
||||
data = {
|
||||
priority = 0
|
||||
weight = 0
|
||||
port = 443
|
||||
target = "mail.w5isp.com"
|
||||
}
|
||||
|
||||
lifecycle {
|
||||
ignore_changes = [priority]
|
||||
}
|
||||
}
|
||||
|
||||
# =============================================================================
|
||||
# mcintire.me - TXT records
|
||||
# =============================================================================
|
||||
|
||||
resource "cloudflare_dns_record" "mcintire_me_txt_spf" {
|
||||
zone_id = cloudflare_zone.mcintire_me.id
|
||||
type = "TXT"
|
||||
name = "mcintire.me"
|
||||
content = "v=spf1 mx a ip4:107.174.178.20 ~all"
|
||||
ttl = 86400
|
||||
}
|
||||
|
||||
resource "cloudflare_dns_record" "mcintire_me_txt_dmarc" {
|
||||
zone_id = cloudflare_zone.mcintire_me.id
|
||||
type = "TXT"
|
||||
name = "_dmarc"
|
||||
content = "v=DMARC1; p=quarantine; rua=mailto:postmaster@mcintire.me; ruf=mailto:postmaster@mcintire.me; fo=1"
|
||||
ttl = 86400
|
||||
}
|
||||
|
||||
resource "cloudflare_dns_record" "mcintire_me_txt_dkim" {
|
||||
zone_id = cloudflare_zone.mcintire_me.id
|
||||
type = "TXT"
|
||||
name = "dkim._domainkey"
|
||||
content = "v=DKIM1;k=rsa;t=s;s=email;p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA0rQie7Hz5AmDbVUX+rKNgp6Hf7crtWyfy6qKbqnrxmmernz1rQ6HyOrHhFAlc8nVLNKr8XP2DOROb1jAnrjndZo9I/ymbrrrCBsi9w6zAht2BheijO/R9k5CDRjeSafm6bg0oMKihtNMIdXvEj9ND8hDpZZKxtOrKFH7zLm4CPmm7jf0gqZH2yK+AA3OYUGSYa1OT0LtdMXadk0IVOI2VYf37Hzb3RUvGOYMVkT0xi+23DiyFk7AyCiyv3LQVBMT+/bwyd4k3yVVn2cr9+Nor+HXVjqASLtqcFLMf1SuX0ezSAjBG7BbqQr5G6Jz+n5YglqEIUKVYzJFE7JdDmqQYQIDAQAB"
|
||||
ttl = 86400
|
||||
}
|
||||
|
||||
resource "cloudflare_dns_record" "mcintire_me_txt_yahoo_verification" {
|
||||
zone_id = cloudflare_zone.mcintire_me.id
|
||||
type = "TXT"
|
||||
name = "mcintire.me"
|
||||
content = "yahoo-verification-key=Pt59XUhQSd7dbVc0x6TQD+mBEtOOTMHFRV1ZG78h4Ug="
|
||||
ttl = 86400
|
||||
}
|
||||
|
||||
# =============================================================================
|
||||
# mcintire.me - Zone settings
|
||||
# =============================================================================
|
||||
|
||||
resource "cloudflare_zone_setting" "mcintire_me_min_tls_version" {
|
||||
zone_id = cloudflare_zone.mcintire_me.id
|
||||
setting_id = "min_tls_version"
|
||||
value = "1.2"
|
||||
}
|
||||
|
||||
resource "cloudflare_zone_setting" "mcintire_me_always_use_https" {
|
||||
zone_id = cloudflare_zone.mcintire_me.id
|
||||
setting_id = "always_use_https"
|
||||
value = "on"
|
||||
}
|
||||
|
||||
resource "cloudflare_zone_setting" "mcintire_me_tls_1_3" {
|
||||
zone_id = cloudflare_zone.mcintire_me.id
|
||||
setting_id = "tls_1_3"
|
||||
value = "zrt"
|
||||
}
|
||||
|
||||
resource "cloudflare_zone_setting" "mcintire_me_zero_rtt" {
|
||||
zone_id = cloudflare_zone.mcintire_me.id
|
||||
setting_id = "0rtt"
|
||||
value = "on"
|
||||
}
|
||||
|
||||
resource "cloudflare_zone_setting" "mcintire_me_ssl" {
|
||||
zone_id = cloudflare_zone.mcintire_me.id
|
||||
setting_id = "ssl"
|
||||
value = "full"
|
||||
}
|
||||
|
||||
resource "cloudflare_zone_setting" "mcintire_me_security_header" {
|
||||
zone_id = cloudflare_zone.mcintire_me.id
|
||||
setting_id = "security_header"
|
||||
value = {
|
||||
strict_transport_security = {
|
||||
enabled = true
|
||||
max_age = 15552000
|
||||
include_subdomains = true
|
||||
preload = true
|
||||
nosniff = true
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
# =============================================================================
|
||||
# mcintire.me - Bot management
|
||||
# =============================================================================
|
||||
|
||||
resource "cloudflare_bot_management" "mcintire_me" {
|
||||
zone_id = cloudflare_zone.mcintire_me.id
|
||||
is_robots_txt_managed = false
|
||||
}
|
||||
|
||||
# =============================================================================
|
||||
# mcintire.me - Firewall
|
||||
# =============================================================================
|
||||
|
||||
resource "cloudflare_ruleset" "mcintire_me_firewall" {
|
||||
zone_id = cloudflare_zone.mcintire_me.id
|
||||
name = "default"
|
||||
kind = "zone"
|
||||
phase = "http_request_firewall_custom"
|
||||
|
||||
rules = [{
|
||||
action = "block"
|
||||
expression = local.firewall_expression
|
||||
description = "block abusers"
|
||||
enabled = true
|
||||
}]
|
||||
}
|
||||
|
|
|
|||
|
|
@ -29,7 +29,7 @@ locals {
|
|||
"gridmap.org" = local.cloudflare_ns
|
||||
"gunincrements.com" = local.porkbun_ns
|
||||
"manero.org" = local.porkbun_ns
|
||||
"mcintire.me" = local.as393837_ns
|
||||
"mcintire.me" = local.cloudflare_ns
|
||||
"ntxarms.com" = local.as393837_ns
|
||||
"qth.social" = local.porkbun_ns
|
||||
# towerops.net is not opted in to Porkbun API access
|
||||
|
|
|
|||
Loading…
Add table
Reference in a new issue