locals {
  cloudflare_account_id = "4d18148a82b0a91f289afbbd2944a603"

  cloudflare_zones = {
    "aprs.me"      = "09da59049b0ecad7b734ce3d902bf581"
    "gridmap.org"  = "836f24d97eb51ffc18aa10c0a98efa48"
    "towerops.net" = "c275d35a8885de79ca8e61c17ac97ab6"
  }

  cloudflare_records = {
    # =========================================================================
    # towerops.net - A records
    # =========================================================================
    "towerops.net-a-dfw-poller" = {
      zone_key  = "towerops.net"
      type      = "A"
      name      = "dfw.poller"
      content   = "144.202.64.79"
      proxied   = false
      record_id = "aa8183b748f1bf0e3850d9dabb91ee3a"
    }
    "towerops.net-a-lon-poller" = {
      zone_key  = "towerops.net"
      type      = "A"
      name      = "lon.poller"
      content   = "45.77.228.168"
      proxied   = false
      record_id = "2a25c3ee47284833cea451170d3bd61d"
    }
    "towerops.net-a-staging" = {
      zone_key  = "towerops.net"
      type      = "A"
      name      = "staging"
      content   = "204.110.191.231"
      proxied   = true
      record_id = "8430e2789d5700c556dc7a598d49d8fd"
    }
    "towerops.net-a-www" = {
      zone_key  = "towerops.net"
      type      = "A"
      name      = "www"
      content   = "192.0.2.1"
      proxied   = true
      comment   = "Created during Cloudflare Rules deployment process for Redirect from WWW to root [Template]"
      record_id = "689c47b0e5ed68427f2c3b9e25bdf602"
    }

    # =========================================================================
    # towerops.net - AAAA records
    # =========================================================================
    "towerops.net-aaaa-dfw-poller" = {
      zone_key  = "towerops.net"
      type      = "AAAA"
      name      = "dfw.poller"
      content   = "2001:19f0:6401:af2:5400:5ff:fee7:1bfb"
      proxied   = false
      record_id = "2edc0cf203313e67d64316daf8a0490e"
    }
    "towerops.net-aaaa-lon-poller" = {
      zone_key  = "towerops.net"
      type      = "AAAA"
      name      = "lon.poller"
      content   = "2001:19f0:7400:1195:5400:5ff:feee:a0c3"
      proxied   = false
      record_id = "610f21b8597a1ce6ad4020f15311787a"
    }

    # =========================================================================
    # towerops.net - CNAME records
    # =========================================================================
    "towerops.net-cname-root" = {
      zone_key  = "towerops.net"
      type      = "CNAME"
      name      = "towerops.net"
      content   = "d3d819ba-925c-4d84-8052-68ed32b686bb.cfargotunnel.com"
      proxied   = true
      record_id = "cf1bc4e745466032786db854f4294f99"
    }
    "towerops.net-cname-dev" = {
      zone_key  = "towerops.net"
      type      = "CNAME"
      name      = "dev"
      content   = "db59aa44-79de-4522-9593-43e828f3215a.cfargotunnel.com"
      proxied   = true
      record_id = "21b470e19493c856ce697052dabc90e5"
    }
    "towerops.net-cname-autoconfig" = {
      zone_key  = "towerops.net"
      type      = "CNAME"
      name      = "autoconfig"
      content   = "mail.mcintire.me"
      proxied   = false
      record_id = "1c0f59e7bd583f8971f50231e6fad3cf"
    }
    "towerops.net-cname-autodiscover" = {
      zone_key  = "towerops.net"
      type      = "CNAME"
      name      = "autodiscover"
      content   = "mail.mcintire.me"
      proxied   = false
      record_id = "34a4a9bde8cf4626635cfa3cb5f8c408"
    }
    "towerops.net-cname-dkim-ses-1" = {
      zone_key  = "towerops.net"
      type      = "CNAME"
      name      = "2skkb53ep3vfbkdstfmm2elfthurggid._domainkey"
      content   = "2skkb53ep3vfbkdstfmm2elfthurggid.dkim.amazonses.com"
      proxied   = false
      record_id = "f4a446531128011a1a6b896010983901"
    }
    "towerops.net-cname-dkim-ses-2" = {
      zone_key  = "towerops.net"
      type      = "CNAME"
      name      = "4uwsaywjpmk35j36pfiz4vr37dyy4v7z._domainkey"
      content   = "4uwsaywjpmk35j36pfiz4vr37dyy4v7z.dkim.amazonses.com"
      proxied   = false
      record_id = "aefc5c72e25e3656dbccf0fdf2fc6f48"
    }
    "towerops.net-cname-dkim-ses-3" = {
      zone_key  = "towerops.net"
      type      = "CNAME"
      name      = "l7lbifvot6nv3wwho5rs35xzqzzinz5f._domainkey"
      content   = "l7lbifvot6nv3wwho5rs35xzqzzinz5f.dkim.amazonses.com"
      proxied   = false
      record_id = "02a4cfa316dae29898a8270f2c3aceda"
    }

    # =========================================================================
    # towerops.net - MX records
    # =========================================================================
    "towerops.net-mx-root-primary" = {
      zone_key  = "towerops.net"
      type      = "MX"
      name      = "towerops.net"
      content   = "mail.mcintire.me"
      priority  = 10
      record_id = "a5dc7d6dc6d9085132a8fa0b7db1b69a"
    }
    "towerops.net-mx-root-backup" = {
      zone_key  = "towerops.net"
      type      = "MX"
      name      = "towerops.net"
      content   = "mail.nsnw.ca"
      priority  = 20
      record_id = "bbd552d191e61345f19f8dae10281f9e"
    }
    "towerops.net-mx-mail" = {
      zone_key  = "towerops.net"
      type      = "MX"
      name      = "mail"
      content   = "feedback-smtp.us-east-1.amazonses.com"
      priority  = 10
      record_id = "a2486e2bbb4d6aca978d28807893e346"
    }

