Graham McIntire
292758900e
- DNS: hi.mcintire.me A/AAAA, git.mcintire.me A/AAAA updated to new host - forgejo role: Docker Compose deployment with SQLite, INSTALL_LOCK, admin user creation - Caddyfile-hi.j2: reverse proxy git.mcintire.me -> localhost:3000 - tailscale role: skip connect when no auth key; dynamic repo suite - debian role: fix Signed-By for debian.sources on trixie - curl added to base Debian packages - support.vntx.net: added to vntx_servers, DNS, host_vars
1487 lines
43 KiB
HCL
1487 lines
43 KiB
HCL
locals {
|
|
cloudflare_account_id = "4d18148a82b0a91f289afbbd2944a603"
|
|
|
|
cloudflare_zones = {
|
|
"aprs.me" = "09da59049b0ecad7b734ce3d902bf581"
|
|
"gridmap.org" = "836f24d97eb51ffc18aa10c0a98efa48"
|
|
"towerops.net" = "c275d35a8885de79ca8e61c17ac97ab6"
|
|
}
|
|
|
|
cloudflare_records = {
|
|
# =========================================================================
|
|
# towerops.net - A records
|
|
# =========================================================================
|
|
"towerops.net-a-dfw-poller" = {
|
|
zone_key = "towerops.net"
|
|
type = "A"
|
|
name = "dfw.poller"
|
|
content = "144.202.64.79"
|
|
proxied = false
|
|
record_id = "aa8183b748f1bf0e3850d9dabb91ee3a"
|
|
}
|
|
"towerops.net-a-lon-poller" = {
|
|
zone_key = "towerops.net"
|
|
type = "A"
|
|
name = "lon.poller"
|
|
content = "45.77.228.168"
|
|
proxied = false
|
|
record_id = "2a25c3ee47284833cea451170d3bd61d"
|
|
}
|
|
"towerops.net-a-staging" = {
|
|
zone_key = "towerops.net"
|
|
type = "A"
|
|
name = "staging"
|
|
content = "204.110.191.231"
|
|
proxied = true
|
|
record_id = "8430e2789d5700c556dc7a598d49d8fd"
|
|
}
|
|
"towerops.net-a-www" = {
|
|
zone_key = "towerops.net"
|
|
type = "A"
|
|
name = "www"
|
|
content = "192.0.2.1"
|
|
proxied = true
|
|
comment = "Created during Cloudflare Rules deployment process for Redirect from WWW to root [Template]"
|
|
record_id = "689c47b0e5ed68427f2c3b9e25bdf602"
|
|
}
|
|
|
|
# =========================================================================
|
|
# towerops.net - AAAA records
|
|
# =========================================================================
|
|
"towerops.net-aaaa-dfw-poller" = {
|
|
zone_key = "towerops.net"
|
|
type = "AAAA"
|
|
name = "dfw.poller"
|
|
content = "2001:19f0:6401:af2:5400:5ff:fee7:1bfb"
|
|
proxied = false
|
|
record_id = "2edc0cf203313e67d64316daf8a0490e"
|
|
}
|
|
"towerops.net-aaaa-lon-poller" = {
|
|
zone_key = "towerops.net"
|
|
type = "AAAA"
|
|
name = "lon.poller"
|
|
content = "2001:19f0:7400:1195:5400:5ff:feee:a0c3"
|
|
proxied = false
|
|
record_id = "610f21b8597a1ce6ad4020f15311787a"
|
|
}
|
|
|
|
# =========================================================================
|
|
# towerops.net - CNAME records
|
|
# =========================================================================
|
|
"towerops.net-cname-root" = {
|
|
zone_key = "towerops.net"
|
|
type = "CNAME"
|
|
name = "towerops.net"
|
|
content = "d3d819ba-925c-4d84-8052-68ed32b686bb.cfargotunnel.com"
|
|
proxied = true
|
|
record_id = "cf1bc4e745466032786db854f4294f99"
|
|
}
|
|
"towerops.net-cname-dev" = {
|
|
zone_key = "towerops.net"
|
|
type = "CNAME"
|
|
name = "dev"
|
|
content = "db59aa44-79de-4522-9593-43e828f3215a.cfargotunnel.com"
|
|
proxied = true
|
|
record_id = "21b470e19493c856ce697052dabc90e5"
|
|
}
|
|
"towerops.net-cname-autoconfig" = {
|
|
zone_key = "towerops.net"
|
|
type = "CNAME"
|
|
name = "autoconfig"
|
|
content = "mail.mcintire.me"
|
|
proxied = false
|
|
record_id = "1c0f59e7bd583f8971f50231e6fad3cf"
|
|
}
|
|
"towerops.net-cname-autodiscover" = {
|
|
zone_key = "towerops.net"
|
|
type = "CNAME"
|
|
name = "autodiscover"
|
|
content = "mail.mcintire.me"
|
|
proxied = false
|
|
record_id = "34a4a9bde8cf4626635cfa3cb5f8c408"
|
|
}
|
|
"towerops.net-cname-dkim-ses-1" = {
|
|
zone_key = "towerops.net"
|
|
type = "CNAME"
|
|
name = "2skkb53ep3vfbkdstfmm2elfthurggid._domainkey"
|
|
content = "2skkb53ep3vfbkdstfmm2elfthurggid.dkim.amazonses.com"
|
|
proxied = false
|
|
record_id = "f4a446531128011a1a6b896010983901"
|
|
}
|
|
"towerops.net-cname-dkim-ses-2" = {
|
|
zone_key = "towerops.net"
|
|
type = "CNAME"
|
|
name = "4uwsaywjpmk35j36pfiz4vr37dyy4v7z._domainkey"
|
|
content = "4uwsaywjpmk35j36pfiz4vr37dyy4v7z.dkim.amazonses.com"
|
|
proxied = false
|
|
record_id = "aefc5c72e25e3656dbccf0fdf2fc6f48"
|
|
}
|
|
"towerops.net-cname-dkim-ses-3" = {
|
|
zone_key = "towerops.net"
|
|
type = "CNAME"
|
|
name = "l7lbifvot6nv3wwho5rs35xzqzzinz5f._domainkey"
|
|
content = "l7lbifvot6nv3wwho5rs35xzqzzinz5f.dkim.amazonses.com"
|
|
proxied = false
|
|
record_id = "02a4cfa316dae29898a8270f2c3aceda"
|
|
}
|
|
|
|
# =========================================================================
|
|
# towerops.net - MX records
|
|
# =========================================================================
|
|
"towerops.net-mx-root-primary" = {
|
|
zone_key = "towerops.net"
|
|
type = "MX"
|
|
name = "towerops.net"
|
|
content = "mail.mcintire.me"
|
|
priority = 10
|
|
record_id = "a5dc7d6dc6d9085132a8fa0b7db1b69a"
|
|
}
|
|
"towerops.net-mx-root-backup" = {
|
|
zone_key = "towerops.net"
|
|
type = "MX"
|
|
name = "towerops.net"
|
|
content = "mail.nsnw.ca"
|
|
priority = 20
|
|
record_id = "bbd552d191e61345f19f8dae10281f9e"
|
|
}
|
|
"towerops.net-mx-mail" = {
|
|
zone_key = "towerops.net"
|
|
type = "MX"
|
|
name = "mail"
|
|
content = "feedback-smtp.us-east-1.amazonses.com"
|
|
priority = 10
|
|
record_id = "a2486e2bbb4d6aca978d28807893e346"
|
|
}
|
|
|
|
# =========================================================================
|
|
# towerops.net - TXT records
|
|
