locals {
  cloudflare_account_id = "4d18148a82b0a91f289afbbd2944a603"

  cloudflare_zones = {
    "aprs.me"      = "09da59049b0ecad7b734ce3d902bf581"
    "gridmap.org"  = "836f24d97eb51ffc18aa10c0a98efa48"
    "towerops.net" = "c275d35a8885de79ca8e61c17ac97ab6"
  }

  cloudflare_records = {
    # =========================================================================
    # towerops.net - A records
    # =========================================================================
    "towerops.net-a-dfw-poller" = {
      zone_key  = "towerops.net"
      type      = "A"
      name      = "dfw.poller"
      content   = "144.202.64.79"
      proxied   = false
      record_id = "aa8183b748f1bf0e3850d9dabb91ee3a"
    }
    "towerops.net-a-lon-poller" = {
      zone_key  = "towerops.net"
      type      = "A"
      name      = "lon.poller"
      content   = "45.77.228.168"
      proxied   = false
      record_id = "2a25c3ee47284833cea451170d3bd61d"
    }
    "towerops.net-a-staging" = {
      zone_key  = "towerops.net"
      type      = "A"
      name      = "staging"
      content   = "204.110.191.231"
      proxied   = true
      record_id = "8430e2789d5700c556dc7a598d49d8fd"
    }
    "towerops.net-a-www" = {
      zone_key  = "towerops.net"
      type      = "A"
      name      = "www"
      content   = "192.0.2.1"
      proxied   = true
      comment   = "Created during Cloudflare Rules deployment process for Redirect from WWW to root [Template]"
      record_id = "689c47b0e5ed68427f2c3b9e25bdf602"
    }

    # =========================================================================
    # towerops.net - AAAA records
    # =========================================================================
    "towerops.net-aaaa-dfw-poller" = {
      zone_key  = "towerops.net"
      type      = "AAAA"
      name      = "dfw.poller"
      content   = "2001:19f0:6401:af2:5400:5ff:fee7:1bfb"
      proxied   = false
      record_id = "2edc0cf203313e67d64316daf8a0490e"
    }
    "towerops.net-aaaa-lon-poller" = {
      zone_key  = "towerops.net"
      type      = "AAAA"
      name      = "lon.poller"
      content   = "2001:19f0:7400:1195:5400:5ff:feee:a0c3"
      proxied   = false
      record_id = "610f21b8597a1ce6ad4020f15311787a"
    }

    # =========================================================================
    # towerops.net - CNAME records
    # =========================================================================
    "towerops.net-cname-root" = {
      zone_key  = "towerops.net"
      type      = "CNAME"
      name      = "towerops.net"
      content   = "d3d819ba-925c-4d84-8052-68ed32b686bb.cfargotunnel.com"
      proxied   = true
      record_id = "cf1bc4e745466032786db854f4294f99"
    }
    "towerops.net-cname-dev" = {
      zone_key  = "towerops.net"
      type      = "CNAME"
      name      = "dev"
      content   = "db59aa44-79de-4522-9593-43e828f3215a.cfargotunnel.com"
      proxied   = true
      record_id = "21b470e19493c856ce697052dabc90e5"
    }
    "towerops.net-cname-autoconfig" = {
      zone_key  = "towerops.net"
      type      = "CNAME"
      name      = "autoconfig"
      content   = "mail.mcintire.me"
      proxied   = false
      record_id = "1c0f59e7bd583f8971f50231e6fad3cf"
    }
    "towerops.net-cname-autodiscover" = {
      zone_key  = "towerops.net"
      type      = "CNAME"
      name      = "autodiscover"
      content   = "mail.mcintire.me"
      proxied   = false
      record_id = "34a4a9bde8cf4626635cfa3cb5f8c408"
    }
    "towerops.net-cname-dkim-ses-1" = {
      zone_key  = "towerops.net"
      type      = "CNAME"
      name      = "2skkb53ep3vfbkdstfmm2elfthurggid._domainkey"
      content   = "2skkb53ep3vfbkdstfmm2elfthurggid.dkim.amazonses.com"
      proxied   = false
      record_id = "f4a446531128011a1a6b896010983901"
    }
    "towerops.net-cname-dkim-ses-2" = {
      zone_key  = "towerops.net"
      type      = "CNAME"
      name      = "4uwsaywjpmk35j36pfiz4vr37dyy4v7z._domainkey"
      content   = "4uwsaywjpmk35j36pfiz4vr37dyy4v7z.dkim.amazonses.com"
      proxied   = false
      record_id = "aefc5c72e25e3656dbccf0fdf2fc6f48"
    }
    "towerops.net-cname-dkim-ses-3" = {
      zone_key  = "towerops.net"
      type      = "CNAME"
      name      = "l7lbifvot6nv3wwho5rs35xzqzzinz5f._domainkey"
      content   = "l7lbifvot6nv3wwho5rs35xzqzzinz5f.dkim.amazonses.com"
      proxied   = false
      record_id = "02a4cfa316dae29898a8270f2c3aceda"
    }