    # =========================================================================
    # towerops.net - TXT records
    # =========================================================================
    "towerops.net-txt-spf" = {
      zone_key  = "towerops.net"
      type      = "TXT"
      name      = "towerops.net"
      content   = "v=spf1 mx a ip4:107.174.178.20 ~all"
      record_id = "cf2f74d345960700a81a6025e7a89642"
    }
    "towerops.net-txt-dmarc" = {
      zone_key  = "towerops.net"
      type      = "TXT"
      name      = "_dmarc"
      content   = "v=DMARC1; p=none;"
      record_id = "bd236f9a89fc42f45fd7f4b076478880"
    }
    "towerops.net-txt-dkim" = {
      zone_key  = "towerops.net"
      type      = "TXT"
      name      = "dkim._domainkey"
      content   = "v=DKIM1;k=rsa;t=s;s=email;p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAuFm6nd0L7/nAO4m0MPxdjwRAup5C90DPSPa0TQBDT8S2WvASyQUPV8xSbICGMj6FjZYNd5ph/0VK47gDulxQgNQT96IVf2ooTfkvY/80bAyEdtJbpjEUzQnX5YBi/pJigQx2EeCdaojUZumeIdlFlzeb8QQIEtQhVnyc1Xc/Z8ljPMW1H9DXLSDINjV6UTaXX+PZ7jgpRKgU+RnJNcqTAkhhKQ4bMcRfOam/lF6wPOWte1A7ir08TdE8O67ioqygkr/ivAp7xvV4vGOkY6buLLE+c3exY+my2qTCZgJyUMAhkZzYqzGo1csfHH8x+O2XN/k8Z5jPhq8LSvl9XkllKwIDAQAB"
      record_id = "3872e537e8cee4087ead7eb5785e1426"
    }
    "towerops.net-txt-mail-spf" = {
      zone_key  = "towerops.net"
      type      = "TXT"
      name      = "mail"
      content   = "v=spf1 include:amazonses.com ~all"
      record_id = "76b8314432391c6630e9e1b2edfce65d"
    }
  }
}

# =============================================================================
# Zones
# =============================================================================

import {
  for_each = local.cloudflare_zones
  to       = cloudflare_zone.zones[each.key]
  id       = each.value
}

resource "cloudflare_zone" "zones" {
  for_each = local.cloudflare_zones

  account = {
    id = local.cloudflare_account_id
  }
  name = each.key
}

# =============================================================================
# DNS Records (A, AAAA, CNAME, MX, TXT)
# =============================================================================

import {
  for_each = local.cloudflare_records
  to       = cloudflare_dns_record.records[each.key]
  id       = "${local.cloudflare_zones[each.value.zone_key]}/${each.value.record_id}"
}

resource "cloudflare_dns_record" "records" {
  for_each = local.cloudflare_records

  zone_id  = cloudflare_zone.zones[each.value.zone_key].id
  type     = each.value.type
  name     = each.value.name
  content  = each.value.content
  proxied  = lookup(each.value, "proxied", false)
  ttl      = lookup(each.value, "ttl", lookup(each.value, "proxied", false) ? 1 : 86400)
  priority = lookup(each.value, "priority", null)
  comment  = lookup(each.value, "comment", null)
}

# =============================================================================
# DNS Records - aprs.me tunnel CNAME
# =============================================================================

resource "cloudflare_dns_record" "aprs_me_tunnel" {
  zone_id = cloudflare_zone.zones["aprs.me"].id
  type    = "CNAME"
  name    = "aprs.me"
  content = "d3d819ba-925c-4d84-8052-68ed32b686bb.cfargotunnel.com"
  proxied = true
  ttl     = 1
}

# aprs.me - Resend email (DKIM, SPF, DMARC, MX)
resource "cloudflare_dns_record" "aprs_me_dkim_resend" {
  zone_id = cloudflare_zone.zones["aprs.me"].id
  type    = "TXT"
  name    = "resend._domainkey"
  content = "p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCrIhTzL7qrNSdbVOWG2WVwXpKrRrkHY4w/giB7JGl9Hj23z1qIQNh8aNyvDaC0Eosf1013TSWvS+bFMETc5kQZ6lQDq6pvZxHeKbAGH1FvUDVQ2uhjV77Qopf95SdoDKsod3hRnfn4kNZBQ2GfrbJmqobIsQRT8IHFA3XOjOn/jwIDAQAB"
  ttl     = 86400
}

resource "cloudflare_dns_record" "aprs_me_mx_send" {
  zone_id  = cloudflare_zone.zones["aprs.me"].id
  type     = "MX"
  name     = "send"
  content  = "feedback-smtp.us-east-1.amazonses.com"
  priority = 10
  ttl      = 86400
}

resource "cloudflare_dns_record" "aprs_me_spf_send" {
  zone_id = cloudflare_zone.zones["aprs.me"].id
  type    = "TXT"
  name    = "send"
  content = "v=spf1 include:amazonses.com ~all"
  ttl     = 86400
}

resource "cloudflare_dns_record" "aprs_me_dmarc" {
  zone_id = cloudflare_zone.zones["aprs.me"].id
  type    = "TXT"
  name    = "_dmarc"
  content = "v=DMARC1; p=none;"
  ttl     = 86400
}

resource "cloudflare_dns_record" "aprs_me_txt_yahoo_verification" {
  zone_id = cloudflare_zone.zones["aprs.me"].id
  type    = "TXT"
  name    = "aprs.me"
  content = "yahoo-verification-key=FTNt+pQ6IU4l0gQZKNUu3jbVXAgUG/yzm4KVwDzahbE="
  ttl     = 86400
}

resource "cloudflare_dns_record" "towerops_txt_yahoo_verification" {
  zone_id = cloudflare_zone.zones["towerops.net"].id
  type    = "TXT"
  name    = "towerops.net"
  content = "yahoo-verification-key=BWUc1N9CUklaviQyfIGHDwF35WGx3Dcvrag/JCZzyKM="
  ttl     = 86400
}

resource "cloudflare_dns_record" "gridmap_org_tunnel" {
  zone_id = cloudflare_zone.zones["gridmap.org"].id
  type    = "CNAME"
  name    = "gridmap.org"
  content = "d3d819ba-925c-4d84-8052-68ed32b686bb.cfargotunnel.com"
  proxied = true
  ttl     = 1
}