# =========================================================================
|
|
"towerops.net-txt-spf" = {
|
|
zone_key = "towerops.net"
|
|
type = "TXT"
|
|
name = "towerops.net"
|
|
content = "v=spf1 mx a ip4:107.174.178.20 ~all"
|
|
record_id = "cf2f74d345960700a81a6025e7a89642"
|
|
}
|
|
"towerops.net-txt-dmarc" = {
|
|
zone_key = "towerops.net"
|
|
type = "TXT"
|
|
name = "_dmarc"
|
|
content = "v=DMARC1; p=none;"
|
|
record_id = "bd236f9a89fc42f45fd7f4b076478880"
|
|
}
|
|
"towerops.net-txt-dkim" = {
|
|
zone_key = "towerops.net"
|
|
type = "TXT"
|
|
name = "dkim._domainkey"
|
|
content = "v=DKIM1;k=rsa;t=s;s=email;p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAuFm6nd0L7/nAO4m0MPxdjwRAup5C90DPSPa0TQBDT8S2WvASyQUPV8xSbICGMj6FjZYNd5ph/0VK47gDulxQgNQT96IVf2ooTfkvY/80bAyEdtJbpjEUzQnX5YBi/pJigQx2EeCdaojUZumeIdlFlzeb8QQIEtQhVnyc1Xc/Z8ljPMW1H9DXLSDINjV6UTaXX+PZ7jgpRKgU+RnJNcqTAkhhKQ4bMcRfOam/lF6wPOWte1A7ir08TdE8O67ioqygkr/ivAp7xvV4vGOkY6buLLE+c3exY+my2qTCZgJyUMAhkZzYqzGo1csfHH8x+O2XN/k8Z5jPhq8LSvl9XkllKwIDAQAB"
|
|
record_id = "3872e537e8cee4087ead7eb5785e1426"
|
|
}
|
|
"towerops.net-txt-mail-spf" = {
|
|
zone_key = "towerops.net"
|
|
type = "TXT"
|
|
name = "mail"
|
|
content = "v=spf1 include:amazonses.com ~all"
|
|
record_id = "76b8314432391c6630e9e1b2edfce65d"
|
|
}
|
|
}
|
|
}
|
|
|
|
# =============================================================================
|
|
# Zones
|
|
# =============================================================================
|
|
|
|
import {
|
|
for_each = local.cloudflare_zones
|
|
to = cloudflare_zone.zones[each.key]
|
|
id = each.value
|
|
}
|
|
|
|
resource "cloudflare_zone" "zones" {
|
|
for_each = local.cloudflare_zones
|
|
|
|
account = {
|
|
id = local.cloudflare_account_id
|
|
}
|
|
name = each.key
|
|
}
|
|
|
|
# =============================================================================
|
|
# DNS Records (A, AAAA, CNAME, MX, TXT)
|
|
# =============================================================================
|
|
|
|
import {
|
|
for_each = local.cloudflare_records
|
|
to = cloudflare_dns_record.records[each.key]
|
|
id = "${local.cloudflare_zones[each.value.zone_key]}/${each.value.record_id}"
|
|
}
|
|
|
|
resource "cloudflare_dns_record" "records" {
|
|
for_each = local.cloudflare_records
|
|
|
|
zone_id = cloudflare_zone.zones[each.value.zone_key].id
|
|
type = each.value.type
|
|
name = each.value.name
|
|
content = each.value.content
|
|
proxied = lookup(each.value, "proxied", false)
|
|
ttl = lookup(each.value, "ttl", lookup(each.value, "proxied", false) ? 1 : 86400)
|
|
priority = lookup(each.value, "priority", null)
|
|
comment = lookup(each.value, "comment", null)
|
|
}
|
|
|
|
# =============================================================================
|
|
# DNS Records - aprs.me tunnel CNAME
|
|
# =============================================================================
|
|
|
|
resource "cloudflare_dns_record" "aprs_me_tunnel" {
|
|
zone_id = cloudflare_zone.zones["aprs.me"].id
|
|
type = "CNAME"
|
|
name = "aprs.me"
|
|
content = "d3d819ba-925c-4d84-8052-68ed32b686bb.cfargotunnel.com"
|
|
proxied = true
|
|
ttl = 1
|
|
}
|
|
|
|
# aprs.me - Resend email (DKIM, SPF, DMARC, MX)
|
|
resource "cloudflare_dns_record" "aprs_me_dkim_resend" {
|
|
zone_id = cloudflare_zone.zones["aprs.me"].id
|
|
type = "TXT"
|
|
name = "resend._domainkey"
|
|
content = "p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCrIhTzL7qrNSdbVOWG2WVwXpKrRrkHY4w/giB7JGl9Hj23z1qIQNh8aNyvDaC0Eosf1013TSWvS+bFMETc5kQZ6lQDq6pvZxHeKbAGH1FvUDVQ2uhjV77Qopf95SdoDKsod3hRnfn4kNZBQ2GfrbJmqobIsQRT8IHFA3XOjOn/jwIDAQAB"
|
|
ttl = 86400
|
|
}
|
|
|
|
resource "cloudflare_dns_record" "aprs_me_mx_send" {
|
|
zone_id = cloudflare_zone.zones["aprs.me"].id
|
|
type = "MX"
|
|
name = "send"
|
|
content = "feedback-smtp.us-east-1.amazonses.com"
|
|
priority = 10
|
|
ttl = 86400
|
|
}
|
|
|
|
resource "cloudflare_dns_record" "aprs_me_spf_send" {
|
|
zone_id = cloudflare_zone.zones["aprs.me"].id
|
|
type = "TXT"
|
|
name = "send"
|
|
content = "v=spf1 include:amazonses.com ~all"
|
|
ttl = 86400
|
|
}
|
|
|
|
resource "cloudflare_dns_record" "aprs_me_dmarc" {
|
|
zone_id = cloudflare_zone.zones["aprs.me"].id
|
|
type = "TXT"
|
|
name = "_dmarc"
|
|
content = "v=DMARC1; p=none;"
|
|
ttl = 86400
|
|
}
|
|
|
|
resource "cloudflare_dns_record" "aprs_me_txt_yahoo_verification" {
|
|
zone_id = cloudflare_zone.zones["aprs.me"].id
|
|
type = "TXT"
|
|
name = "aprs.me"
|
|
content = "yahoo-verification-key=FTNt+pQ6IU4l0gQZKNUu3jbVXAgUG/yzm4KVwDzahbE="
|
|
ttl = 86400
|
|
}
|
|
|
|
resource "cloudflare_dns_record" "towerops_txt_yahoo_verification" {
|
|
zone_id = cloudflare_zone.zones["towerops.net"].id
|
|
type = "TXT"
|
|
name = "towerops.net"
|
|
content = "yahoo-verification-key=BWUc1N9CUklaviQyfIGHDwF35WGx3Dcvrag/JCZzyKM="
|
|
ttl = 86400
|
|
}
|
|
|
|
resource "cloudflare_dns_record" "gridmap_org_tunnel" {
|
|
zone_id = cloudflare_zone.zones["gridmap.org"].id
|
|
type = "CNAME"
|
|
name = "gridmap.org"
|
|
content = "d3d819ba-925c-4d84-8052-68ed32b686bb.cfargotunnel.com"
|
|
proxied = true
|
|
ttl = 1
|
|
}
|
|
|
|
# =============================================================================
|
|
# DNS Records (CAA) - restrict certificate issuance to Cloudflare CAs
|
|
# =============================================================================
|
|
|
|
locals {
|
|
cloudflare_cas = ["letsencrypt.org", "pki.goog", "ssl.com", "sectigo.com"]
|
|
caa_zones = ["aprs.me", "gridmap.org"]
|
|
caa_records = merge([
|
|
for zone in local.caa_zones : {
|
|
for ca in local.cloudflare_cas : "${zone}-${ca}" => {
|
|
zone = zone
|
|
ca = ca
|
|
}
|
|
}
|
|
]...)
