Migrate mcintire.me DNS from self-hosted BIND9 to Cloudflare

- Add mcintire.me zone + all 14 DNS records to tofu/cloudflare.tf (A, MX, CNAME, SRV, TXT)
- Include zone settings, HSTS, bot management, firewall for mcintire.me
- Update Porkbun NS from as393837_ns to cloudflare_ns in tofu/dns.tf
- Remove mcintire.me zone from BIND9 master config (group_vars/bind9_servers/)
- Delete mcintire.me.yml zone file
- Remove mcintire.me secondary zone from git.mcintire.me host_vars

ansible/group_vars/bind9_servers/main.yml

@@ -25,7 +25,6 @@ bind_allow_transfer:
 bind_zones:
   - "{{ beanjar_org_zone }}"
   - "{{ gridmap_org_zone }}"
-  - "{{ mcintire_me_zone }}"
   - "{{ manero_org_zone }}"
   - "{{ ntxarms_com_zone }}"
   - "{{ towerops_net_zone }}"

ansible/group_vars/bind9_servers/mcintire.me.yml

@@ -1,42 +0,0 @@
----
-# mcintire.me DNS zone configuration
-mcintire_me_zone:
-  name: mcintire.me
-  type: master
-  create_reverse_zones: false
-  name_servers:
-    - ns1.as393837.net.
-    - ns2.as393837.net.
-    - ns-global.kjsl.com.
-  mail_servers:
-    - name: mail
-      preference: 10
-    - name: mail.nsnw.ca.
-      preference: 20
-  hosts:
-    - name: mail
-      ip: 107.174.178.20
-    - name: photos
-      ip: 204.110.191.8
-    - name: git
-      ip: 172.245.56.83
-    - name: vm1
-      ip: 172.245.56.83
-  other_name_servers:
-    - ha.mcintire.me. IN CNAME q1l09qiycnaagngmjsg1qas0rhqcfoou.ui.nabu.casa.
-    - _acme-challenge.ha.mcintire.me. IN CNAME _acme-challenge.q1l09qiycnaagngmjsg1qas0rhqcfoou.ui.nabu.casa.
-    - autodiscover.mcintire.me. IN CNAME mail.w5isp.com.
-    - autoconfig.mcintire.me. IN CNAME mail.w5isp.com.
-    - em977211.mcintire.me. IN CNAME return.smtp2go.net.
-    - s977211._domainkey.mcintire.me. IN CNAME dkim.smtp2go.net.
-    - link.mcintire.me. IN CNAME track.smtp2go.net.
-    - _autodiscover._tcp.mcintire.me. IN SRV 0 0 443 mail.w5isp.com.
-  text:
-    - name: "@"
-      text: '"v=spf1 mx a ip4:107.174.178.20 ~all"'
-    - name: _dmarc
-      text: '"v=DMARC1; p=quarantine; rua=mailto:postmaster@mcintire.me; ruf=mailto:postmaster@mcintire.me; fo=1"'
-    - name: dkim._domainkey
-      text: '"v=DKIM1;k=rsa;t=s;s=email;p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA0rQie7Hz5AmDbVUX+rKNgp6Hf7crtWyfy6qKbqnrxmmernz1rQ6HyOrHhFAlc8nVLNKr8XP2DOROb1jAnrjndZo9I/ymbrrrCBsi9w6zAht2BheijO/R9k5CDRjeSafm6bg0oMKihtNMIdXvEj9ND8hDpZZKxtOrKFH7zLm4CPmm7jf0gqZH2yK+AA3OYUGSYa1OT0LtdMXadk0IVOI2VYf37Hzb3RUvGOYMVkT0xi+23DiyFk7AyCiyv3LQVBMT+/bwyd4k3yVVn2cr9+Nor+HXVjqASLtqcFLMf1SuX0ezSAjBG7BbqQr5G6Jz+n5YglqEIUKVYzJFE7JdDmqQYQIDAQAB"'
-    - name: "@"
-      text: '"yahoo-verification-key=Pt59XUhQSd7dbVc0x6TQD+mBEtOOTMHFRV1ZG78h4Ug="'

ansible/host_vars/git.mcintire.me.yml

@@ -31,9 +31,6 @@ bind_zones:
   - name: aprs.me
     type: secondary
     primaries: [204.110.191.222]
-  - name: mcintire.me
-    type: secondary
-    primaries: [204.110.191.222]
   - name: manero.org
     type: secondary
     primaries: [204.110.191.222]