# =============================================================================
# DNS Records (CAA) - restrict certificate issuance to Cloudflare CAs
# =============================================================================

locals {
  cloudflare_cas = ["letsencrypt.org", "pki.goog", "ssl.com", "sectigo.com"]
  caa_zones      = ["aprs.me", "gridmap.org"]
  caa_records = merge([
    for zone in local.caa_zones : {
      for ca in local.cloudflare_cas : "${zone}-${ca}" => {
        zone = zone
        ca   = ca
      }
    }
  ]...)
}

resource "cloudflare_dns_record" "caa" {
  for_each = local.caa_records

  zone_id = cloudflare_zone.zones[each.value.zone].id
  type    = "CAA"
  name    = each.value.zone
  ttl     = 86400

  data = {
    flags = 0
    tag   = "issue"
    value = each.value.ca
  }
}

# =============================================================================
# DNS Records (SRV) - separate due to data block
# =============================================================================

import {
  to = cloudflare_dns_record.towerops_srv_autodiscover
  id = "${local.cloudflare_zones["towerops.net"]}/26db78978535d1d630432970b9a4e279"
}

resource "cloudflare_dns_record" "towerops_srv_autodiscover" {
  zone_id = cloudflare_zone.zones["towerops.net"].id
  type    = "SRV"
  name    = "_autodiscover._tcp"
  ttl     = 86400

  data = {
    priority = 0
    weight   = 0
    port     = 443
    target   = "mail.mcintire.me"
  }

  lifecycle {
    ignore_changes = [priority]
  }
}

# =============================================================================
# Zone Settings
#
# Zone security settings: TLS hardening and HSTS
# =============================================================================

# aprs.me
resource "cloudflare_zone_setting" "aprs_me_min_tls_version" {
  zone_id    = cloudflare_zone.zones["aprs.me"].id
  setting_id = "min_tls_version"
  value      = "1.2"
}

resource "cloudflare_zone_setting" "aprs_me_always_use_https" {
  zone_id    = cloudflare_zone.zones["aprs.me"].id
  setting_id = "always_use_https"
  value      = "on"
}

resource "cloudflare_zone_setting" "aprs_me_tls_1_3" {
  zone_id    = cloudflare_zone.zones["aprs.me"].id
  setting_id = "tls_1_3"
  value      = "zrt"
}

resource "cloudflare_zone_setting" "aprs_me_zero_rtt" {
  zone_id    = cloudflare_zone.zones["aprs.me"].id
  setting_id = "0rtt"
  value      = "on"
}

resource "cloudflare_zone_setting" "aprs_me_ssl" {
  zone_id    = cloudflare_zone.zones["aprs.me"].id
  setting_id = "ssl"
  value      = "strict"
}

resource "cloudflare_zone_setting" "aprs_me_security_header" {
  zone_id    = cloudflare_zone.zones["aprs.me"].id
  setting_id = "security_header"
  value = {
    strict_transport_security = {
      enabled            = true
      max_age            = 15552000
      include_subdomains = true
      preload            = true
      nosniff            = true
    }
  }
}

# towerops.net
resource "cloudflare_zone_setting" "towerops_net_min_tls_version" {
  zone_id    = cloudflare_zone.zones["towerops.net"].id
  setting_id = "min_tls_version"
  value      = "1.2"
}

resource "cloudflare_zone_setting" "towerops_net_always_use_https" {
  zone_id    = cloudflare_zone.zones["towerops.net"].id
  setting_id = "always_use_https"
  value      = "on"
}

resource "cloudflare_zone_setting" "towerops_net_tls_1_3" {
  zone_id    = cloudflare_zone.zones["towerops.net"].id
  setting_id = "tls_1_3"
  value      = "zrt"
}

resource "cloudflare_zone_setting" "towerops_net_zero_rtt" {
  zone_id    = cloudflare_zone.zones["towerops.net"].id
  setting_id = "0rtt"
  value      = "on"
}

resource "cloudflare_zone_setting" "towerops_net_ssl" {
  zone_id    = cloudflare_zone.zones["towerops.net"].id
  setting_id = "ssl"
  value      = "full"
}

resource "cloudflare_zone_setting" "towerops_net_security_header" {
  zone_id    = cloudflare_zone.zones["towerops.net"].id
  setting_id = "security_header"
  value = {
    strict_transport_security = {
      enabled            = true
      max_age            = 15552000
      include_subdomains = true
      preload            = true
      nosniff            = true
    }
  }
}

# gridmap.org
resource "cloudflare_zone_setting" "gridmap_org_min_tls_version" {
  zone_id    = cloudflare_zone.zones["gridmap.org"].id
  setting_id = "min_tls_version"
  value      = "1.2"
}

resource "cloudflare_zone_setting" "gridmap_org_always_use_https" {
  zone_id    = cloudflare_zone.zones["gridmap.org"].id
  setting_id = "always_use_https"
  value      = "on"
}

resource "cloudflare_zone_setting" "gridmap_org_tls_1_3" {
  zone_id    = cloudflare_zone.zones["gridmap.org"].id
  setting_id = "tls_1_3"
  value      = "zrt"
}

resource "cloudflare_zone_setting" "gridmap_org_zero_rtt" {
  zone_id    = cloudflare_zone.zones["gridmap.org"].id
  setting_id = "0rtt"
  value      = "on"
}

resource "cloudflare_zone_setting" "gridmap_org_ssl" {
  zone_id    = cloudflare_zone.zones["gridmap.org"].id
  setting_id = "ssl"
  value      = "strict"
}

resource "cloudflare_zone_setting" "gridmap_org_security_header" {
  zone_id    = cloudflare_zone.zones["gridmap.org"].id
  setting_id = "security_header"
  value = {
    strict_transport_security = {
      enabled            = true
      max_age            = 15552000
      include_subdomains = true
      preload            = true
      nosniff            = true
    }
  }
}

# =============================================================================
# Bot Management - disable Cloudflare managed robots.txt
#
# Each app repo ships its own robots.txt. Turning off the managed robots.txt
# feature ("Instruct AI bot traffic with robots.txt") stops Cloudflare from
# prepending/serving its own robots.txt at the zone edge, so the origin's file
# is returned unchanged. All other bot_management fields are Optional+Computed,
# so omitting them preserves their current values (e.g. Super Bot Fight Mode).
#
# NOTE: requires CLOUDFLARE_API_TOKEN to include the "Bot Management Write"
# permission for these zones; the DNS-scoped token cannot apply this.
# =============================================================================

resource "cloudflare_bot_management" "zones" {
  for_each = { for k, v in cloudflare_zone.zones : k => v.id }

  zone_id               = each.value
  is_robots_txt_managed = false
}

resource "cloudflare_bot_management" "w5isp_com" {
  zone_id               = cloudflare_zone.w5isp_com.id
  is_robots_txt_managed = false
}