|
|
}
|
|
|
|
resource "cloudflare_dns_record" "caa" {
|
|
for_each = local.caa_records
|
|
|
|
zone_id = cloudflare_zone.zones[each.value.zone].id
|
|
type = "CAA"
|
|
name = each.value.zone
|
|
ttl = 86400
|
|
|
|
data = {
|
|
flags = 0
|
|
tag = "issue"
|
|
value = each.value.ca
|
|
}
|
|
}
|
|
|
|
# =============================================================================
|
|
# DNS Records (SRV) - separate due to data block
|
|
# =============================================================================
|
|
|
|
import {
|
|
to = cloudflare_dns_record.towerops_srv_autodiscover
|
|
id = "${local.cloudflare_zones["towerops.net"]}/26db78978535d1d630432970b9a4e279"
|
|
}
|
|
|
|
resource "cloudflare_dns_record" "towerops_srv_autodiscover" {
|
|
zone_id = cloudflare_zone.zones["towerops.net"].id
|
|
type = "SRV"
|
|
name = "_autodiscover._tcp"
|
|
ttl = 86400
|
|
|
|
data = {
|
|
priority = 0
|
|
weight = 0
|
|
port = 443
|
|
target = "mail.mcintire.me"
|
|
}
|
|
|
|
lifecycle {
|
|
ignore_changes = [priority]
|
|
}
|
|
}
|
|
|
|
# =============================================================================
|
|
# Zone Settings
|
|
#
|
|
# Zone security settings: TLS hardening and HSTS
|
|
# =============================================================================
|
|
|
|
# aprs.me
|
|
resource "cloudflare_zone_setting" "aprs_me_min_tls_version" {
|
|
zone_id = cloudflare_zone.zones["aprs.me"].id
|
|
setting_id = "min_tls_version"
|
|
value = "1.2"
|
|
}
|
|
|
|
resource "cloudflare_zone_setting" "aprs_me_always_use_https" {
|
|
zone_id = cloudflare_zone.zones["aprs.me"].id
|
|
setting_id = "always_use_https"
|
|
value = "on"
|
|
}
|
|
|
|
resource "cloudflare_zone_setting" "aprs_me_tls_1_3" {
|
|
zone_id = cloudflare_zone.zones["aprs.me"].id
|
|
setting_id = "tls_1_3"
|
|
value = "zrt"
|
|
}
|
|
|
|
resource "cloudflare_zone_setting" "aprs_me_zero_rtt" {
|
|
zone_id = cloudflare_zone.zones["aprs.me"].id
|
|
setting_id = "0rtt"
|
|
value = "on"
|
|
}
|
|
|
|
resource "cloudflare_zone_setting" "aprs_me_ssl" {
|
|
zone_id = cloudflare_zone.zones["aprs.me"].id
|
|
setting_id = "ssl"
|
|
value = "strict"
|
|
}
|
|
|
|
resource "cloudflare_zone_setting" "aprs_me_security_header" {
|
|
zone_id = cloudflare_zone.zones["aprs.me"].id
|
|
setting_id = "security_header"
|
|
value = {
|
|
strict_transport_security = {
|
|
enabled = true
|
|
max_age = 15552000
|
|
include_subdomains = true
|
|
preload = true
|
|
nosniff = true
|
|
}
|
|
}
|
|
}
|
|
|
|
# towerops.net
|
|
resource "cloudflare_zone_setting" "towerops_net_min_tls_version" {
|
|
zone_id = cloudflare_zone.zones["towerops.net"].id
|
|
setting_id = "min_tls_version"
|
|
value = "1.2"
|
|
}
|
|
|
|
resource "cloudflare_zone_setting" "towerops_net_always_use_https" {
|
|
zone_id = cloudflare_zone.zones["towerops.net"].id
|
|
setting_id = "always_use_https"
|
|
value = "on"
|
|
}
|
|
|
|
resource "cloudflare_zone_setting" "towerops_net_tls_1_3" {
|
|
zone_id = cloudflare_zone.zones["towerops.net"].id
|
|
setting_id = "tls_1_3"
|
|
value = "zrt"
|
|
}
|
|
|
|
resource "cloudflare_zone_setting" "towerops_net_zero_rtt" {
|
|
zone_id = cloudflare_zone.zones["towerops.net"].id
|
|
setting_id = "0rtt"
|
|
value = "on"
|
|
}
|
|
|
|
resource "cloudflare_zone_setting" "towerops_net_ssl" {
|
|
zone_id = cloudflare_zone.zones["towerops.net"].id
|
|
setting_id = "ssl"
|
|
value = "full"
|
|
}
|
|
|
|
resource "cloudflare_zone_setting" "towerops_net_security_header" {
|
|
zone_id = cloudflare_zone.zones["towerops.net"].id
|
|
setting_id = "security_header"
|
|
value = {
|
|
strict_transport_security = {
|
|
enabled = true
|
|
max_age = 15552000
|
|
include_subdomains = true
|
|
preload = true
|
|
nosniff = true
|
|
}
|
|
}
|
|
}
|
|
|
|
# gridmap.org
|
|
resource "cloudflare_zone_setting" "gridmap_org_min_tls_version" {
|
|
zone_id = cloudflare_zone.zones["gridmap.org"].id
|
|
setting_id = "min_tls_version"
|
|
value = "1.2"
|
|
}
|
|
|
|
resource "cloudflare_zone_setting" "gridmap_org_always_use_https" {
|
|
zone_id = cloudflare_zone.zones["gridmap.org"].id
|
|
setting_id = "always_use_https"
|
|
value = "on"
|
|
}
|
|
|
|
resource "cloudflare_zone_setting" "gridmap_org_tls_1_3" {
|
|
zone_id = cloudflare_zone.zones["gridmap.org"].id
|
|
setting_id = "tls_1_3"
|
|
value = "zrt"
|
|
}
|
|
|
|
resource "cloudflare_zone_setting" "gridmap_org_zero_rtt" {
|
|
zone_id = cloudflare_zone.zones["gridmap.org"].id
|
|
setting_id = "0rtt"
|
|
value = "on"
|
|
}
|
|
|
|
resource "cloudflare_zone_setting" "gridmap_org_ssl" {
|
|
zone_id = cloudflare_zone.zones["gridmap.org"].id
|
|
setting_id = "ssl"
|
|
value = "strict"
|
|
}
|
|
|
|
resource "cloudflare_zone_setting" "gridmap_org_security_header" {
|
|
zone_id = cloudflare_zone.zones["gridmap.org"].id
|
|
setting_id = "security_header"