    # =========================================================================
    # towerops.net - MX records
    # =========================================================================
    "towerops.net-mx-root-primary" = {
      zone_key  = "towerops.net"
      type      = "MX"
      name      = "towerops.net"
      content   = "mail.mcintire.me"
      priority  = 10
      record_id = "a5dc7d6dc6d9085132a8fa0b7db1b69a"
    }
    "towerops.net-mx-root-backup" = {
      zone_key  = "towerops.net"
      type      = "MX"
      name      = "towerops.net"
      content   = "mail.nsnw.ca"
      priority  = 20
      record_id = "bbd552d191e61345f19f8dae10281f9e"
    }
    "towerops.net-mx-mail" = {
      zone_key  = "towerops.net"
      type      = "MX"
      name      = "mail"
      content   = "feedback-smtp.us-east-1.amazonses.com"
      priority  = 10
      record_id = "a2486e2bbb4d6aca978d28807893e346"
    }

    # =========================================================================
    # towerops.net - TXT records
    # =========================================================================
    "towerops.net-txt-spf" = {
      zone_key  = "towerops.net"
      type      = "TXT"
      name      = "towerops.net"
      content   = "v=spf1 mx a ip4:107.174.178.20 ~all"
      record_id = "cf2f74d345960700a81a6025e7a89642"
    }
    "towerops.net-txt-dmarc" = {
      zone_key  = "towerops.net"
      type      = "TXT"
      name      = "_dmarc"
      content   = "v=DMARC1; p=none;"
      record_id = "bd236f9a89fc42f45fd7f4b076478880"
    }
    "towerops.net-txt-dkim" = {
      zone_key  = "towerops.net"
      type      = "TXT"
      name      = "dkim._domainkey"
      content   = "v=DKIM1;k=rsa;t=s;s=email;p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAuFm6nd0L7/nAO4m0MPxdjwRAup5C90DPSPa0TQBDT8S2WvASyQUPV8xSbICGMj6FjZYNd5ph/0VK47gDulxQgNQT96IVf2ooTfkvY/80bAyEdtJbpjEUzQnX5YBi/pJigQx2EeCdaojUZumeIdlFlzeb8QQIEtQhVnyc1Xc/Z8ljPMW1H9DXLSDINjV6UTaXX+PZ7jgpRKgU+RnJNcqTAkhhKQ4bMcRfOam/lF6wPOWte1A7ir08TdE8O67ioqygkr/ivAp7xvV4vGOkY6buLLE+c3exY+my2qTCZgJyUMAhkZzYqzGo1csfHH8x+O2XN/k8Z5jPhq8LSvl9XkllKwIDAQAB"
      record_id = "3872e537e8cee4087ead7eb5785e1426"
    }
    "towerops.net-txt-mail-spf" = {
      zone_key  = "towerops.net"
      type      = "TXT"
      name      = "mail"
      content   = "v=spf1 include:amazonses.com ~all"
      record_id = "76b8314432391c6630e9e1b2edfce65d"
    }
  }
}

# =============================================================================
# Zones
# =============================================================================

import {
  for_each = local.cloudflare_zones
  to       = cloudflare_zone.zones[each.key]
  id       = each.value
}

resource "cloudflare_zone" "zones" {
  for_each = local.cloudflare_zones

  account_id = local.cloudflare_account_id
  zone       = each.key
}

# =============================================================================
# DNS Records (A, AAAA, CNAME, MX, TXT)
# =============================================================================

import {
  for_each = local.cloudflare_records
  to       = cloudflare_record.records[each.key]
  id       = "${local.cloudflare_zones[each.value.zone_key]}/${each.value.record_id}"
}

resource "cloudflare_record" "records" {
  for_each = local.cloudflare_records

  zone_id  = cloudflare_zone.zones[each.value.zone_key].id
  type     = each.value.type
  name     = each.value.name
  content  = each.value.content
  proxied  = lookup(each.value, "proxied", false)
  ttl      = lookup(each.value, "ttl", lookup(each.value, "proxied", false) ? 1 : 86400)
  priority = lookup(each.value, "priority", null)
  comment  = lookup(each.value, "comment", null)
}