# =============================================================================
# Firewall - custom rules (applied to all zones)
# =============================================================================

locals {
  firewall_expression = join(" or ", [
    "(ip.src.country in {\"KP\" \"RU\" \"CN\" \"SY\" \"MM\" \"VE\" \"IQ\" \"LY\" \"SO\" \"YE\" \"SS\"})",
    "(http.request.uri.path contains \".php\")",
    "(http.request.uri.path contains \"/wp-content\")",
    "(http.request.uri.path contains \"/wp-login\")",
    "(http.request.uri.path contains \"/wp-admin\")",
    "(http.request.uri.path contains \"/wp-includes\")",
    "(http.request.uri.path contains \"/xmlrpc.php\")",
    "(http.request.uri.path contains \"wlwmanifest.xml\")",
    "(http.request.uri.path contains \"/.env\")",
    "(http.request.uri.path contains \"/.git\")",
    "(http.request.uri.path contains \"/phpmyadmin\")",
    "(http.request.uri.path contains \"/cgi-bin\")",
    "(not http.user_agent ne \"\")",
  ])
}

# =============================================================================
# towerops.net - Response Header Transform
#
# Sets the Content-Security-Policy explicitly at the Cloudflare layer so it
# cannot be silently overridden by managed rulesets or other Cloudflare features.
# =============================================================================

locals {
  towerops_csp = join("; ", [
    "default-src 'self' data:",
    "script-src 'self' 'unsafe-inline' https://a.w5isp.com",
    "style-src 'self' 'unsafe-inline' 'unsafe-hashes'",
    "img-src 'self' data: https:",
    "font-src 'self' data:",
    "connect-src 'self' ws: wss: https://a.w5isp.com",
    "frame-ancestors 'none'",
  ])
}

resource "cloudflare_ruleset" "towerops_response_headers" {
  zone_id = cloudflare_zone.zones["towerops.net"].id
  name    = "default"
  kind    = "zone"
  phase   = "http_response_headers_transform"

  rules = [{
    action = "rewrite"
    action_parameters = {
      headers = {
        "Content-Security-Policy" = {
          operation = "set"
          value     = local.towerops_csp
        }
      }
    }
    expression  = "true"
    description = "set CSP for towerops.net"
    enabled     = true
  }]
}
import {
  to = cloudflare_ruleset.towerops_firewall
  id = "zone/${local.cloudflare_zones["towerops.net"]}/3c209e50f21b40388733a7cfe8f62f4e"
}

resource "cloudflare_ruleset" "towerops_firewall" {
  zone_id = cloudflare_zone.zones["towerops.net"].id
  name    = "default"
  kind    = "zone"
  phase   = "http_request_firewall_custom"

  # Allow agent WebSocket connections (must come before block rules)
  rules = [{
    action = "skip"
    action_parameters = {
      ruleset = "current"
    }
    expression  = "(http.request.uri.path eq \"/socket/agent/websocket\")"
    description = "allow agent websocket connections"
    enabled     = true
    logging = {
      enabled = false
    }
    },

    {
      action      = "block"
      expression  = local.firewall_expression
      description = "block abusers"
      enabled     = true
  }]
}
import {
  to = cloudflare_ruleset.gridmap_firewall
  id = "zone/${local.cloudflare_zones["gridmap.org"]}/7dfc79c24a22439ea501865479822df8"
}

resource "cloudflare_ruleset" "gridmap_firewall" {
  zone_id = cloudflare_zone.zones["gridmap.org"].id
  name    = "default"
  kind    = "zone"
  phase   = "http_request_firewall_custom"

  rules = [{
    action      = "block"
    expression  = local.firewall_expression
    description = "block abusers"
    enabled     = true
  }]
}
resource "cloudflare_ruleset" "aprs_me_firewall" {
  zone_id = cloudflare_zone.zones["aprs.me"].id
  name    = "default"
  kind    = "zone"
  phase   = "http_request_firewall_custom"

  rules = [{
    action      = "block"
    expression  = local.firewall_expression
    description = "block abusers"
    enabled     = true
  }]
}
# =============================================================================
# Tunnel Configs
#
# Tunnel resources themselves are not managed here because the tunnel secrets
# are not recoverable from the API. The tunnels were created via the dashboard:
#   - towerops:     d3d819ba-925c-4d84-8052-68ed32b686bb (healthy)
#   - towerops-dev: db59aa44-79de-4522-9593-43e828f3215a (down)
#   - birdnet:      bd9fe980-86d1-4b62-8a35-65ed529696f1 (created via API,
#                   config_src=cloudflare; cloudflared runs on host birdnet
#                   at 10.0.17.29 as a systemd token service)
# =============================================================================

# birdnet tunnel ingress: bird.w5isp.com -> BirdNET Caddy UI on the host
resource "cloudflare_zero_trust_tunnel_cloudflared_config" "birdnet" {
  account_id = local.cloudflare_account_id
  tunnel_id  = "bd9fe980-86d1-4b62-8a35-65ed529696f1"

  config = {
    ingress = [
      {
        hostname = "bird.w5isp.com"
        service  = "http://localhost:80"
      },
      {
        service = "http_status:404"
      },
    ]
  }
}

import {
  to = cloudflare_zero_trust_tunnel_cloudflared_config.towerops
  id = "${local.cloudflare_account_id}/d3d819ba-925c-4d84-8052-68ed32b686bb"
}

resource "cloudflare_zero_trust_tunnel_cloudflared_config" "towerops" {
  account_id = local.cloudflare_account_id
  tunnel_id  = "d3d819ba-925c-4d84-8052-68ed32b686bb"

  config = {
    ingress = [
      {
        hostname = "aprs.me"
        service  = "http://aprs.aprs.svc.cluster.local:4000"
      },
      {
        hostname = "gridmap.org"
        service  = "http://gridmap.gridmap.svc.cluster.local:4000"
      },
      {
        hostname = "towerops.net"
        service  = "http://towerops.towerops.svc.cluster.local:4000"
      },
      {
        hostname = "prop.w5isp.com"
        service  = "http://prop.prop.svc.cluster.local:5000"
      },
      {
        hostname = "argo.w5isp.com"
        service  = "http://argocd-server.argocd.svc.cluster.local:80"
      },
      {
        service = "http_status:404"
      },
    ]
  }
}

import {
  to = cloudflare_zero_trust_tunnel_cloudflared_config.towerops_dev
  id = "${local.cloudflare_account_id}/db59aa44-79de-4522-9593-43e828f3215a"
}