|
|
value = {
|
|
strict_transport_security = {
|
|
enabled = true
|
|
max_age = 15552000
|
|
include_subdomains = true
|
|
preload = true
|
|
nosniff = true
|
|
}
|
|
}
|
|
}
|
|
|
|
# =============================================================================
|
|
# Bot Management - disable Cloudflare managed robots.txt
|
|
#
|
|
# Each app repo ships its own robots.txt. Turning off the managed robots.txt
|
|
# feature ("Instruct AI bot traffic with robots.txt") stops Cloudflare from
|
|
# prepending/serving its own robots.txt at the zone edge, so the origin's file
|
|
# is returned unchanged. All other bot_management fields are Optional+Computed,
|
|
# so omitting them preserves their current values (e.g. Super Bot Fight Mode).
|
|
#
|
|
# NOTE: requires CLOUDFLARE_API_TOKEN to include the "Bot Management Write"
|
|
# permission for these zones; the DNS-scoped token cannot apply this.
|
|
# =============================================================================
|
|
|
|
resource "cloudflare_bot_management" "zones" {
|
|
for_each = { for k, v in cloudflare_zone.zones : k => v.id }
|
|
|
|
zone_id = each.value
|
|
is_robots_txt_managed = false
|
|
}
|
|
|
|
resource "cloudflare_bot_management" "w5isp_com" {
|
|
zone_id = cloudflare_zone.w5isp_com.id
|
|
is_robots_txt_managed = false
|
|
}
|
|
|
|
# =============================================================================
|
|
# Firewall - custom rules (applied to all zones)
|
|
# =============================================================================
|
|
|
|
locals {
|
|
firewall_expression = join(" or ", [
|
|
"(ip.src.country in {\"KP\" \"RU\" \"CN\" \"SY\" \"MM\" \"VE\" \"IQ\" \"LY\" \"SO\" \"YE\" \"SS\"})",
|
|
"(http.request.uri.path contains \".php\")",
|
|
"(http.request.uri.path contains \"/wp-content\")",
|
|
"(http.request.uri.path contains \"/wp-login\")",
|
|
"(http.request.uri.path contains \"/wp-admin\")",
|
|
"(http.request.uri.path contains \"/wp-includes\")",
|
|
"(http.request.uri.path contains \"/xmlrpc.php\")",
|
|
"(http.request.uri.path contains \"wlwmanifest.xml\")",
|
|
"(http.request.uri.path contains \"/.env\")",
|
|
"(http.request.uri.path contains \"/.git\")",
|
|
"(http.request.uri.path contains \"/phpmyadmin\")",
|
|
"(http.request.uri.path contains \"/cgi-bin\")",
|
|
"(not http.user_agent ne \"\")",
|
|
])
|
|
}
|
|
|
|
# =============================================================================
|
|
# towerops.net - Response Header Transform
|
|
#
|
|
# Sets the Content-Security-Policy explicitly at the Cloudflare layer so it
|
|
# cannot be silently overridden by managed rulesets or other Cloudflare features.
|
|
# =============================================================================
|
|
|
|
locals {
|
|
towerops_csp = join("; ", [
|
|
"default-src 'self' data:",
|
|
"script-src 'self' 'unsafe-inline' https://a.w5isp.com",
|
|
"style-src 'self' 'unsafe-inline' 'unsafe-hashes'",
|
|
"img-src 'self' data: https:",
|
|
"font-src 'self' data:",
|
|
"connect-src 'self' ws: wss: https://a.w5isp.com",
|
|
"frame-ancestors 'none'",
|
|
])
|
|
}
|
|
|
|
resource "cloudflare_ruleset" "towerops_response_headers" {
|
|
zone_id = cloudflare_zone.zones["towerops.net"].id
|
|
name = "default"
|
|
kind = "zone"
|
|
phase = "http_response_headers_transform"
|
|
|
|
rules = [{
|
|
action = "rewrite"
|
|
action_parameters = {
|
|
headers = {
|
|
"Content-Security-Policy" = {
|
|
operation = "set"
|
|
value = local.towerops_csp
|
|
}
|
|
}
|
|
}
|
|
expression = "true"
|
|
description = "set CSP for towerops.net"
|
|
enabled = true
|
|
}]
|
|
}
|
|
import {
|
|
to = cloudflare_ruleset.towerops_firewall
|
|
id = "zone/${local.cloudflare_zones["towerops.net"]}/3c209e50f21b40388733a7cfe8f62f4e"
|
|
}
|
|
|
|
resource "cloudflare_ruleset" "towerops_firewall" {
|
|
zone_id = cloudflare_zone.zones["towerops.net"].id
|
|
name = "default"
|
|
kind = "zone"
|
|
phase = "http_request_firewall_custom"
|
|
|
|
# Allow agent WebSocket connections (must come before block rules)
|
|
rules = [{
|
|
action = "skip"
|
|
action_parameters = {
|
|
ruleset = "current"
|
|
}
|
|
expression = "(http.request.uri.path eq \"/socket/agent/websocket\")"
|
|
description = "allow agent websocket connections"
|
|
enabled = true
|
|
logging = {
|
|
enabled = false
|
|
}
|
|
},
|
|
|
|
{
|
|
action = "block"
|
|
expression = local.firewall_expression
|
|
description = "block abusers"
|
|
enabled = true
|
|
}]
|
|
}
|
|
import {
|
|
to = cloudflare_ruleset.gridmap_firewall
|
|
id = "zone/${local.cloudflare_zones["gridmap.org"]}/7dfc79c24a22439ea501865479822df8"
|
|
}
|
|
|
|
resource "cloudflare_ruleset" "gridmap_firewall" {
|
|
zone_id = cloudflare_zone.zones["gridmap.org"].id
|
|
name = "default"
|
|
kind = "zone"
|
|
phase = "http_request_firewall_custom"
|
|
|
|
rules = [{
|
|
action = "block"
|
|
expression = local.firewall_expression
|
|
description = "block abusers"
|
|
enabled = true
|
|
}]
|
|
}
|
|
resource "cloudflare_ruleset" "aprs_me_firewall" {
|
|
zone_id = cloudflare_zone.zones["aprs.me"].id
|
|
name = "default"
|
|
kind = "zone"
|
|
phase = "http_request_firewall_custom"
|
|
|
|
rules = [{
|
|
action = "block"
|
|
expression = local.firewall_expression
|
|
description = "block abusers"
|
|
enabled = true
|
|
}]
|
|
}
|
|
# =============================================================================
|
|
# Tunnel Configs
|
|
#
|
|
# Tunnel resources themselves are not managed here because the tunnel secrets
|
|
# are not recoverable from the API. The tunnels were created via the dashboard:
|
|
# - towerops: d3d819ba-925c-4d84-8052-68ed32b686bb (healthy)
|
|
# - towerops-dev: db59aa44-79de-4522-9593-43e828f3215a (down)
|
|
# - birdnet: bd9fe980-86d1-4b62-8a35-65ed529696f1 (created via API,
|
|
# config_src=cloudflare; cloudflared runs on host birdnet
|
|
# at 10.0.17.29 as a systemd token service)
|
|
# =============================================================================
|
|
|
|
# birdnet tunnel ingress: bird.w5isp.com -> BirdNET Caddy UI on the host
|
|
resource "cloudflare_zero_trust_tunnel_cloudflared_config" "birdnet" {
|
|
account_id = local.cloudflare_account_id
|
|
tunnel_id = "bd9fe980-86d1-4b62-8a35-65ed529696f1"
|
|