# =============================================================================
# DNS Records - aprs.me tunnel CNAME
# =============================================================================

resource "cloudflare_record" "aprs_me_tunnel" {
  zone_id = cloudflare_zone.zones["aprs.me"].id
  type    = "CNAME"
  name    = "aprs.me"
  content = "d3d819ba-925c-4d84-8052-68ed32b686bb.cfargotunnel.com"
  proxied = true
}

# aprs.me - Resend email (DKIM, SPF, DMARC, MX)
resource "cloudflare_record" "aprs_me_dkim_resend" {
  zone_id = cloudflare_zone.zones["aprs.me"].id
  type    = "TXT"
  name    = "resend._domainkey"
  content = "p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCrIhTzL7qrNSdbVOWG2WVwXpKrRrkHY4w/giB7JGl9Hj23z1qIQNh8aNyvDaC0Eosf1013TSWvS+bFMETc5kQZ6lQDq6pvZxHeKbAGH1FvUDVQ2uhjV77Qopf95SdoDKsod3hRnfn4kNZBQ2GfrbJmqobIsQRT8IHFA3XOjOn/jwIDAQAB"
  ttl     = 86400
}

resource "cloudflare_record" "aprs_me_mx_send" {
  zone_id  = cloudflare_zone.zones["aprs.me"].id
  type     = "MX"
  name     = "send"
  content  = "feedback-smtp.us-east-1.amazonses.com"
  priority = 10
  ttl      = 86400
}

resource "cloudflare_record" "aprs_me_spf_send" {
  zone_id = cloudflare_zone.zones["aprs.me"].id
  type    = "TXT"
  name    = "send"
  content = "v=spf1 include:amazonses.com ~all"
  ttl     = 86400
}

resource "cloudflare_record" "aprs_me_dmarc" {
  zone_id = cloudflare_zone.zones["aprs.me"].id
  type    = "TXT"
  name    = "_dmarc"
  content = "v=DMARC1; p=none;"
  ttl     = 86400
}

resource "cloudflare_record" "aprs_me_txt_yahoo_verification" {
  zone_id = cloudflare_zone.zones["aprs.me"].id
  type    = "TXT"
  name    = "aprs.me"
  content = "yahoo-verification-key=FTNt+pQ6IU4l0gQZKNUu3jbVXAgUG/yzm4KVwDzahbE="
  ttl     = 86400
}

resource "cloudflare_record" "towerops_txt_yahoo_verification" {
  zone_id = cloudflare_zone.zones["towerops.net"].id
  type    = "TXT"
  name    = "towerops.net"
  content = "yahoo-verification-key=BWUc1N9CUklaviQyfIGHDwF35WGx3Dcvrag/JCZzyKM="
  ttl     = 86400
}

resource "cloudflare_record" "gridmap_org_tunnel" {
  zone_id = cloudflare_zone.zones["gridmap.org"].id
  type    = "CNAME"
  name    = "gridmap.org"
  content = "d3d819ba-925c-4d84-8052-68ed32b686bb.cfargotunnel.com"
  proxied = true
}

# =============================================================================
# DNS Records (CAA) - restrict certificate issuance to Cloudflare CAs
# =============================================================================

locals {
  cloudflare_cas = ["letsencrypt.org", "pki.goog", "ssl.com", "sectigo.com"]
  caa_zones      = ["aprs.me", "gridmap.org"]
  caa_records = merge([
    for zone in local.caa_zones : {
      for ca in local.cloudflare_cas : "${zone}-${ca}" => {
        zone = zone
        ca   = ca
      }
    }
  ]...)
}

resource "cloudflare_record" "caa" {
  for_each = local.caa_records

  zone_id = cloudflare_zone.zones[each.value.zone].id
  type    = "CAA"
  name    = each.value.zone
  ttl     = 86400

  data {
    flags = "0"
    tag   = "issue"
    value = each.value.ca
  }
}

# =============================================================================
# DNS Records (SRV) - separate due to data block
# =============================================================================

import {
  to = cloudflare_record.towerops_srv_autodiscover
  id = "${local.cloudflare_zones["towerops.net"]}/26db78978535d1d630432970b9a4e279"
}

resource "cloudflare_record" "towerops_srv_autodiscover" {
  zone_id = cloudflare_zone.zones["towerops.net"].id
  type    = "SRV"
  name    = "_autodiscover._tcp"
  ttl     = 86400

  data {
    priority = 0
    weight   = 0
    port     = 443
    target   = "mail.mcintire.me"
  }
}