# =============================================================================
# w5isp.com Zone
# =============================================================================

resource "cloudflare_zone" "w5isp_com" {
  account = {
    id = local.cloudflare_account_id
  }
  name = "w5isp.com"
}

# =============================================================================
# w5isp.com - A records
# =============================================================================

resource "cloudflare_dns_record" "w5isp_a_root" {
  zone_id = cloudflare_zone.w5isp_com.id
  type    = "A"
  name    = "w5isp.com"
  content = "204.110.191.8"
  proxied = false
  ttl     = 86400
}

resource "cloudflare_dns_record" "w5isp_a_home" {
  zone_id = cloudflare_zone.w5isp_com.id
  type    = "A"
  name    = "home"
  content = "204.110.191.1"
  proxied = false
  ttl     = 86400
}

resource "cloudflare_dns_record" "w5isp_a_photos" {
  zone_id = cloudflare_zone.w5isp_com.id
  type    = "A"
  name    = "photos"
  content = "204.110.191.8"
  proxied = false
  ttl     = 86400
}

resource "cloudflare_dns_record" "w5isp_a_skippy" {
  zone_id = cloudflare_zone.w5isp_com.id
  type    = "A"
  name    = "skippy"
  content = "204.110.191.8"
  proxied = false
  ttl     = 86400
}

resource "cloudflare_dns_record" "w5isp_a_mail" {
  zone_id = cloudflare_zone.w5isp_com.id
  type    = "A"
  name    = "mail"
  content = "107.174.178.20"
  proxied = false
  ttl     = 86400
}

resource "cloudflare_dns_record" "w5isp_a_dokku" {
  zone_id = cloudflare_zone.w5isp_com.id
  type    = "A"
  name    = "dokku"
  content = "204.110.191.218"
  proxied = false
  ttl     = 86400
}

resource "cloudflare_dns_record" "w5isp_a_feedback" {
  zone_id = cloudflare_zone.w5isp_com.id
  type    = "A"
  name    = "feedback"
  content = "204.110.191.8"
  proxied = false
  ttl     = 86400
}

resource "cloudflare_dns_record" "w5isp_a_vm1" {
  zone_id = cloudflare_zone.w5isp_com.id
  type    = "A"
  name    = "vm1"
  content = "172.245.56.83"
  proxied = false
  ttl     = 86400
}

resource "cloudflare_dns_record" "w5isp_a_log" {
  zone_id = cloudflare_zone.w5isp_com.id
  type    = "A"
  name    = "log"
  content = "204.110.191.8"
  proxied = false
  ttl     = 86400
}

resource "cloudflare_dns_record" "w5isp_a_vaprs" {
  zone_id = cloudflare_zone.w5isp_com.id
  type    = "A"
  name    = "vaprs"
  content = "204.110.191.8"
  proxied = false
  ttl     = 86400
}

resource "cloudflare_dns_record" "w5isp_a_srtm" {
  zone_id = cloudflare_zone.w5isp_com.id
  type    = "A"
  name    = "srtm"
  content = "204.110.191.8"
  proxied = false
  ttl     = 86400
}

resource "cloudflare_dns_record" "w5isp_a_aprs" {
  zone_id = cloudflare_zone.w5isp_com.id
  type    = "A"
  name    = "aprs"
  content = "204.110.191.232"
  proxied = false
  ttl     = 86400
}

resource "cloudflare_dns_record" "w5isp_a_a" {
  zone_id = cloudflare_zone.w5isp_com.id
  type    = "A"
  name    = "a"
  content = "204.110.191.223"
  proxied = false
  ttl     = 86400
}

resource "cloudflare_dns_record" "w5isp_cname_prop" {
  zone_id = cloudflare_zone.w5isp_com.id
  type    = "CNAME"
  name    = "prop"
  content = "d3d819ba-925c-4d84-8052-68ed32b686bb.cfargotunnel.com"
  proxied = true
  ttl     = 1
}

resource "cloudflare_dns_record" "w5isp_cname_argo" {
  zone_id = cloudflare_zone.w5isp_com.id
  type    = "CNAME"
  name    = "argo"
  content = "d3d819ba-925c-4d84-8052-68ed32b686bb.cfargotunnel.com"
  proxied = true
  ttl     = 1
}

# birdnet host (10.0.17.29) - BirdNET web UI via its own cloudflared tunnel
resource "cloudflare_dns_record" "w5isp_cname_bird" {
  zone_id = cloudflare_zone.w5isp_com.id
  type    = "CNAME"
  name    = "bird"
  content = "bd9fe980-86d1-4b62-8a35-65ed529696f1.cfargotunnel.com"
  proxied = true
  ttl     = 1
}

# =============================================================================
# w5isp.com - MX records
# =============================================================================

resource "cloudflare_dns_record" "w5isp_mx_root" {
  zone_id  = cloudflare_zone.w5isp_com.id
  type     = "MX"
  name     = "w5isp.com"
  content  = "mail.w5isp.com"
  priority = 10
  ttl      = 86400
}