|
|
config = {
|
|
ingress = [
|
|
{
|
|
hostname = "bird.w5isp.com"
|
|
service = "http://localhost:80"
|
|
},
|
|
{
|
|
service = "http_status:404"
|
|
},
|
|
]
|
|
}
|
|
}
|
|
|
|
import {
|
|
to = cloudflare_zero_trust_tunnel_cloudflared_config.towerops
|
|
id = "${local.cloudflare_account_id}/d3d819ba-925c-4d84-8052-68ed32b686bb"
|
|
}
|
|
|
|
resource "cloudflare_zero_trust_tunnel_cloudflared_config" "towerops" {
|
|
account_id = local.cloudflare_account_id
|
|
tunnel_id = "d3d819ba-925c-4d84-8052-68ed32b686bb"
|
|
|
|
config = {
|
|
ingress = [
|
|
{
|
|
hostname = "aprs.me"
|
|
service = "http://aprs.aprs.svc.cluster.local:4000"
|
|
},
|
|
{
|
|
hostname = "gridmap.org"
|
|
service = "http://gridmap.gridmap.svc.cluster.local:4000"
|
|
},
|
|
{
|
|
hostname = "towerops.net"
|
|
service = "http://towerops.towerops.svc.cluster.local:4000"
|
|
},
|
|
{
|
|
hostname = "prop.w5isp.com"
|
|
service = "http://prop.prop.svc.cluster.local:5000"
|
|
},
|
|
{
|
|
hostname = "argo.w5isp.com"
|
|
service = "http://argocd-server.argocd.svc.cluster.local:80"
|
|
},
|
|
{
|
|
service = "http_status:404"
|
|
},
|
|
]
|
|
}
|
|
}
|
|
|
|
import {
|
|
to = cloudflare_zero_trust_tunnel_cloudflared_config.towerops_dev
|
|
id = "${local.cloudflare_account_id}/db59aa44-79de-4522-9593-43e828f3215a"
|
|
}
|
|
|
|
# =============================================================================
|
|
# w5isp.com Zone
|
|
# =============================================================================
|
|
|
|
resource "cloudflare_zone" "w5isp_com" {
|
|
account = {
|
|
id = local.cloudflare_account_id
|
|
}
|
|
name = "w5isp.com"
|
|
}
|
|
|
|
# =============================================================================
|
|
# w5isp.com - A records
|
|
# =============================================================================
|
|
|
|
resource "cloudflare_dns_record" "w5isp_a_root" {
|
|
zone_id = cloudflare_zone.w5isp_com.id
|
|
type = "A"
|
|
name = "w5isp.com"
|
|
content = "204.110.191.8"
|
|
proxied = false
|
|
ttl = 86400
|
|
}
|
|
|
|
resource "cloudflare_dns_record" "w5isp_a_home" {
|
|
zone_id = cloudflare_zone.w5isp_com.id
|
|
type = "A"
|
|
name = "home"
|
|
content = "204.110.191.1"
|
|
proxied = false
|
|
ttl = 86400
|
|
}
|
|
|
|
resource "cloudflare_dns_record" "w5isp_a_photos" {
|
|
zone_id = cloudflare_zone.w5isp_com.id
|
|
type = "A"
|
|
name = "photos"
|
|
content = "204.110.191.8"
|
|
proxied = false
|
|
ttl = 86400
|
|
}
|
|
|
|
resource "cloudflare_dns_record" "w5isp_a_skippy" {
|
|
zone_id = cloudflare_zone.w5isp_com.id
|
|
type = "A"
|
|
name = "skippy"
|
|
content = "204.110.191.8"
|
|
proxied = false
|
|
ttl = 86400
|
|
}
|
|
|
|
resource "cloudflare_dns_record" "w5isp_a_mail" {
|
|
zone_id = cloudflare_zone.w5isp_com.id
|
|
type = "A"
|
|
name = "mail"
|
|
content = "107.174.178.20"
|
|
proxied = false
|
|
ttl = 86400
|
|
}
|
|
|
|
resource "cloudflare_dns_record" "w5isp_a_dokku" {
|
|
zone_id = cloudflare_zone.w5isp_com.id
|
|
type = "A"
|
|
name = "dokku"
|
|
content = "204.110.191.218"
|
|
proxied = false
|
|
ttl = 86400
|
|
}
|
|
|
|
resource "cloudflare_dns_record" "w5isp_a_feedback" {
|
|
zone_id = cloudflare_zone.w5isp_com.id
|
|
type = "A"
|
|
name = "feedback"
|
|
content = "204.110.191.8"
|
|
proxied = false
|
|
ttl = 86400
|
|
}
|
|
|
|
resource "cloudflare_dns_record" "w5isp_a_vm1" {
|
|
zone_id = cloudflare_zone.w5isp_com.id
|
|
type = "A"
|
|
name = "vm1"
|
|
content = "172.245.56.83"
|
|
proxied = false
|
|
ttl = 86400
|
|
}
|
|
|
|
resource "cloudflare_dns_record" "w5isp_a_log" {
|
|
zone_id = cloudflare_zone.w5isp_com.id
|
|
type = "A"
|
|
name = "log"
|
|
content = "204.110.191.8"
|
|
proxied = false
|
|
ttl = 86400
|
|
}
|
|
|
|
resource "cloudflare_dns_record" "w5isp_a_vaprs" {
|
|
zone_id = cloudflare_zone.w5isp_com.id
|
|
type = "A"
|
|
name = "vaprs"
|
|
content = "204.110.191.8"
|
|
proxied = false
|
|
ttl = 86400
|
|
}
|
|
|
|
resource "cloudflare_dns_record" "w5isp_a_srtm" {
|
|
zone_id = cloudflare_zone.w5isp_com.id
|
|
type = "A"
|
|
name = "srtm"
|
|
content = "204.110.191.8"
|
|
proxied = false
|
|
ttl = 86400
|
|
}
|
|
|
|
resource "cloudflare_dns_record" "w5isp_a_aprs" {
|
|
zone_id = cloudflare_zone.w5isp_com.id
|
|
type = "A"
|
|
name = "aprs"
|
|
content = "204.110.191.232"
|
|
proxied = false
|
|
ttl = 86400
|
|
}
|
|
|
|
resource "cloudflare_dns_record" "w5isp_a_a" {
|
|
zone_id = cloudflare_zone.w5isp_com.id
|
|
type = "A"
|
|
name = "a"
|
|
content = "204.110.191.223"
|
|
proxied = false
|
|
ttl = 86400
|
|
}
|
|
|
|
resource "cloudflare_dns_record" "w5isp_cname_prop" {
|
|
zone_id = cloudflare_zone.w5isp_com.id
|
|
type = "CNAME"
|
|
name = "prop"
|
|
content = "d3d819ba-925c-4d84-8052-68ed32b686bb.cfargotunnel.com"
|
|
proxied = true
|
|
ttl = 1
|
|
}
|
|
|
|
resource "cloudflare_dns_record" "w5isp_cname_argo" {
|
|
zone_id = cloudflare_zone.w5isp_com.id
|
|
type = "CNAME"
|
|
name = "argo"
|
|
content = "d3d819ba-925c-4d84-8052-68ed32b686bb.cfargotunnel.com"
|
|
proxied = true
|
|
ttl = 1
|
|
}
|
|
|
|
# birdnet host (10.0.17.29) - BirdNET web UI via its own cloudflared tunnel
|
|
resource "cloudflare_dns_record" "w5isp_cname_bird" {
|
|
zone_id = cloudflare_zone.w5isp_com.id
|
|
type = "CNAME"
|
|
name = "bird"
|
|
content = "bd9fe980-86d1-4b62-8a35-65ed529696f1.cfargotunnel.com"
|
|
proxied = true
|
|
ttl = 1
|
|
}
|
|
|
|
# =============================================================================
|
|
# w5isp.com - MX records
|
|
# =============================================================================
|
|
|
|
resource "cloudflare_dns_record" "w5isp_mx_root" {
|
|
zone_id = cloudflare_zone.w5isp_com.id
|
|
type = "MX"
|
|
name = "w5isp.com"
|
|
content = "mail.w5isp.com"
|
|
priority = 10
|
|
ttl = 86400
|
|
}
|
|
|
|
# =============================================================================
|
|
# w5isp.com - CNAME records
|
|
# =============================================================================
|
|
|
|
resource "cloudflare_dns_record" "w5isp_cname_autodiscover" {
|
|
zone_id = cloudflare_zone.w5isp_com.id
|
|
type = "CNAME"
|
|
name = "autodiscover"
|
|
content = "mail.w5isp.com"
|
|
proxied = false
|
|
ttl = 86400
|
|
}
|
|
|
|