# =============================================================================
# Zone Settings
#
# Zone security settings: TLS hardening and HSTS
# =============================================================================
resource "cloudflare_zone_settings_override" "aprs_me" {
  zone_id = cloudflare_zone.zones["aprs.me"].id

  settings {
    min_tls_version  = "1.2"
    always_use_https = "on"
    tls_1_3          = "zrt"
    zero_rtt         = "on"
    ssl              = "strict"

    security_header {
      enabled            = true
      max_age            = 15552000
      include_subdomains = true
      preload            = true
      nosniff            = true
    }
  }
}

resource "cloudflare_zone_settings_override" "towerops_net" {
  zone_id = cloudflare_zone.zones["towerops.net"].id

  settings {
    min_tls_version  = "1.2"
    always_use_https = "on"
    tls_1_3          = "zrt"
    zero_rtt         = "on"
    ssl              = "full"

    security_header {
      enabled            = true
      max_age            = 15552000
      include_subdomains = true
      preload            = true
      nosniff            = true
    }
  }
}

resource "cloudflare_zone_settings_override" "gridmap_org" {
  zone_id = cloudflare_zone.zones["gridmap.org"].id

  settings {
    min_tls_version  = "1.2"
    always_use_https = "on"
    tls_1_3          = "zrt"
    zero_rtt         = "on"
    ssl              = "strict"

    security_header {
      enabled            = true
      max_age            = 15552000
      include_subdomains = true
      preload            = true
      nosniff            = true
    }
  }
}
# =============================================================================
# Firewall - custom rules (applied to all zones)
# =============================================================================

locals {
  firewall_expression = join(" or ", [
    "(ip.src.country in {\"KP\" \"RU\" \"CN\" \"SY\" \"MM\" \"VE\" \"IQ\" \"LY\" \"SO\" \"YE\" \"SS\"})",
    "(http.request.uri.path contains \".php\")",
    "(http.request.uri.path contains \"/wp-content\")",
    "(http.request.uri.path contains \"/wp-login\")",
    "(http.request.uri.path contains \"/wp-admin\")",
    "(http.request.uri.path contains \"/wp-includes\")",
    "(http.request.uri.path contains \"/xmlrpc.php\")",
    "(http.request.uri.path contains \"wlwmanifest.xml\")",
    "(http.request.uri.path contains \"/.env\")",
    "(http.request.uri.path contains \"/.git\")",
    "(http.request.uri.path contains \"/phpmyadmin\")",
    "(http.request.uri.path contains \"/cgi-bin\")",
    "(not http.user_agent ne \"\")",
  ])
}

import {
  to = cloudflare_ruleset.towerops_firewall
  id = "zone/${local.cloudflare_zones["towerops.net"]}/3c209e50f21b40388733a7cfe8f62f4e"
}

resource "cloudflare_ruleset" "towerops_firewall" {
  zone_id = cloudflare_zone.zones["towerops.net"].id
  name    = "default"
  kind    = "zone"
  phase   = "http_request_firewall_custom"

  # Allow agent WebSocket connections (must come before block rules)
  rules {
    action = "skip"
    action_parameters {
      ruleset = "current"
    }
    expression  = "(http.request.uri.path eq \"/socket/agent/websocket\")"
    description = "allow agent websocket connections"
    enabled     = true
    logging {
      enabled = false
    }
  }

  rules {
    action      = "block"
    expression  = local.firewall_expression
    description = "block abusers"
    enabled     = true
  }
}

import {
  to = cloudflare_ruleset.gridmap_firewall
  id = "zone/${local.cloudflare_zones["gridmap.org"]}/7dfc79c24a22439ea501865479822df8"
}

resource "cloudflare_ruleset" "gridmap_firewall" {
  zone_id = cloudflare_zone.zones["gridmap.org"].id
  name    = "default"
  kind    = "zone"
  phase   = "http_request_firewall_custom"

  rules {
    action      = "block"
    expression  = local.firewall_expression
    description = "block abusers"
    enabled     = true
  }
}

resource "cloudflare_ruleset" "aprs_me_firewall" {
  zone_id = cloudflare_zone.zones["aprs.me"].id
  name    = "default"
  kind    = "zone"
  phase   = "http_request_firewall_custom"

  rules {
    action      = "block"
    expression  = local.firewall_expression
    description = "block abusers"
    enabled     = true
  }
}

