908 lines
26 KiB
HCL
908 lines
26 KiB
HCL
locals {
|
|
cloudflare_account_id = "4d18148a82b0a91f289afbbd2944a603"
|
|
|
|
cloudflare_zones = {
|
|
"aprs.me" = "09da59049b0ecad7b734ce3d902bf581"
|
|
"gridmap.org" = "836f24d97eb51ffc18aa10c0a98efa48"
|
|
"towerops.net" = "c275d35a8885de79ca8e61c17ac97ab6"
|
|
}
|
|
|
|
cloudflare_records = {
|
|
# =========================================================================
|
|
# towerops.net - A records
|
|
# =========================================================================
|
|
"towerops.net-a-dfw-poller" = {
|
|
zone_key = "towerops.net"
|
|
type = "A"
|
|
name = "dfw.poller"
|
|
content = "144.202.64.79"
|
|
proxied = false
|
|
record_id = "aa8183b748f1bf0e3850d9dabb91ee3a"
|
|
}
|
|
"towerops.net-a-lon-poller" = {
|
|
zone_key = "towerops.net"
|
|
type = "A"
|
|
name = "lon.poller"
|
|
content = "45.77.228.168"
|
|
proxied = false
|
|
record_id = "2a25c3ee47284833cea451170d3bd61d"
|
|
}
|
|
"towerops.net-a-staging" = {
|
|
zone_key = "towerops.net"
|
|
type = "A"
|
|
name = "staging"
|
|
content = "204.110.191.231"
|
|
proxied = true
|
|
record_id = "8430e2789d5700c556dc7a598d49d8fd"
|
|
}
|
|
"towerops.net-a-www" = {
|
|
zone_key = "towerops.net"
|
|
type = "A"
|
|
name = "www"
|
|
content = "192.0.2.1"
|
|
proxied = true
|
|
comment = "Created during Cloudflare Rules deployment process for Redirect from WWW to root [Template]"
|
|
record_id = "689c47b0e5ed68427f2c3b9e25bdf602"
|
|
}
|
|
|
|
# =========================================================================
|
|
# towerops.net - AAAA records
|
|
# =========================================================================
|
|
"towerops.net-aaaa-dfw-poller" = {
|
|
zone_key = "towerops.net"
|
|
type = "AAAA"
|
|
name = "dfw.poller"
|
|
content = "2001:19f0:6401:af2:5400:5ff:fee7:1bfb"
|
|
proxied = false
|
|
record_id = "2edc0cf203313e67d64316daf8a0490e"
|
|
}
|
|
"towerops.net-aaaa-lon-poller" = {
|
|
zone_key = "towerops.net"
|
|
type = "AAAA"
|
|
name = "lon.poller"
|
|
content = "2001:19f0:7400:1195:5400:5ff:feee:a0c3"
|
|
proxied = false
|
|
record_id = "610f21b8597a1ce6ad4020f15311787a"
|
|
}
|
|
|
|
# =========================================================================
|
|
# towerops.net - CNAME records
|
|
# =========================================================================
|
|
"towerops.net-cname-root" = {
|
|
zone_key = "towerops.net"
|
|
type = "CNAME"
|
|
name = "towerops.net"
|
|
content = "d3d819ba-925c-4d84-8052-68ed32b686bb.cfargotunnel.com"
|
|
proxied = true
|
|
record_id = "cf1bc4e745466032786db854f4294f99"
|
|
}
|
|
"towerops.net-cname-dev" = {
|
|
zone_key = "towerops.net"
|
|
type = "CNAME"
|
|
name = "dev"
|
|
content = "db59aa44-79de-4522-9593-43e828f3215a.cfargotunnel.com"
|
|
proxied = true
|
|
record_id = "21b470e19493c856ce697052dabc90e5"
|
|
}
|
|
"towerops.net-cname-autoconfig" = {
|
|
zone_key = "towerops.net"
|
|
type = "CNAME"
|
|
name = "autoconfig"
|
|
content = "mail.mcintire.me"
|
|
proxied = false
|
|
record_id = "1c0f59e7bd583f8971f50231e6fad3cf"
|
|
}
|
|
"towerops.net-cname-autodiscover" = {
|
|