resource "cloudflare_dns_record" "w5isp_cname_autoconfig" {
|
|
zone_id = cloudflare_zone.w5isp_com.id
|
|
type = "CNAME"
|
|
name = "autoconfig"
|
|
content = "mail.w5isp.com"
|
|
proxied = false
|
|
ttl = 86400
|
|
}
|
|
|
|
resource "cloudflare_dns_record" "w5isp_cname_em40" {
|
|
zone_id = cloudflare_zone.w5isp_com.id
|
|
type = "CNAME"
|
|
name = "em40"
|
|
content = "u177982.wl233.sendgrid.net"
|
|
proxied = false
|
|
ttl = 86400
|
|
}
|
|
|
|
resource "cloudflare_dns_record" "w5isp_cname_dkim_s1" {
|
|
zone_id = cloudflare_zone.w5isp_com.id
|
|
type = "CNAME"
|
|
name = "s1._domainkey"
|
|
content = "s1.domainkey.u177982.wl233.sendgrid.net"
|
|
proxied = false
|
|
ttl = 86400
|
|
}
|
|
|
|
resource "cloudflare_dns_record" "w5isp_cname_dkim_s2" {
|
|
zone_id = cloudflare_zone.w5isp_com.id
|
|
type = "CNAME"
|
|
name = "s2._domainkey"
|
|
content = "s2.domainkey.u177982.wl233.sendgrid.net"
|
|
proxied = false
|
|
ttl = 86400
|
|
}
|
|
|
|
resource "cloudflare_dns_record" "w5isp_cname_uptime" {
|
|
zone_id = cloudflare_zone.w5isp_com.id
|
|
type = "CNAME"
|
|
name = "uptime"
|
|
content = "stats.uptimerobot.com"
|
|
proxied = false
|
|
ttl = 86400
|
|
}
|
|
|
|
resource "cloudflare_dns_record" "w5isp_cname_em977211" {
|
|
zone_id = cloudflare_zone.w5isp_com.id
|
|
type = "CNAME"
|
|
name = "em977211"
|
|
content = "return.smtp2go.net"
|
|
proxied = false
|
|
ttl = 86400
|
|
}
|
|
|
|
resource "cloudflare_dns_record" "w5isp_cname_dkim_s977211" {
|
|
zone_id = cloudflare_zone.w5isp_com.id
|
|
type = "CNAME"
|
|
name = "s977211._domainkey"
|
|
content = "dkim.smtp2go.net"
|
|
proxied = false
|
|
ttl = 86400
|
|
}
|
|
|
|
resource "cloudflare_dns_record" "w5isp_cname_link" {
|
|
zone_id = cloudflare_zone.w5isp_com.id
|
|
type = "CNAME"
|
|
name = "link"
|
|
content = "track.smtp2go.net"
|
|
proxied = false
|
|
ttl = 86400
|
|
}
|
|
|
|
resource "cloudflare_dns_record" "w5isp_cname_ha" {
|
|
zone_id = cloudflare_zone.w5isp_com.id
|
|
type = "CNAME"
|
|
name = "ha"
|
|
content = "q1l09qiycnaagngmjsg1qas0rhqcfoou.ui.nabu.casa"
|
|
proxied = false
|
|
ttl = 86400
|
|
}
|
|
|
|
resource "cloudflare_dns_record" "w5isp_cname_acme_ha" {
|
|
zone_id = cloudflare_zone.w5isp_com.id
|
|
type = "CNAME"
|
|
name = "_acme-challenge.ha"
|
|
content = "_acme-challenge.q1l09qiycnaagngmjsg1qas0rhqcfoou.ui.nabu.casa"
|
|
proxied = false
|
|
ttl = 86400
|
|
}
|
|
|
|
# =============================================================================
|
|
# w5isp.com - TXT records
|
|
# =============================================================================
|
|
|
|
resource "cloudflare_dns_record" "w5isp_txt_spf" {
|
|
zone_id = cloudflare_zone.w5isp_com.id
|
|
type = "TXT"
|
|
name = "w5isp.com"
|
|
content = "v=spf1 mx a ip4:107.174.178.20 ~all"
|
|
ttl = 86400
|
|
}
|
|
|
|
resource "cloudflare_dns_record" "w5isp_txt_dkim" {
|
|
zone_id = cloudflare_zone.w5isp_com.id
|
|
type = "TXT"
|
|
name = "dkim._domainkey"
|
|
content = "v=DKIM1;k=rsa;t=s;s=email;p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAxti2t8TvzIqKF9BpKn3rQExKg3sS1SyQuwtQgL0r/ELEJ0D9cKU/iM+eB1ROJctKHoMqKDJoRCMP6eibFcgq2kLKqf+aceEOIBx2OK2WCXML+CNqQZA6yO+A8/Jq7iFZPq8D5FmOoxbwRZkso7CkSennSz/+F7nBPI/OfyEiiI4xJzWH3t8SaAkkcy46O+1K0iCkTpsthon7E2PHa3SPkrjbep/5NImTJLK5LuffiLJtLsiK+73mvsAYCDmrNxPTaDjXkj0TWdKl/d/TnlVJl+YloqWIDt/7LtZQM0C7GZ9flIr7z9hHpSWERXAA5Gj5NQ0/hcY3nF4dPoqWs3VeeQIDAQAB"
|
|
ttl = 86400
|
|
}
|
|
|
|
resource "cloudflare_dns_record" "w5isp_txt_dmarc" {
|
|
zone_id = cloudflare_zone.w5isp_com.id
|
|
type = "TXT"
|
|
name = "_dmarc"
|
|
content = "v=DMARC1; p=quarantine; rua=mailto:postmaster@w5isp.com; ruf=mailto:postmaster@w5isp.com; fo=1"
|
|
ttl = 86400
|
|
}
|
|
|
|
resource "cloudflare_dns_record" "w5isp_txt_yahoo_verification" {
|
|
zone_id = cloudflare_zone.w5isp_com.id
|
|
type = "TXT"
|
|
name = "w5isp.com"
|
|
content = "yahoo-verification-key=CX5h64q8On4rlR/1/DCyvASxTv3rlDmDcNQhwSapyk4="
|
|
ttl = 86400
|
|
}
|
|
|
|
# =============================================================================
|
|
# w5isp.com - SRV records
|
|
# =============================================================================
|
|
|
|
resource "cloudflare_dns_record" "w5isp_srv_autodiscover" {
|
|
zone_id = cloudflare_zone.w5isp_com.id
|
|
type = "SRV"
|
|
name = "_autodiscover._tcp"
|
|
ttl = 86400
|
|
|
|
data = {
|
|
priority = 0
|
|
weight = 0
|
|
port = 443
|
|
target = "mail.w5isp.com"
|
|
}
|
|
|
|
lifecycle {
|
|
ignore_changes = [priority]
|
|
}
|
|
}
|
|
|
|
# =============================================================================
|
|
# w5isp.com - Zone settings
|
|
# =============================================================================
|
|
|
|
resource "cloudflare_zone_setting" "w5isp_com_min_tls_version" {
|
|
zone_id = cloudflare_zone.w5isp_com.id
|
|
setting_id = "min_tls_version"
|
|
value = "1.2"
|
|
}
|
|
|
|
resource "cloudflare_zone_setting" "w5isp_com_always_use_https" {
|
|
zone_id = cloudflare_zone.w5isp_com.id
|
|
setting_id = "always_use_https"
|
|
value = "on"
|
|
}
|
|
|
|
resource "cloudflare_zone_setting" "w5isp_com_tls_1_3" {
|
|
zone_id = cloudflare_zone.w5isp_com.id
|
|
setting_id = "tls_1_3"
|
|
value = "zrt"
|
|
}
|
|
|
|
resource "cloudflare_zone_setting" "w5isp_com_zero_rtt" {
|
|
zone_id = cloudflare_zone.w5isp_com.id
|
|
setting_id = "0rtt"
|
|
value = "on"
|
|
}
|
|
|
|
resource "cloudflare_zone_setting" "w5isp_com_ssl" {
|
|
zone_id = cloudflare_zone.w5isp_com.id
|
|
setting_id = "ssl"
|
|
value = "full"
|
|
}
|
|
|
|
resource "cloudflare_zone_setting" "w5isp_com_security_header" {
|
|
zone_id = cloudflare_zone.w5isp_com.id
|
|
setting_id = "security_header"
|
|
value = {
|
|
strict_transport_security = {
|
|
enabled = true
|
|
max_age = 15552000
|
|
include_subdomains = true
|
|
preload = true
|
|
nosniff = true
|
|
}
|
|
}
|
|
}
|
|
|
|
# =============================================================================
|
|
# w5isp.com - Firewall
|
|
# =============================================================================
|
|
|
|
resource "cloudflare_ruleset" "w5isp_firewall" {
|
|
zone_id = cloudflare_zone.w5isp_com.id
|
|
name = "default"
|
|
kind = "zone"
|
|
phase = "http_request_firewall_custom"