# =============================================================================
# w5isp.com - CNAME records
# =============================================================================

resource "cloudflare_dns_record" "w5isp_cname_autodiscover" {
  zone_id = cloudflare_zone.w5isp_com.id
  type    = "CNAME"
  name    = "autodiscover"
  content = "mail.w5isp.com"
  proxied = false
  ttl     = 86400
}

resource "cloudflare_dns_record" "w5isp_cname_autoconfig" {
  zone_id = cloudflare_zone.w5isp_com.id
  type    = "CNAME"
  name    = "autoconfig"
  content = "mail.w5isp.com"
  proxied = false
  ttl     = 86400
}

resource "cloudflare_dns_record" "w5isp_cname_em40" {
  zone_id = cloudflare_zone.w5isp_com.id
  type    = "CNAME"
  name    = "em40"
  content = "u177982.wl233.sendgrid.net"
  proxied = false
  ttl     = 86400
}

resource "cloudflare_dns_record" "w5isp_cname_dkim_s1" {
  zone_id = cloudflare_zone.w5isp_com.id
  type    = "CNAME"
  name    = "s1._domainkey"
  content = "s1.domainkey.u177982.wl233.sendgrid.net"
  proxied = false
  ttl     = 86400
}

resource "cloudflare_dns_record" "w5isp_cname_dkim_s2" {
  zone_id = cloudflare_zone.w5isp_com.id
  type    = "CNAME"
  name    = "s2._domainkey"
  content = "s2.domainkey.u177982.wl233.sendgrid.net"
  proxied = false
  ttl     = 86400
}

resource "cloudflare_dns_record" "w5isp_cname_uptime" {
  zone_id = cloudflare_zone.w5isp_com.id
  type    = "CNAME"
  name    = "uptime"
  content = "stats.uptimerobot.com"
  proxied = false
  ttl     = 86400
}

resource "cloudflare_dns_record" "w5isp_cname_em977211" {
  zone_id = cloudflare_zone.w5isp_com.id
  type    = "CNAME"
  name    = "em977211"
  content = "return.smtp2go.net"
  proxied = false
  ttl     = 86400
}

resource "cloudflare_dns_record" "w5isp_cname_dkim_s977211" {
  zone_id = cloudflare_zone.w5isp_com.id
  type    = "CNAME"
  name    = "s977211._domainkey"
  content = "dkim.smtp2go.net"
  proxied = false
  ttl     = 86400
}

resource "cloudflare_dns_record" "w5isp_cname_link" {
  zone_id = cloudflare_zone.w5isp_com.id
  type    = "CNAME"
  name    = "link"
  content = "track.smtp2go.net"
  proxied = false
  ttl     = 86400
}

resource "cloudflare_dns_record" "w5isp_cname_ha" {
  zone_id = cloudflare_zone.w5isp_com.id
  type    = "CNAME"
  name    = "ha"
  content = "q1l09qiycnaagngmjsg1qas0rhqcfoou.ui.nabu.casa"
  proxied = false
  ttl     = 86400
}

resource "cloudflare_dns_record" "w5isp_cname_acme_ha" {
  zone_id = cloudflare_zone.w5isp_com.id
  type    = "CNAME"
  name    = "_acme-challenge.ha"
  content = "_acme-challenge.q1l09qiycnaagngmjsg1qas0rhqcfoou.ui.nabu.casa"
  proxied = false
  ttl     = 86400
}

# =============================================================================
# w5isp.com - TXT records
# =============================================================================

resource "cloudflare_dns_record" "w5isp_txt_spf" {
  zone_id = cloudflare_zone.w5isp_com.id
  type    = "TXT"
  name    = "w5isp.com"
  content = "v=spf1 mx a ip4:107.174.178.20 ~all"
  ttl     = 86400
}

resource "cloudflare_dns_record" "w5isp_txt_dkim" {
  zone_id = cloudflare_zone.w5isp_com.id
  type    = "TXT"
  name    = "dkim._domainkey"
  content = "v=DKIM1;k=rsa;t=s;s=email;p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAxti2t8TvzIqKF9BpKn3rQExKg3sS1SyQuwtQgL0r/ELEJ0D9cKU/iM+eB1ROJctKHoMqKDJoRCMP6eibFcgq2kLKqf+aceEOIBx2OK2WCXML+CNqQZA6yO+A8/Jq7iFZPq8D5FmOoxbwRZkso7CkSennSz/+F7nBPI/OfyEiiI4xJzWH3t8SaAkkcy46O+1K0iCkTpsthon7E2PHa3SPkrjbep/5NImTJLK5LuffiLJtLsiK+73mvsAYCDmrNxPTaDjXkj0TWdKl/d/TnlVJl+YloqWIDt/7LtZQM0C7GZ9flIr7z9hHpSWERXAA5Gj5NQ0/hcY3nF4dPoqWs3VeeQIDAQAB"
  ttl     = 86400
}

resource "cloudflare_dns_record" "w5isp_txt_dmarc" {
  zone_id = cloudflare_zone.w5isp_com.id
  type    = "TXT"
  name    = "_dmarc"
  content = "v=DMARC1; p=quarantine; rua=mailto:postmaster@w5isp.com; ruf=mailto:postmaster@w5isp.com; fo=1"
  ttl     = 86400
}

resource "cloudflare_dns_record" "w5isp_txt_yahoo_verification" {
  zone_id = cloudflare_zone.w5isp_com.id
  type    = "TXT"
  name    = "w5isp.com"
  content = "yahoo-verification-key=CX5h64q8On4rlR/1/DCyvASxTv3rlDmDcNQhwSapyk4="
  ttl     = 86400
}

# =============================================================================
# w5isp.com - SRV records
# =============================================================================

resource "cloudflare_dns_record" "w5isp_srv_autodiscover" {
  zone_id = cloudflare_zone.w5isp_com.id
  type    = "SRV"
  name    = "_autodiscover._tcp"
  ttl     = 86400

  data = {
    priority = 0
    weight   = 0
    port     = 443
    target   = "mail.w5isp.com"
  }

  lifecycle {
    ignore_changes = [priority]
  }
}

# =============================================================================
# w5isp.com - Zone settings
# =============================================================================

resource "cloudflare_zone_setting" "w5isp_com_min_tls_version" {
  zone_id    = cloudflare_zone.w5isp_com.id
  setting_id = "min_tls_version"
  value      = "1.2"
}

resource "cloudflare_zone_setting" "w5isp_com_always_use_https" {
  zone_id    = cloudflare_zone.w5isp_com.id
  setting_id = "always_use_https"
  value      = "on"
}

resource "cloudflare_zone_setting" "w5isp_com_tls_1_3" {
  zone_id    = cloudflare_zone.w5isp_com.id
  setting_id = "tls_1_3"
  value      = "zrt"
}

resource "cloudflare_zone_setting" "w5isp_com_zero_rtt" {
  zone_id    = cloudflare_zone.w5isp_com.id
  setting_id = "0rtt"
  value      = "on"
}

resource "cloudflare_zone_setting" "w5isp_com_ssl" {
  zone_id    = cloudflare_zone.w5isp_com.id
  setting_id = "ssl"
  value      = "full"
}

resource "cloudflare_zone_setting" "w5isp_com_security_header" {
  zone_id    = cloudflare_zone.w5isp_com.id
  setting_id = "security_header"
  value = {
    strict_transport_security = {
      enabled            = true
      max_age            = 15552000
      include_subdomains = true
      preload            = true
      nosniff            = true
    }
  }
}