tofu/cloudflare.tf

@@ -1174,3 +1174,283 @@ resource "cloudflare_zero_trust_tunnel_cloudflared_config" "towerops_dev" {
     ]
   }
 }
+
+# =============================================================================
+# mcintire.me Zone
+#
+# Migrated from self-hosted BIND9 (ns1.as393837.net) to Cloudflare.
+#
+# IMPORTANT: The zone is created fresh (no import block). After the first
+# `tofu apply`, run `tofu state show cloudflare_zone.mcintire_me` to get the
+# assigned name_servers, then update tofu/dns.tf with those values before
+# running `tofu apply` a second time to update Porkbun's NS records.
+# =============================================================================
+
+resource "cloudflare_zone" "mcintire_me" {
+  account = {
+    id = local.cloudflare_account_id
+  }
+  name = "mcintire.me"
+}
+
+# =============================================================================
+# mcintire.me - A records
+# =============================================================================
+
+resource "cloudflare_dns_record" "mcintire_me_a_mail" {
+  zone_id = cloudflare_zone.mcintire_me.id
+  type    = "A"
+  name    = "mail"
+  content = "107.174.178.20"
+  proxied = false
+  ttl     = 86400
+}
+
+resource "cloudflare_dns_record" "mcintire_me_a_photos" {
+  zone_id = cloudflare_zone.mcintire_me.id
+  type    = "A"
+  name    = "photos"
+  content = "204.110.191.8"
+  proxied = false
+  ttl     = 86400
+}
+
+resource "cloudflare_dns_record" "mcintire_me_a_git" {
+  zone_id = cloudflare_zone.mcintire_me.id
+  type    = "A"
+  name    = "git"
+  content = "172.245.56.83"
+  proxied = false
+  ttl     = 86400
+}
+
+resource "cloudflare_dns_record" "mcintire_me_a_vm1" {
+  zone_id = cloudflare_zone.mcintire_me.id
+  type    = "A"
+  name    = "vm1"
+  content = "172.245.56.83"
+  proxied = false
+  ttl     = 86400
+}
+
+# =============================================================================
+# mcintire.me - MX records
+# =============================================================================
+
+resource "cloudflare_dns_record" "mcintire_me_mx_root_primary" {
+  zone_id  = cloudflare_zone.mcintire_me.id
+  type     = "MX"
+  name     = "mcintire.me"
+  content  = "mail.mcintire.me"
+  priority = 10
+  ttl      = 86400
+}
+
+resource "cloudflare_dns_record" "mcintire_me_mx_root_backup" {
+  zone_id  = cloudflare_zone.mcintire_me.id
+  type     = "MX"
+  name     = "mcintire.me"
+  content  = "mail.nsnw.ca"
+  priority = 20
+  ttl      = 86400
+}
+
+# =============================================================================
+# mcintire.me - CNAME records
+# =============================================================================
+
+resource "cloudflare_dns_record" "mcintire_me_cname_ha" {
+  zone_id = cloudflare_zone.mcintire_me.id
+  type    = "CNAME"
+  name    = "ha"
+  content = "q1l09qiycnaagngmjsg1qas0rhqcfoou.ui.nabu.casa"
+  proxied = false
+  ttl     = 86400
+}
+
+resource "cloudflare_dns_record" "mcintire_me_cname_acme_ha" {
+  zone_id = cloudflare_zone.mcintire_me.id
+  type    = "CNAME"
+  name    = "_acme-challenge.ha"
+  content = "_acme-challenge.q1l09qiycnaagngmjsg1qas0rhqcfoou.ui.nabu.casa"
+  proxied = false
+  ttl     = 86400
+}
+
+resource "cloudflare_dns_record" "mcintire_me_cname_autodiscover" {
+  zone_id = cloudflare_zone.mcintire_me.id
+  type    = "CNAME"
+  name    = "autodiscover"
+  content = "mail.w5isp.com"
+  proxied = false
+  ttl     = 86400
+}
+
+resource "cloudflare_dns_record" "mcintire_me_cname_autoconfig" {
+  zone_id = cloudflare_zone.mcintire_me.id
+  type    = "CNAME"
+  name    = "autoconfig"
+  content = "mail.w5isp.com"
+  proxied = false
+  ttl     = 86400
+}
+
+resource "cloudflare_dns_record" "mcintire_me_cname_em977211" {
+  zone_id = cloudflare_zone.mcintire_me.id
+  type    = "CNAME"
+  name    = "em977211"
+  content = "return.smtp2go.net"
+  proxied = false
+  ttl     = 86400
+}
+
+resource "cloudflare_dns_record" "mcintire_me_cname_dkim_s977211" {
+  zone_id = cloudflare_zone.mcintire_me.id
+  type    = "CNAME"
+  name    = "s977211._domainkey"
+  content = "dkim.smtp2go.net"
+  proxied = false
+  ttl     = 86400
+}
+
+resource "cloudflare_dns_record" "mcintire_me_cname_link" {
+  zone_id = cloudflare_zone.mcintire_me.id
+  type    = "CNAME"
+  name    = "link"
+  content = "track.smtp2go.net"
+  proxied = false
+  ttl     = 86400
+}
+
+# =============================================================================
+# mcintire.me - SRV records
+# =============================================================================
+
