From d644868602bf6e48ecb086c57b59ad21bba29224 Mon Sep 17 00:00:00 2001 From: Graham McInitre Date: Fri, 24 Jul 2026 09:14:36 -0500 Subject: [PATCH] Migrate mcintire.me DNS from self-hosted BIND9 to Cloudflare - Add mcintire.me zone + all 14 DNS records to tofu/cloudflare.tf (A, MX, CNAME, SRV, TXT) - Include zone settings, HSTS, bot management, firewall for mcintire.me - Update Porkbun NS from as393837_ns to cloudflare_ns in tofu/dns.tf - Remove mcintire.me zone from BIND9 master config (group_vars/bind9_servers/) - Delete mcintire.me.yml zone file - Remove mcintire.me secondary zone from git.mcintire.me host_vars --- ansible/group_vars/bind9_servers/main.yml | 1 - .../group_vars/bind9_servers/mcintire.me.yml | 42 --- ansible/host_vars/git.mcintire.me.yml | 3 - tofu/cloudflare.tf | 280 ++++++++++++++++++ tofu/dns.tf | 2 +- 5 files changed, 281 insertions(+), 47 deletions(-) delete mode 100644 ansible/group_vars/bind9_servers/mcintire.me.yml diff --git a/ansible/group_vars/bind9_servers/main.yml b/ansible/group_vars/bind9_servers/main.yml index 4e85aa0..fdef6b6 100644 --- a/ansible/group_vars/bind9_servers/main.yml +++ b/ansible/group_vars/bind9_servers/main.yml @@ -25,7 +25,6 @@ bind_allow_transfer: bind_zones: - "{{ beanjar_org_zone }}" - "{{ gridmap_org_zone }}" - - "{{ mcintire_me_zone }}" - "{{ manero_org_zone }}" - "{{ ntxarms_com_zone }}" - "{{ towerops_net_zone }}" diff --git a/ansible/group_vars/bind9_servers/mcintire.me.yml b/ansible/group_vars/bind9_servers/mcintire.me.yml deleted file mode 100644 index 96e6c8c..0000000 --- a/ansible/group_vars/bind9_servers/mcintire.me.yml +++ /dev/null @@ -1,42 +0,0 @@ ---- -# mcintire.me DNS zone configuration -mcintire_me_zone: - name: mcintire.me - type: master - create_reverse_zones: false - name_servers: - - ns1.as393837.net. - - ns2.as393837.net. - - ns-global.kjsl.com. - mail_servers: - - name: mail - preference: 10 - - name: mail.nsnw.ca. - preference: 20 - hosts: - - name: mail - ip: 107.174.178.20 - - name: photos - ip: 204.110.191.8 - - name: git - ip: 172.245.56.83 - - name: vm1 - ip: 172.245.56.83 - other_name_servers: - - ha.mcintire.me. IN CNAME q1l09qiycnaagngmjsg1qas0rhqcfoou.ui.nabu.casa. - - _acme-challenge.ha.mcintire.me. IN CNAME _acme-challenge.q1l09qiycnaagngmjsg1qas0rhqcfoou.ui.nabu.casa. - - autodiscover.mcintire.me. IN CNAME mail.w5isp.com. - - autoconfig.mcintire.me. IN CNAME mail.w5isp.com. - - em977211.mcintire.me. IN CNAME return.smtp2go.net. - - s977211._domainkey.mcintire.me. IN CNAME dkim.smtp2go.net. - - link.mcintire.me. IN CNAME track.smtp2go.net. - - _autodiscover._tcp.mcintire.me. IN SRV 0 0 443 mail.w5isp.com. - text: - - name: "@" - text: '"v=spf1 mx a ip4:107.174.178.20 ~all"' - - name: _dmarc - text: '"v=DMARC1; p=quarantine; rua=mailto:postmaster@mcintire.me; ruf=mailto:postmaster@mcintire.me; fo=1"' - - name: dkim._domainkey - text: '"v=DKIM1;k=rsa;t=s;s=email;p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA0rQie7Hz5AmDbVUX+rKNgp6Hf7crtWyfy6qKbqnrxmmernz1rQ6HyOrHhFAlc8nVLNKr8XP2DOROb1jAnrjndZo9I/ymbrrrCBsi9w6zAht2BheijO/R9k5CDRjeSafm6bg0oMKihtNMIdXvEj9ND8hDpZZKxtOrKFH7zLm4CPmm7jf0gqZH2yK+AA3OYUGSYa1OT0LtdMXadk0IVOI2VYf37Hzb3RUvGOYMVkT0xi+23DiyFk7AyCiyv3LQVBMT+/bwyd4k3yVVn2cr9+Nor+HXVjqASLtqcFLMf1SuX0ezSAjBG7BbqQr5G6Jz+n5YglqEIUKVYzJFE7JdDmqQYQIDAQAB"' - - name: "@" - text: '"yahoo-verification-key=Pt59XUhQSd7dbVc0x6TQD+mBEtOOTMHFRV1ZG78h4Ug="' diff --git a/ansible/host_vars/git.mcintire.me.yml b/ansible/host_vars/git.mcintire.me.yml index c6205bc..795bfa9 100644 --- a/ansible/host_vars/git.mcintire.me.yml +++ b/ansible/host_vars/git.mcintire.me.yml @@ -31,9 +31,6 @@ bind_zones: - name: aprs.me type: secondary primaries: [204.110.191.222] - - name: mcintire.me - type: secondary - primaries: [204.110.191.222] - name: manero.org type: secondary primaries: [204.110.191.222] diff --git a/tofu/cloudflare.tf b/tofu/cloudflare.tf index a47bc22..a978027 100644 --- a/tofu/cloudflare.tf +++ b/tofu/cloudflare.tf @@ -1174,3 +1174,283 @@ resource "cloudflare_zero_trust_tunnel_cloudflared_config" "towerops_dev" { ] } } + +# ============================================================================= +# mcintire.me Zone +# +# Migrated from self-hosted BIND9 (ns1.as393837.net) to Cloudflare. +# +# IMPORTANT: The zone is created fresh (no import block). After the first +# `tofu apply`, run `tofu state show cloudflare_zone.mcintire_me` to get the +# assigned name_servers, then update tofu/dns.tf with those values before +# running `tofu apply` a second time to update Porkbun's NS records. +# ============================================================================= + +resource "cloudflare_zone" "mcintire_me" { + account = { + id = local.cloudflare_account_id + } + name = "mcintire.me" +} + +# ============================================================================= +# mcintire.me - A records +# ============================================================================= + +resource "cloudflare_dns_record" "mcintire_me_a_mail" { + zone_id = cloudflare_zone.mcintire_me.id + type = "A" + name = "mail" + content = "107.174.178.20" + proxied = false + ttl = 86400 +} + +resource "cloudflare_dns_record" "mcintire_me_a_photos" { + zone_id = cloudflare_zone.mcintire_me.id + type = "A" + name = "photos" + content = "204.110.191.8" + proxied = false + ttl = 86400 +} + +resource "cloudflare_dns_record" "mcintire_me_a_git" { + zone_id = cloudflare_zone.mcintire_me.id + type = "A" + name = "git" + content = "172.245.56.83" + proxied = false + ttl = 86400 +} + +resource "cloudflare_dns_record" "mcintire_me_a_vm1" { + zone_id = cloudflare_zone.mcintire_me.id + type = "A" + name = "vm1" + content = "172.245.56.83" + proxied = false + ttl = 86400 +} + +# ============================================================================= +# mcintire.me - MX records +# ============================================================================= + +resource "cloudflare_dns_record" "mcintire_me_mx_root_primary" { + zone_id = cloudflare_zone.mcintire_me.id + type = "MX" + name = "mcintire.me" + content = "mail.mcintire.me" + priority = 10 + ttl = 86400 +} + +resource "cloudflare_dns_record" "mcintire_me_mx_root_backup" { + zone_id = cloudflare_zone.mcintire_me.id + type = "MX" + name = "mcintire.me" + content = "mail.nsnw.ca" + priority = 20 + ttl = 86400 +} + +# ============================================================================= +# mcintire.me - CNAME records +# ============================================================================= + +resource "cloudflare_dns_record" "mcintire_me_cname_ha" { + zone_id = cloudflare_zone.mcintire_me.id + type = "CNAME" + name = "ha" + content = "q1l09qiycnaagngmjsg1qas0rhqcfoou.ui.nabu.casa" + proxied = false + ttl = 86400 +} + +resource "cloudflare_dns_record" "mcintire_me_cname_acme_ha" { + zone_id = cloudflare_zone.mcintire_me.id + type = "CNAME" + name = "_acme-challenge.ha" + content = "_acme-challenge.q1l09qiycnaagngmjsg1qas0rhqcfoou.ui.nabu.casa" + proxied = false + ttl = 86400 +} + +resource "cloudflare_dns_record" "mcintire_me_cname_autodiscover" { + zone_id = cloudflare_zone.mcintire_me.id + type = "CNAME" + name = "autodiscover" + content = "mail.w5isp.com" + proxied = false + ttl = 86400 +} + +resource "cloudflare_dns_record" "mcintire_me_cname_autoconfig" { + zone_id = cloudflare_zone.mcintire_me.id + type = "CNAME" + name = "autoconfig" + content = "mail.w5isp.com" + proxied = false + ttl = 86400 +} + +resource "cloudflare_dns_record" "mcintire_me_cname_em977211" { + zone_id = cloudflare_zone.mcintire_me.id + type = "CNAME" + name = "em977211" + content = "return.smtp2go.net" + proxied = false + ttl = 86400 +} + +resource "cloudflare_dns_record" "mcintire_me_cname_dkim_s977211" { + zone_id = cloudflare_zone.mcintire_me.id + type = "CNAME" + name = "s977211._domainkey" + content = "dkim.smtp2go.net" + proxied = false + ttl = 86400 +} + +resource "cloudflare_dns_record" "mcintire_me_cname_link" { + zone_id = cloudflare_zone.mcintire_me.id + type = "CNAME" + name = "link" + content = "track.smtp2go.net" + proxied = false + ttl = 86400 +} + +# ============================================================================= +# mcintire.me - SRV records +# ============================================================================= + +resource "cloudflare_dns_record" "mcintire_me_srv_autodiscover" { + zone_id = cloudflare_zone.mcintire_me.id + type = "SRV" + name = "_autodiscover._tcp" + ttl = 86400 + + data = { + priority = 0 + weight = 0 + port = 443 + target = "mail.w5isp.com" + } + + lifecycle { + ignore_changes = [priority] + } +} + +# ============================================================================= +# mcintire.me - TXT records +# ============================================================================= + +resource "cloudflare_dns_record" "mcintire_me_txt_spf" { + zone_id = cloudflare_zone.mcintire_me.id + type = "TXT" + name = "mcintire.me" + content = "v=spf1 mx a ip4:107.174.178.20 ~all" + ttl = 86400 +} + +resource "cloudflare_dns_record" "mcintire_me_txt_dmarc" { + zone_id = cloudflare_zone.mcintire_me.id + type = "TXT" + name = "_dmarc" + content = "v=DMARC1; p=quarantine; rua=mailto:postmaster@mcintire.me; ruf=mailto:postmaster@mcintire.me; fo=1" + ttl = 86400 +} + +resource "cloudflare_dns_record" "mcintire_me_txt_dkim" { + zone_id = cloudflare_zone.mcintire_me.id + type = "TXT" + name = "dkim._domainkey" + content = "v=DKIM1;k=rsa;t=s;s=email;p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA0rQie7Hz5AmDbVUX+rKNgp6Hf7crtWyfy6qKbqnrxmmernz1rQ6HyOrHhFAlc8nVLNKr8XP2DOROb1jAnrjndZo9I/ymbrrrCBsi9w6zAht2BheijO/R9k5CDRjeSafm6bg0oMKihtNMIdXvEj9ND8hDpZZKxtOrKFH7zLm4CPmm7jf0gqZH2yK+AA3OYUGSYa1OT0LtdMXadk0IVOI2VYf37Hzb3RUvGOYMVkT0xi+23DiyFk7AyCiyv3LQVBMT+/bwyd4k3yVVn2cr9+Nor+HXVjqASLtqcFLMf1SuX0ezSAjBG7BbqQr5G6Jz+n5YglqEIUKVYzJFE7JdDmqQYQIDAQAB" + ttl = 86400 +} + +resource "cloudflare_dns_record" "mcintire_me_txt_yahoo_verification" { + zone_id = cloudflare_zone.mcintire_me.id + type = "TXT" + name = "mcintire.me" + content = "yahoo-verification-key=Pt59XUhQSd7dbVc0x6TQD+mBEtOOTMHFRV1ZG78h4Ug=" + ttl = 86400 +} + +# ============================================================================= +# mcintire.me - Zone settings +# ============================================================================= + +resource "cloudflare_zone_setting" "mcintire_me_min_tls_version" { + zone_id = cloudflare_zone.mcintire_me.id + setting_id = "min_tls_version" + value = "1.2" +} + +resource "cloudflare_zone_setting" "mcintire_me_always_use_https" { + zone_id = cloudflare_zone.mcintire_me.id + setting_id = "always_use_https" + value = "on" +} + +resource "cloudflare_zone_setting" "mcintire_me_tls_1_3" { + zone_id = cloudflare_zone.mcintire_me.id + setting_id = "tls_1_3" + value = "zrt" +} + +resource "cloudflare_zone_setting" "mcintire_me_zero_rtt" { + zone_id = cloudflare_zone.mcintire_me.id + setting_id = "0rtt" + value = "on" +} + +resource "cloudflare_zone_setting" "mcintire_me_ssl" { + zone_id = cloudflare_zone.mcintire_me.id + setting_id = "ssl" + value = "full" +} + +resource "cloudflare_zone_setting" "mcintire_me_security_header" { + zone_id = cloudflare_zone.mcintire_me.id + setting_id = "security_header" + value = { + strict_transport_security = { + enabled = true + max_age = 15552000 + include_subdomains = true + preload = true + nosniff = true + } + } +} + +# ============================================================================= +# mcintire.me - Bot management +# ============================================================================= + +resource "cloudflare_bot_management" "mcintire_me" { + zone_id = cloudflare_zone.mcintire_me.id + is_robots_txt_managed = false +} + +# ============================================================================= +# mcintire.me - Firewall +# ============================================================================= + +resource "cloudflare_ruleset" "mcintire_me_firewall" { + zone_id = cloudflare_zone.mcintire_me.id + name = "default" + kind = "zone" + phase = "http_request_firewall_custom" + + rules = [{ + action = "block" + expression = local.firewall_expression + description = "block abusers" + enabled = true + }] +} diff --git a/tofu/dns.tf b/tofu/dns.tf index 395c64e..a13d31f 100644 --- a/tofu/dns.tf +++ b/tofu/dns.tf @@ -29,7 +29,7 @@ locals { "gridmap.org" = local.cloudflare_ns "gunincrements.com" = local.porkbun_ns "manero.org" = local.porkbun_ns - "mcintire.me" = local.as393837_ns + "mcintire.me" = local.cloudflare_ns "ntxarms.com" = local.as393837_ns "qth.social" = local.porkbun_ns # towerops.net is not opted in to Porkbun API access