# =============================================================================
# w5isp.com - Firewall
# =============================================================================

resource "cloudflare_ruleset" "w5isp_firewall" {
  zone_id = cloudflare_zone.w5isp_com.id
  name    = "default"
  kind    = "zone"
  phase   = "http_request_firewall_custom"

  # BirdNET-Pi (bird.w5isp.com) legitimately serves .php pages (e.g. views.php
  # loaded in an iframe), which the abuser block rule below would otherwise
  # catch. Skip the custom ruleset for that host. Must precede the block rule.
  rules = [{
    action = "skip"
    action_parameters = {
      ruleset = "current"
    }
    expression  = "(http.host eq \"bird.w5isp.com\")"
    description = "skip WAF for birdnet UI"
    enabled     = true
    logging = {
      enabled = false
    }
    },

    {
      action      = "block"
      expression  = local.firewall_expression
      description = "block abusers"
      enabled     = true
  }]
}
# =============================================================================
# w5isp.com - CAA records
# =============================================================================

resource "cloudflare_dns_record" "w5isp_caa" {
  for_each = toset(local.cloudflare_cas)

  zone_id = cloudflare_zone.w5isp_com.id
  type    = "CAA"
  name    = "w5isp.com"
  ttl     = 86400

  data = {
    flags = 0
    tag   = "issue"
    value = each.value
  }
}

resource "cloudflare_zero_trust_tunnel_cloudflared_config" "towerops_dev" {
  account_id = local.cloudflare_account_id
  tunnel_id  = "db59aa44-79de-4522-9593-43e828f3215a"

  config = {
    ingress = [
      {
        hostname = "dev.towerops.net"
        service  = "http://localhost:4000"
      },
      {
        service = "http_status:404"
      },
    ]
  }
}

# =============================================================================
# mcintire.me Zone
#
# Migrated from self-hosted BIND9 (ns1.as393837.net) to Cloudflare.
#
# IMPORTANT: The zone is created fresh (no import block). After the first
# `tofu apply`, run `tofu state show cloudflare_zone.mcintire_me` to get the
# assigned name_servers, then update tofu/dns.tf with those values before
# running `tofu apply` a second time to update Porkbun's NS records.
# =============================================================================

resource "cloudflare_zone" "mcintire_me" {
  account = {
    id = local.cloudflare_account_id
  }
  name = "mcintire.me"
}

# =============================================================================
# mcintire.me - A records
# =============================================================================

resource "cloudflare_dns_record" "mcintire_me_a_mail" {
  zone_id = cloudflare_zone.mcintire_me.id
  type    = "A"
  name    = "mail"
  content = "107.174.178.20"
  proxied = false
  ttl     = 86400
}

resource "cloudflare_dns_record" "mcintire_me_a_photos" {
  zone_id = cloudflare_zone.mcintire_me.id
  type    = "A"
  name    = "photos"
  content = "204.110.191.8"
  proxied = false
  ttl     = 86400
}

resource "cloudflare_dns_record" "mcintire_me_a_git" {
  zone_id = cloudflare_zone.mcintire_me.id
  type    = "A"
  name    = "git"
  content = "74.50.113.232"
  proxied = false
  ttl     = 86400
}

resource "cloudflare_dns_record" "mcintire_me_a_hi" {
  zone_id = cloudflare_zone.mcintire_me.id
  type    = "A"
  name    = "hi"
  content = "74.50.113.232"
  proxied = false
  ttl     = 86400
}

resource "cloudflare_dns_record" "mcintire_me_a_vm1" {
  zone_id = cloudflare_zone.mcintire_me.id
  type    = "A"
  name    = "vm1"
  content = "172.245.56.83"
  proxied = false
  ttl     = 86400
}

# =============================================================================
# mcintire.me - AAAA records
# =============================================================================

resource "cloudflare_dns_record" "mcintire_me_aaaa_git" {
  zone_id = cloudflare_zone.mcintire_me.id
  type    = "AAAA"
  name    = "git"
  content = "2604:4500:0009:003d:1c00:bfff:fe00:0464"
  proxied = false
  ttl     = 86400
}

resource "cloudflare_dns_record" "mcintire_me_aaaa_hi" {
  zone_id = cloudflare_zone.mcintire_me.id
  type    = "AAAA"
  name    = "hi"
  content = "2604:4500:0009:003d:1c00:bfff:fe00:0464"
  proxied = false
  ttl     = 86400
}

# =============================================================================
# mcintire.me - MX records
# =============================================================================

resource "cloudflare_dns_record" "mcintire_me_mx_root_primary" {
  zone_id  = cloudflare_zone.mcintire_me.id
  type     = "MX"
  name     = "mcintire.me"
  content  = "mail.mcintire.me"
  priority = 10
  ttl      = 86400
}

resource "cloudflare_dns_record" "mcintire_me_mx_root_backup" {
  zone_id  = cloudflare_zone.mcintire_me.id
  type     = "MX"
  name     = "mcintire.me"
  content  = "mail.nsnw.ca"
  priority = 20
  ttl      = 86400
}