# =============================================================================
# Tunnel Configs
#
# Tunnel resources themselves are not managed here because the tunnel secrets
# are not recoverable from the API. The tunnels were created via the dashboard:
#   - towerops:     d3d819ba-925c-4d84-8052-68ed32b686bb (healthy)
#   - towerops-dev: db59aa44-79de-4522-9593-43e828f3215a (down)
# =============================================================================

import {
  to = cloudflare_zero_trust_tunnel_cloudflared_config.towerops
  id = "${local.cloudflare_account_id}/d3d819ba-925c-4d84-8052-68ed32b686bb"
}

resource "cloudflare_zero_trust_tunnel_cloudflared_config" "towerops" {
  account_id = local.cloudflare_account_id
  tunnel_id  = "d3d819ba-925c-4d84-8052-68ed32b686bb"

  config {
    ingress_rule {
      hostname = "aprs.me"
      service  = "http://aprs.aprs.svc.cluster.local:4000"
    }
    ingress_rule {
      hostname = "gridmap.org"
      service  = "http://gridmap.gridmap.svc.cluster.local:4000"
    }
    ingress_rule {
      hostname = "towerops.net"
      service  = "http://towerops.towerops.svc.cluster.local:4000"
    }
    ingress_rule {
      hostname = "prop.w5isp.com"
      service  = "http://prop.prop.svc.cluster.local:5000"
    }
    ingress_rule {
      service = "http_status:404"
    }
  }
}

import {
  to = cloudflare_zero_trust_tunnel_cloudflared_config.towerops_dev
  id = "${local.cloudflare_account_id}/db59aa44-79de-4522-9593-43e828f3215a"
}

# =============================================================================
# w5isp.com Zone
# =============================================================================

resource "cloudflare_zone" "w5isp_com" {
  account_id = local.cloudflare_account_id
  zone       = "w5isp.com"
}

# =============================================================================
# w5isp.com - A records
# =============================================================================

resource "cloudflare_record" "w5isp_a_root" {
  zone_id = cloudflare_zone.w5isp_com.id
  type    = "A"
  name    = "w5isp.com"
  content = "204.110.191.8"
  proxied = false
  ttl     = 86400
}

resource "cloudflare_record" "w5isp_a_home" {
  zone_id = cloudflare_zone.w5isp_com.id
  type    = "A"
  name    = "home"
  content = "204.110.191.1"
  proxied = false
  ttl     = 86400
}

resource "cloudflare_record" "w5isp_a_photos" {
  zone_id = cloudflare_zone.w5isp_com.id
  type    = "A"
  name    = "photos"
  content = "204.110.191.8"
  proxied = false
  ttl     = 86400
}

resource "cloudflare_record" "w5isp_a_skippy" {
  zone_id = cloudflare_zone.w5isp_com.id
  type    = "A"
  name    = "skippy"
  content = "204.110.191.8"
  proxied = false
  ttl     = 86400
}

resource "cloudflare_record" "w5isp_a_mail" {
  zone_id = cloudflare_zone.w5isp_com.id
  type    = "A"
  name    = "mail"
  content = "107.174.178.20"
  proxied = false
  ttl     = 86400
}

resource "cloudflare_record" "w5isp_a_dokku" {
  zone_id = cloudflare_zone.w5isp_com.id
  type    = "A"
  name    = "dokku"
  content = "204.110.191.218"
  proxied = false
  ttl     = 86400
}

resource "cloudflare_record" "w5isp_a_feedback" {
  zone_id = cloudflare_zone.w5isp_com.id
  type    = "A"
  name    = "feedback"
  content = "204.110.191.8"
  proxied = false
  ttl     = 86400
}

resource "cloudflare_record" "w5isp_a_vm1" {
  zone_id = cloudflare_zone.w5isp_com.id
  type    = "A"
  name    = "vm1"
  content = "172.245.56.83"
  proxied = false
  ttl     = 86400
}