+resource "cloudflare_dns_record" "mcintire_me_srv_autodiscover" {
+  zone_id = cloudflare_zone.mcintire_me.id
+  type    = "SRV"
+  name    = "_autodiscover._tcp"
+  ttl     = 86400
+
+  data = {
+    priority = 0
+    weight   = 0
+    port     = 443
+    target   = "mail.w5isp.com"
+  }
+
+  lifecycle {
+    ignore_changes = [priority]
+  }
+}
+
+# =============================================================================
+# mcintire.me - TXT records
+# =============================================================================
+
+resource "cloudflare_dns_record" "mcintire_me_txt_spf" {
+  zone_id = cloudflare_zone.mcintire_me.id
+  type    = "TXT"
+  name    = "mcintire.me"
+  content = "v=spf1 mx a ip4:107.174.178.20 ~all"
+  ttl     = 86400
+}
+
+resource "cloudflare_dns_record" "mcintire_me_txt_dmarc" {
+  zone_id = cloudflare_zone.mcintire_me.id
+  type    = "TXT"
+  name    = "_dmarc"
+  content = "v=DMARC1; p=quarantine; rua=mailto:postmaster@mcintire.me; ruf=mailto:postmaster@mcintire.me; fo=1"
+  ttl     = 86400
+}
+
+resource "cloudflare_dns_record" "mcintire_me_txt_dkim" {
+  zone_id = cloudflare_zone.mcintire_me.id
+  type    = "TXT"
+  name    = "dkim._domainkey"
+  content = "v=DKIM1;k=rsa;t=s;s=email;p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA0rQie7Hz5AmDbVUX+rKNgp6Hf7crtWyfy6qKbqnrxmmernz1rQ6HyOrHhFAlc8nVLNKr8XP2DOROb1jAnrjndZo9I/ymbrrrCBsi9w6zAht2BheijO/R9k5CDRjeSafm6bg0oMKihtNMIdXvEj9ND8hDpZZKxtOrKFH7zLm4CPmm7jf0gqZH2yK+AA3OYUGSYa1OT0LtdMXadk0IVOI2VYf37Hzb3RUvGOYMVkT0xi+23DiyFk7AyCiyv3LQVBMT+/bwyd4k3yVVn2cr9+Nor+HXVjqASLtqcFLMf1SuX0ezSAjBG7BbqQr5G6Jz+n5YglqEIUKVYzJFE7JdDmqQYQIDAQAB"
+  ttl     = 86400
+}
+
+resource "cloudflare_dns_record" "mcintire_me_txt_yahoo_verification" {
+  zone_id = cloudflare_zone.mcintire_me.id
+  type    = "TXT"
+  name    = "mcintire.me"
+  content = "yahoo-verification-key=Pt59XUhQSd7dbVc0x6TQD+mBEtOOTMHFRV1ZG78h4Ug="
+  ttl     = 86400
+}
+
+# =============================================================================
+# mcintire.me - Zone settings
+# =============================================================================
+
+resource "cloudflare_zone_setting" "mcintire_me_min_tls_version" {
+  zone_id    = cloudflare_zone.mcintire_me.id
+  setting_id = "min_tls_version"
+  value      = "1.2"
+}
+
+resource "cloudflare_zone_setting" "mcintire_me_always_use_https" {
+  zone_id    = cloudflare_zone.mcintire_me.id
+  setting_id = "always_use_https"
+  value      = "on"
+}
+
+resource "cloudflare_zone_setting" "mcintire_me_tls_1_3" {
+  zone_id    = cloudflare_zone.mcintire_me.id
+  setting_id = "tls_1_3"
+  value      = "zrt"
+}
+
+resource "cloudflare_zone_setting" "mcintire_me_zero_rtt" {
+  zone_id    = cloudflare_zone.mcintire_me.id
+  setting_id = "0rtt"
+  value      = "on"
+}
+
+resource "cloudflare_zone_setting" "mcintire_me_ssl" {
+  zone_id    = cloudflare_zone.mcintire_me.id
+  setting_id = "ssl"
+  value      = "full"
+}
+
+resource "cloudflare_zone_setting" "mcintire_me_security_header" {
+  zone_id    = cloudflare_zone.mcintire_me.id
+  setting_id = "security_header"
+  value = {
+    strict_transport_security = {
+      enabled            = true
+      max_age            = 15552000
+      include_subdomains = true
+      preload            = true
+      nosniff            = true
+    }
+  }
+}
+
+# =============================================================================
+# mcintire.me - Bot management
+# =============================================================================
+
+resource "cloudflare_bot_management" "mcintire_me" {
+  zone_id               = cloudflare_zone.mcintire_me.id
+  is_robots_txt_managed = false
+}
+
+# =============================================================================
+# mcintire.me - Firewall
+# =============================================================================
+
+resource "cloudflare_ruleset" "mcintire_me_firewall" {
+  zone_id = cloudflare_zone.mcintire_me.id
+  name    = "default"
+  kind    = "zone"
+  phase   = "http_request_firewall_custom"
+
+  rules = [{
+    action      = "block"
+    expression  = local.firewall_expression
+    description = "block abusers"
+    enabled     = true
+  }]
+}

tofu/dns.tf

@@ -29,7 +29,7 @@ locals {
     "gridmap.org"       = local.cloudflare_ns
     "gunincrements.com" = local.porkbun_ns
     "manero.org"        = local.porkbun_ns
-    "mcintire.me"       = local.as393837_ns
+    "mcintire.me"       = local.cloudflare_ns
     "ntxarms.com"       = local.as393837_ns
     "qth.social"        = local.porkbun_ns
     # towerops.net is not opted in to Porkbun API access