|
|
|
|
# BirdNET-Pi (bird.w5isp.com) legitimately serves .php pages (e.g. views.php
|
|
# loaded in an iframe), which the abuser block rule below would otherwise
|
|
# catch. Skip the custom ruleset for that host. Must precede the block rule.
|
|
rules = [{
|
|
action = "skip"
|
|
action_parameters = {
|
|
ruleset = "current"
|
|
}
|
|
expression = "(http.host eq \"bird.w5isp.com\")"
|
|
description = "skip WAF for birdnet UI"
|
|
enabled = true
|
|
logging = {
|
|
enabled = false
|
|
}
|
|
},
|
|
|
|
{
|
|
action = "block"
|
|
expression = local.firewall_expression
|
|
description = "block abusers"
|
|
enabled = true
|
|
}]
|
|
}
|
|
# =============================================================================
|
|
# w5isp.com - CAA records
|
|
# =============================================================================
|
|
|
|
resource "cloudflare_dns_record" "w5isp_caa" {
|
|
for_each = toset(local.cloudflare_cas)
|
|
|
|
zone_id = cloudflare_zone.w5isp_com.id
|
|
type = "CAA"
|
|
name = "w5isp.com"
|
|
ttl = 86400
|
|
|
|
data = {
|
|
flags = 0
|
|
tag = "issue"
|
|
value = each.value
|
|
}
|
|
}
|
|
|
|
resource "cloudflare_zero_trust_tunnel_cloudflared_config" "towerops_dev" {
|
|
account_id = local.cloudflare_account_id
|
|
tunnel_id = "db59aa44-79de-4522-9593-43e828f3215a"
|
|
|
|
config = {
|
|
ingress = [
|
|
{
|
|
hostname = "dev.towerops.net"
|
|
service = "http://localhost:4000"
|
|
},
|
|
{
|
|
service = "http_status:404"
|
|
},
|
|
]
|
|
}
|
|
}
|
|
|
|
# =============================================================================
|
|
# mcintire.me Zone
|
|
#
|
|
# Migrated from self-hosted BIND9 (ns1.as393837.net) to Cloudflare.
|
|
#
|
|
# IMPORTANT: The zone is created fresh (no import block). After the first
|
|
# `tofu apply`, run `tofu state show cloudflare_zone.mcintire_me` to get the
|
|
# assigned name_servers, then update tofu/dns.tf with those values before
|
|
# running `tofu apply` a second time to update Porkbun's NS records.
|
|
# =============================================================================
|
|
|
|
resource "cloudflare_zone" "mcintire_me" {
|
|
account = {
|
|
id = local.cloudflare_account_id
|
|
}
|
|
name = "mcintire.me"
|
|
}
|
|
|
|
# =============================================================================
|
|
# mcintire.me - A records
|
|
# =============================================================================
|
|
|
|
resource "cloudflare_dns_record" "mcintire_me_a_mail" {
|
|
zone_id = cloudflare_zone.mcintire_me.id
|
|
type = "A"
|
|
name = "mail"
|
|
content = "107.174.178.20"
|
|
proxied = false
|
|
ttl = 86400
|
|
}
|
|
|
|
resource "cloudflare_dns_record" "mcintire_me_a_photos" {
|
|
zone_id = cloudflare_zone.mcintire_me.id
|
|
type = "A"
|
|
name = "photos"
|
|
content = "204.110.191.8"
|
|
proxied = false
|
|
ttl = 86400
|
|
}
|
|
|
|
resource "cloudflare_dns_record" "mcintire_me_a_git" {
|
|
zone_id = cloudflare_zone.mcintire_me.id
|
|
type = "A"
|
|
name = "git"
|
|
content = "74.50.113.232"
|
|
proxied = false
|
|
ttl = 86400
|
|
}
|
|
|
|
resource "cloudflare_dns_record" "mcintire_me_a_hi" {
|
|
zone_id = cloudflare_zone.mcintire_me.id
|
|
type = "A"
|
|
name = "hi"
|
|
content = "74.50.113.232"
|
|
proxied = false
|
|
ttl = 86400
|
|
}
|
|
|
|
resource "cloudflare_dns_record" "mcintire_me_a_vm1" {
|
|
zone_id = cloudflare_zone.mcintire_me.id
|
|
type = "A"
|
|
name = "vm1"
|
|
content = "172.245.56.83"
|
|
proxied = false
|
|
ttl = 86400
|
|
}
|
|
|
|
# =============================================================================
|
|
# mcintire.me - AAAA records
|
|
# =============================================================================
|
|
|
|
resource "cloudflare_dns_record" "mcintire_me_aaaa_git" {
|
|
zone_id = cloudflare_zone.mcintire_me.id
|
|
type = "AAAA"
|
|
name = "git"
|
|
content = "2604:4500:0009:003d:1c00:bfff:fe00:0464"
|
|
proxied = false
|
|
ttl = 86400
|
|
}
|
|
|
|
resource "cloudflare_dns_record" "mcintire_me_aaaa_hi" {
|
|
zone_id = cloudflare_zone.mcintire_me.id
|
|
type = "AAAA"
|
|
name = "hi"
|
|
content = "2604:4500:0009:003d:1c00:bfff:fe00:0464"
|
|
proxied = false
|
|
ttl = 86400
|
|
}
|
|
|
|
# =============================================================================
|
|
# mcintire.me - MX records
|
|
# =============================================================================
|
|
|
|
resource "cloudflare_dns_record" "mcintire_me_mx_root_primary" {
|
|
zone_id = cloudflare_zone.mcintire_me.id
|
|
type = "MX"
|
|
name = "mcintire.me"
|
|
content = "mail.mcintire.me"
|
|
priority = 10
|
|
ttl = 86400
|
|
}
|
|
|
|
resource "cloudflare_dns_record" "mcintire_me_mx_root_backup" {
|
|
zone_id = cloudflare_zone.mcintire_me.id
|
|
type = "MX"
|
|
name = "mcintire.me"
|
|
content = "mail.nsnw.ca"
|
|
priority = 20
|
|
ttl = 86400
|
|
}
|
|
|
|
# =============================================================================
|
|
# mcintire.me - CNAME records
|
|
# =============================================================================
|
|
|
|
resource "cloudflare_dns_record" "mcintire_me_cname_ha" {
|
|
zone_id = cloudflare_zone.mcintire_me.id
|
|
type = "CNAME"
|
|
name = "ha"
|
|
content = "q1l09qiycnaagngmjsg1qas0rhqcfoou.ui.nabu.casa"
|
|
proxied = false
|
|
ttl = 86400
|
|
}
|
|
|
|
resource "cloudflare_dns_record" "mcintire_me_cname_acme_ha" {
|
|
zone_id = cloudflare_zone.mcintire_me.id
|
|
type = "CNAME"
|
|
name = "_acme-challenge.ha"
|
|
content = "_acme-challenge.q1l09qiycnaagngmjsg1qas0rhqcfoou.ui.nabu.casa"
|
|
proxied = false
|
|
ttl = 86400
|
|
}
|
|
|
|