resource "cloudflare_record" "w5isp_a_log" {
  zone_id = cloudflare_zone.w5isp_com.id
  type    = "A"
  name    = "log"
  content = "204.110.191.8"
  proxied = false
  ttl     = 86400
}

resource "cloudflare_record" "w5isp_a_vaprs" {
  zone_id = cloudflare_zone.w5isp_com.id
  type    = "A"
  name    = "vaprs"
  content = "204.110.191.8"
  proxied = false
  ttl     = 86400
}

resource "cloudflare_record" "w5isp_a_srtm" {
  zone_id = cloudflare_zone.w5isp_com.id
  type    = "A"
  name    = "srtm"
  content = "204.110.191.8"
  proxied = false
  ttl     = 86400
}

resource "cloudflare_record" "w5isp_a_aprs" {
  zone_id = cloudflare_zone.w5isp_com.id
  type    = "A"
  name    = "aprs"
  content = "204.110.191.232"
  proxied = false
  ttl     = 86400
}

resource "cloudflare_record" "w5isp_cname_prop" {
  zone_id = cloudflare_zone.w5isp_com.id
  type    = "CNAME"
  name    = "prop"
  content = "d3d819ba-925c-4d84-8052-68ed32b686bb.cfargotunnel.com"
  proxied = true
}

# =============================================================================
# w5isp.com - MX records
# =============================================================================

resource "cloudflare_record" "w5isp_mx_root" {
  zone_id  = cloudflare_zone.w5isp_com.id
  type     = "MX"
  name     = "w5isp.com"
  content  = "mail.w5isp.com"
  priority = 10
  ttl      = 86400
}

# =============================================================================
# w5isp.com - CNAME records
# =============================================================================

resource "cloudflare_record" "w5isp_cname_autodiscover" {
  zone_id = cloudflare_zone.w5isp_com.id
  type    = "CNAME"
  name    = "autodiscover"
  content = "mail.w5isp.com"
  proxied = false
  ttl     = 86400
}

resource "cloudflare_record" "w5isp_cname_autoconfig" {
  zone_id = cloudflare_zone.w5isp_com.id
  type    = "CNAME"
  name    = "autoconfig"
  content = "mail.w5isp.com"
  proxied = false
  ttl     = 86400
}

resource "cloudflare_record" "w5isp_cname_em40" {
  zone_id = cloudflare_zone.w5isp_com.id
  type    = "CNAME"
  name    = "em40"
  content = "u177982.wl233.sendgrid.net"
  proxied = false
  ttl     = 86400
}

resource "cloudflare_record" "w5isp_cname_dkim_s1" {
  zone_id = cloudflare_zone.w5isp_com.id
  type    = "CNAME"
  name    = "s1._domainkey"
  content = "s1.domainkey.u177982.wl233.sendgrid.net"
  proxied = false
  ttl     = 86400
}

resource "cloudflare_record" "w5isp_cname_dkim_s2" {
  zone_id = cloudflare_zone.w5isp_com.id
  type    = "CNAME"
  name    = "s2._domainkey"
  content = "s2.domainkey.u177982.wl233.sendgrid.net"
  proxied = false
  ttl     = 86400
}

resource "cloudflare_record" "w5isp_cname_uptime" {
  zone_id = cloudflare_zone.w5isp_com.id
  type    = "CNAME"
  name    = "uptime"
  content = "stats.uptimerobot.com"
  proxied = false
  ttl     = 86400
}

resource "cloudflare_record" "w5isp_cname_em977211" {
  zone_id = cloudflare_zone.w5isp_com.id
  type    = "CNAME"
  name    = "em977211"
  content = "return.smtp2go.net"
  proxied = false
  ttl     = 86400
}

resource "cloudflare_record" "w5isp_cname_dkim_s977211" {
  zone_id = cloudflare_zone.w5isp_com.id
  type    = "CNAME"
  name    = "s977211._domainkey"
  content = "dkim.smtp2go.net"
  proxied = false
  ttl     = 86400
}

resource "cloudflare_record" "w5isp_cname_link" {
  zone_id = cloudflare_zone.w5isp_com.id
  type    = "CNAME"
  name    = "link"
  content = "track.smtp2go.net"
  proxied = false
  ttl     = 86400
}