# =============================================================================
# mcintire.me - CNAME records
# =============================================================================

resource "cloudflare_dns_record" "mcintire_me_cname_ha" {
  zone_id = cloudflare_zone.mcintire_me.id
  type    = "CNAME"
  name    = "ha"
  content = "q1l09qiycnaagngmjsg1qas0rhqcfoou.ui.nabu.casa"
  proxied = false
  ttl     = 86400
}

resource "cloudflare_dns_record" "mcintire_me_cname_acme_ha" {
  zone_id = cloudflare_zone.mcintire_me.id
  type    = "CNAME"
  name    = "_acme-challenge.ha"
  content = "_acme-challenge.q1l09qiycnaagngmjsg1qas0rhqcfoou.ui.nabu.casa"
  proxied = false
  ttl     = 86400
}

resource "cloudflare_dns_record" "mcintire_me_cname_autodiscover" {
  zone_id = cloudflare_zone.mcintire_me.id
  type    = "CNAME"
  name    = "autodiscover"
  content = "mail.w5isp.com"
  proxied = false
  ttl     = 86400
}

resource "cloudflare_dns_record" "mcintire_me_cname_autoconfig" {
  zone_id = cloudflare_zone.mcintire_me.id
  type    = "CNAME"
  name    = "autoconfig"
  content = "mail.w5isp.com"
  proxied = false
  ttl     = 86400
}

resource "cloudflare_dns_record" "mcintire_me_cname_em977211" {
  zone_id = cloudflare_zone.mcintire_me.id
  type    = "CNAME"
  name    = "em977211"
  content = "return.smtp2go.net"
  proxied = false
  ttl     = 86400
}

resource "cloudflare_dns_record" "mcintire_me_cname_dkim_s977211" {
  zone_id = cloudflare_zone.mcintire_me.id
  type    = "CNAME"
  name    = "s977211._domainkey"
  content = "dkim.smtp2go.net"
  proxied = false
  ttl     = 86400
}

resource "cloudflare_dns_record" "mcintire_me_cname_link" {
  zone_id = cloudflare_zone.mcintire_me.id
  type    = "CNAME"
  name    = "link"
  content = "track.smtp2go.net"
  proxied = false
  ttl     = 86400
}

# =============================================================================
# mcintire.me - SRV records
# =============================================================================

resource "cloudflare_dns_record" "mcintire_me_srv_autodiscover" {
  zone_id = cloudflare_zone.mcintire_me.id
  type    = "SRV"
  name    = "_autodiscover._tcp"
  ttl     = 86400

  data = {
    priority = 0
    weight   = 0
    port     = 443
    target   = "mail.w5isp.com"
  }

  lifecycle {
    ignore_changes = [priority]
  }
}

# =============================================================================
# mcintire.me - TXT records
# =============================================================================

resource "cloudflare_dns_record" "mcintire_me_txt_spf" {
  zone_id = cloudflare_zone.mcintire_me.id
  type    = "TXT"
  name    = "mcintire.me"
  content = "v=spf1 mx a ip4:107.174.178.20 ~all"
  ttl     = 86400
}

resource "cloudflare_dns_record" "mcintire_me_txt_dmarc" {
  zone_id = cloudflare_zone.mcintire_me.id
  type    = "TXT"
  name    = "_dmarc"
  content = "v=DMARC1; p=quarantine; rua=mailto:postmaster@mcintire.me; ruf=mailto:postmaster@mcintire.me; fo=1"
  ttl     = 86400
}

resource "cloudflare_dns_record" "mcintire_me_txt_dkim" {
  zone_id = cloudflare_zone.mcintire_me.id
  type    = "TXT"
  name    = "dkim._domainkey"
  content = "v=DKIM1;k=rsa;t=s;s=email;p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA0rQie7Hz5AmDbVUX+rKNgp6Hf7crtWyfy6qKbqnrxmmernz1rQ6HyOrHhFAlc8nVLNKr8XP2DOROb1jAnrjndZo9I/ymbrrrCBsi9w6zAht2BheijO/R9k5CDRjeSafm6bg0oMKihtNMIdXvEj9ND8hDpZZKxtOrKFH7zLm4CPmm7jf0gqZH2yK+AA3OYUGSYa1OT0LtdMXadk0IVOI2VYf37Hzb3RUvGOYMVkT0xi+23DiyFk7AyCiyv3LQVBMT+/bwyd4k3yVVn2cr9+Nor+HXVjqASLtqcFLMf1SuX0ezSAjBG7BbqQr5G6Jz+n5YglqEIUKVYzJFE7JdDmqQYQIDAQAB"
  ttl     = 86400
}

resource "cloudflare_dns_record" "mcintire_me_txt_yahoo_verification" {
  zone_id = cloudflare_zone.mcintire_me.id
  type    = "TXT"
  name    = "mcintire.me"
  content = "yahoo-verification-key=Pt59XUhQSd7dbVc0x6TQD+mBEtOOTMHFRV1ZG78h4Ug="
  ttl     = 86400
}

# =============================================================================
# mcintire.me - Zone settings
# =============================================================================

resource "cloudflare_zone_setting" "mcintire_me_min_tls_version" {
  zone_id    = cloudflare_zone.mcintire_me.id
  setting_id = "min_tls_version"
  value      = "1.2"
}

resource "cloudflare_zone_setting" "mcintire_me_always_use_https" {
  zone_id    = cloudflare_zone.mcintire_me.id
  setting_id = "always_use_https"
  value      = "on"
}

resource "cloudflare_zone_setting" "mcintire_me_tls_1_3" {
  zone_id    = cloudflare_zone.mcintire_me.id
  setting_id = "tls_1_3"
  value      = "zrt"
}

resource "cloudflare_zone_setting" "mcintire_me_zero_rtt" {
  zone_id    = cloudflare_zone.mcintire_me.id
  setting_id = "0rtt"
  value      = "on"
}

resource "cloudflare_zone_setting" "mcintire_me_ssl" {
  zone_id    = cloudflare_zone.mcintire_me.id
  setting_id = "ssl"
  value      = "full"
}

resource "cloudflare_zone_setting" "mcintire_me_security_header" {
  zone_id    = cloudflare_zone.mcintire_me.id
  setting_id = "security_header"
  value = {
    strict_transport_security = {
      enabled            = true
      max_age            = 15552000
      include_subdomains = true
      preload            = true
      nosniff            = true
    }
  }
}

# =============================================================================
# mcintire.me - Bot management
# =============================================================================

resource "cloudflare_bot_management" "mcintire_me" {
  zone_id               = cloudflare_zone.mcintire_me.id
  is_robots_txt_managed = false
}

# =============================================================================
# mcintire.me - Firewall
# =============================================================================

resource "cloudflare_ruleset" "mcintire_me_firewall" {
  zone_id = cloudflare_zone.mcintire_me.id
  name    = "default"
  kind    = "zone"
  phase   = "http_request_firewall_custom"

  rules = [{
    action      = "block"
    expression  = local.firewall_expression
    description = "block abusers"
    enabled     = true
  }]
}