resource "cloudflare_dns_record" "mcintire_me_cname_autodiscover" {
|
|
zone_id = cloudflare_zone.mcintire_me.id
|
|
type = "CNAME"
|
|
name = "autodiscover"
|
|
content = "mail.w5isp.com"
|
|
proxied = false
|
|
ttl = 86400
|
|
}
|
|
|
|
resource "cloudflare_dns_record" "mcintire_me_cname_autoconfig" {
|
|
zone_id = cloudflare_zone.mcintire_me.id
|
|
type = "CNAME"
|
|
name = "autoconfig"
|
|
content = "mail.w5isp.com"
|
|
proxied = false
|
|
ttl = 86400
|
|
}
|
|
|
|
resource "cloudflare_dns_record" "mcintire_me_cname_em977211" {
|
|
zone_id = cloudflare_zone.mcintire_me.id
|
|
type = "CNAME"
|
|
name = "em977211"
|
|
content = "return.smtp2go.net"
|
|
proxied = false
|
|
ttl = 86400
|
|
}
|
|
|
|
resource "cloudflare_dns_record" "mcintire_me_cname_dkim_s977211" {
|
|
zone_id = cloudflare_zone.mcintire_me.id
|
|
type = "CNAME"
|
|
name = "s977211._domainkey"
|
|
content = "dkim.smtp2go.net"
|
|
proxied = false
|
|
ttl = 86400
|
|
}
|
|
|
|
resource "cloudflare_dns_record" "mcintire_me_cname_link" {
|
|
zone_id = cloudflare_zone.mcintire_me.id
|
|
type = "CNAME"
|
|
name = "link"
|
|
content = "track.smtp2go.net"
|
|
proxied = false
|
|
ttl = 86400
|
|
}
|
|
|
|
# =============================================================================
|
|
# mcintire.me - SRV records
|
|
# =============================================================================
|
|
|
|
resource "cloudflare_dns_record" "mcintire_me_srv_autodiscover" {
|
|
zone_id = cloudflare_zone.mcintire_me.id
|
|
type = "SRV"
|
|
name = "_autodiscover._tcp"
|
|
ttl = 86400
|
|
|
|
data = {
|
|
priority = 0
|
|
weight = 0
|
|
port = 443
|
|
target = "mail.w5isp.com"
|
|
}
|
|
|
|
lifecycle {
|
|
ignore_changes = [priority]
|
|
}
|
|
}
|
|
|
|
# =============================================================================
|
|
# mcintire.me - TXT records
|
|
# =============================================================================
|
|
|
|
resource "cloudflare_dns_record" "mcintire_me_txt_spf" {
|
|
zone_id = cloudflare_zone.mcintire_me.id
|
|
type = "TXT"
|
|
name = "mcintire.me"
|
|
content = "v=spf1 mx a ip4:107.174.178.20 ~all"
|
|
ttl = 86400
|
|
}
|
|
|
|
resource "cloudflare_dns_record" "mcintire_me_txt_dmarc" {
|
|
zone_id = cloudflare_zone.mcintire_me.id
|
|
type = "TXT"
|
|
name = "_dmarc"
|
|
content = "v=DMARC1; p=quarantine; rua=mailto:postmaster@mcintire.me; ruf=mailto:postmaster@mcintire.me; fo=1"
|
|
ttl = 86400
|
|
}
|
|
|
|
resource "cloudflare_dns_record" "mcintire_me_txt_dkim" {
|
|
zone_id = cloudflare_zone.mcintire_me.id
|
|
type = "TXT"
|
|
name = "dkim._domainkey"
|
|
content = "v=DKIM1;k=rsa;t=s;s=email;p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA0rQie7Hz5AmDbVUX+rKNgp6Hf7crtWyfy6qKbqnrxmmernz1rQ6HyOrHhFAlc8nVLNKr8XP2DOROb1jAnrjndZo9I/ymbrrrCBsi9w6zAht2BheijO/R9k5CDRjeSafm6bg0oMKihtNMIdXvEj9ND8hDpZZKxtOrKFH7zLm4CPmm7jf0gqZH2yK+AA3OYUGSYa1OT0LtdMXadk0IVOI2VYf37Hzb3RUvGOYMVkT0xi+23DiyFk7AyCiyv3LQVBMT+/bwyd4k3yVVn2cr9+Nor+HXVjqASLtqcFLMf1SuX0ezSAjBG7BbqQr5G6Jz+n5YglqEIUKVYzJFE7JdDmqQYQIDAQAB"
|
|
ttl = 86400
|
|
}
|
|
|
|
resource "cloudflare_dns_record" "mcintire_me_txt_yahoo_verification" {
|
|
zone_id = cloudflare_zone.mcintire_me.id
|
|
type = "TXT"
|
|
name = "mcintire.me"
|
|
content = "yahoo-verification-key=Pt59XUhQSd7dbVc0x6TQD+mBEtOOTMHFRV1ZG78h4Ug="
|
|
ttl = 86400
|
|
}
|
|
|
|
# =============================================================================
|
|
# mcintire.me - Zone settings
|
|
# =============================================================================
|
|
|
|
resource "cloudflare_zone_setting" "mcintire_me_min_tls_version" {
|
|
zone_id = cloudflare_zone.mcintire_me.id
|
|
setting_id = "min_tls_version"
|
|
value = "1.2"
|
|
}
|
|
|
|
resource "cloudflare_zone_setting" "mcintire_me_always_use_https" {
|
|
zone_id = cloudflare_zone.mcintire_me.id
|
|
setting_id = "always_use_https"
|
|
value = "on"
|
|
}
|
|
|
|
resource "cloudflare_zone_setting" "mcintire_me_tls_1_3" {
|
|
zone_id = cloudflare_zone.mcintire_me.id
|
|
setting_id = "tls_1_3"
|
|
value = "zrt"
|
|
}
|
|
|
|
resource "cloudflare_zone_setting" "mcintire_me_zero_rtt" {
|
|
zone_id = cloudflare_zone.mcintire_me.id
|
|
setting_id = "0rtt"
|
|
value = "on"
|
|
}
|
|
|
|
resource "cloudflare_zone_setting" "mcintire_me_ssl" {
|
|
zone_id = cloudflare_zone.mcintire_me.id
|
|
setting_id = "ssl"
|
|
value = "full"
|
|
}
|
|
|
|
resource "cloudflare_zone_setting" "mcintire_me_security_header" {
|
|
zone_id = cloudflare_zone.mcintire_me.id
|
|
setting_id = "security_header"
|
|
value = {
|
|
strict_transport_security = {
|
|
enabled = true
|
|
max_age = 15552000
|
|
include_subdomains = true
|
|
preload = true
|
|
nosniff = true
|
|
}
|
|
}
|
|
}
|
|
|
|
# =============================================================================
|
|
# mcintire.me - Bot management
|
|
# =============================================================================
|
|
|
|
resource "cloudflare_bot_management" "mcintire_me" {
|
|
zone_id = cloudflare_zone.mcintire_me.id
|
|
is_robots_txt_managed = false
|
|
}
|
|
|
|
# =============================================================================
|
|
# mcintire.me - Firewall
|
|
# =============================================================================
|
|
|
|
resource "cloudflare_ruleset" "mcintire_me_firewall" {
|
|
zone_id = cloudflare_zone.mcintire_me.id
|
|
name = "default"
|
|
kind = "zone"
|
|
phase = "http_request_firewall_custom"
|
|
|
|
rules = [{
|
|
action = "block"
|
|
expression = local.firewall_expression
|
|
description = "block abusers"
|
|
enabled = true
|
|
}]
|
|
}
|