# =============================================================================
# w5isp.com - TXT records
# =============================================================================

resource "cloudflare_record" "w5isp_txt_spf" {
  zone_id = cloudflare_zone.w5isp_com.id
  type    = "TXT"
  name    = "w5isp.com"
  content = "v=spf1 mx a ip4:107.174.178.20 ~all"
  ttl     = 86400
}

resource "cloudflare_record" "w5isp_txt_dkim" {
  zone_id = cloudflare_zone.w5isp_com.id
  type    = "TXT"
  name    = "dkim._domainkey"
  content = "v=DKIM1;k=rsa;t=s;s=email;p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAxti2t8TvzIqKF9BpKn3rQExKg3sS1SyQuwtQgL0r/ELEJ0D9cKU/iM+eB1ROJctKHoMqKDJoRCMP6eibFcgq2kLKqf+aceEOIBx2OK2WCXML+CNqQZA6yO+A8/Jq7iFZPq8D5FmOoxbwRZkso7CkSennSz/+F7nBPI/OfyEiiI4xJzWH3t8SaAkkcy46O+1K0iCkTpsthon7E2PHa3SPkrjbep/5NImTJLK5LuffiLJtLsiK+73mvsAYCDmrNxPTaDjXkj0TWdKl/d/TnlVJl+YloqWIDt/7LtZQM0C7GZ9flIr7z9hHpSWERXAA5Gj5NQ0/hcY3nF4dPoqWs3VeeQIDAQAB"
  ttl     = 86400
}

resource "cloudflare_record" "w5isp_txt_dmarc" {
  zone_id = cloudflare_zone.w5isp_com.id
  type    = "TXT"
  name    = "_dmarc"
  content = "v=DMARC1; p=quarantine; rua=mailto:postmaster@w5isp.com; ruf=mailto:postmaster@w5isp.com; fo=1"
  ttl     = 86400
}

resource "cloudflare_record" "w5isp_txt_yahoo_verification" {
  zone_id = cloudflare_zone.w5isp_com.id
  type    = "TXT"
  name    = "w5isp.com"
  content = "yahoo-verification-key=CX5h64q8On4rlR/1/DCyvASxTv3rlDmDcNQhwSapyk4="
  ttl     = 86400
}

# =============================================================================
# w5isp.com - SRV records
# =============================================================================

resource "cloudflare_record" "w5isp_srv_autodiscover" {
  zone_id = cloudflare_zone.w5isp_com.id
  type    = "SRV"
  name    = "_autodiscover._tcp"
  ttl     = 86400

  data {
    priority = 0
    weight   = 0
    port     = 443
    target   = "mail.w5isp.com"
  }
}

# =============================================================================
# w5isp.com - Zone settings
# =============================================================================

resource "cloudflare_zone_settings_override" "w5isp_com" {
  zone_id = cloudflare_zone.w5isp_com.id

  settings {
    min_tls_version  = "1.2"
    always_use_https = "on"
    tls_1_3          = "zrt"
    zero_rtt         = "on"
    ssl              = "full"

    security_header {
      enabled            = true
      max_age            = 15552000
      include_subdomains = true
      preload            = true
      nosniff            = true
    }
  }
}

# =============================================================================
# w5isp.com - Firewall
# =============================================================================

resource "cloudflare_ruleset" "w5isp_firewall" {
  zone_id = cloudflare_zone.w5isp_com.id
  name    = "default"
  kind    = "zone"
  phase   = "http_request_firewall_custom"

  rules {
    action      = "block"
    expression  = local.firewall_expression
    description = "block abusers"
    enabled     = true
  }
}

# =============================================================================
# w5isp.com - CAA records
# =============================================================================

resource "cloudflare_record" "w5isp_caa" {
  for_each = toset(local.cloudflare_cas)

  zone_id = cloudflare_zone.w5isp_com.id
  type    = "CAA"
  name    = "w5isp.com"
  ttl     = 86400

  data {
    flags = "0"
    tag   = "issue"
    value = each.value
  }
}

resource "cloudflare_zero_trust_tunnel_cloudflared_config" "towerops_dev" {
  account_id = local.cloudflare_account_id
  tunnel_id  = "db59aa44-79de-4522-9593-43e828f3215a"

  config {
    ingress_rule {
      hostname = "dev.towerops.net"
      service  = "http://localhost:4000"
    }
    ingress_rule {
      service = "http_status:404"
    }
  }
}