zone_key = "towerops.net"
|
|
type = "CNAME"
|
|
name = "autodiscover"
|
|
content = "mail.mcintire.me"
|
|
proxied = false
|
|
record_id = "34a4a9bde8cf4626635cfa3cb5f8c408"
|
|
}
|
|
"towerops.net-cname-dkim-ses-1" = {
|
|
zone_key = "towerops.net"
|
|
type = "CNAME"
|
|
name = "2skkb53ep3vfbkdstfmm2elfthurggid._domainkey"
|
|
content = "2skkb53ep3vfbkdstfmm2elfthurggid.dkim.amazonses.com"
|
|
proxied = false
|
|
record_id = "f4a446531128011a1a6b896010983901"
|
|
}
|
|
"towerops.net-cname-dkim-ses-2" = {
|
|
zone_key = "towerops.net"
|
|
type = "CNAME"
|
|
name = "4uwsaywjpmk35j36pfiz4vr37dyy4v7z._domainkey"
|
|
content = "4uwsaywjpmk35j36pfiz4vr37dyy4v7z.dkim.amazonses.com"
|
|
proxied = false
|
|
record_id = "aefc5c72e25e3656dbccf0fdf2fc6f48"
|
|
}
|
|
"towerops.net-cname-dkim-ses-3" = {
|
|
zone_key = "towerops.net"
|
|
type = "CNAME"
|
|
name = "l7lbifvot6nv3wwho5rs35xzqzzinz5f._domainkey"
|
|
content = "l7lbifvot6nv3wwho5rs35xzqzzinz5f.dkim.amazonses.com"
|
|
proxied = false
|
|
record_id = "02a4cfa316dae29898a8270f2c3aceda"
|
|
}
|
|
|
|
# =========================================================================
|
|
# towerops.net - MX records
|
|
# =========================================================================
|
|
"towerops.net-mx-root-primary" = {
|
|
zone_key = "towerops.net"
|
|
type = "MX"
|
|
name = "towerops.net"
|
|
content = "mail.mcintire.me"
|
|
priority = 10
|
|
record_id = "a5dc7d6dc6d9085132a8fa0b7db1b69a"
|
|
}
|
|
"towerops.net-mx-root-backup" = {
|
|
zone_key = "towerops.net"
|
|
type = "MX"
|
|
name = "towerops.net"
|
|
content = "mail.nsnw.ca"
|
|
priority = 20
|
|
record_id = "bbd552d191e61345f19f8dae10281f9e"
|
|
}
|
|
"towerops.net-mx-mail" = {
|
|
zone_key = "towerops.net"
|
|
type = "MX"
|
|
name = "mail"
|
|
content = "feedback-smtp.us-east-1.amazonses.com"
|
|
priority = 10
|
|
record_id = "a2486e2bbb4d6aca978d28807893e346"
|
|
}
|
|
|
|
# =========================================================================
|
|
# towerops.net - TXT records
|
|
# =========================================================================
|
|
"towerops.net-txt-spf" = {
|
|
zone_key = "towerops.net"
|
|
type = "TXT"
|
|
name = "towerops.net"
|
|
content = "v=spf1 mx a ip4:107.174.178.20 ~all"
|
|
record_id = "cf2f74d345960700a81a6025e7a89642"
|
|
}
|
|
"towerops.net-txt-dmarc" = {
|
|
zone_key = "towerops.net"
|
|
type = "TXT"
|
|
name = "_dmarc"
|
|
content = "v=DMARC1; p=none;"
|
|
record_id = "bd236f9a89fc42f45fd7f4b076478880"
|
|
}
|
|
"towerops.net-txt-dkim" = {
|
|
zone_key = "towerops.net"
|
|
type = "TXT"
|
|
name = "dkim._domainkey"
|
|
content = "v=DKIM1;k=rsa;t=s;s=email;p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAuFm6nd0L7/nAO4m0MPxdjwRAup5C90DPSPa0TQBDT8S2WvASyQUPV8xSbICGMj6FjZYNd5ph/0VK47gDulxQgNQT96IVf2ooTfkvY/80bAyEdtJbpjEUzQnX5YBi/pJigQx2EeCdaojUZumeIdlFlzeb8QQIEtQhVnyc1Xc/Z8ljPMW1H9DXLSDINjV6UTaXX+PZ7jgpRKgU+RnJNcqTAkhhKQ4bMcRfOam/lF6wPOWte1A7ir08TdE8O67ioqygkr/ivAp7xvV4vGOkY6buLLE+c3exY+my2qTCZgJyUMAhkZzYqzGo1csfHH8x+O2XN/k8Z5jPhq8LSvl9XkllKwIDAQAB"
|
|
record_id = "3872e537e8cee4087ead7eb5785e1426"
|
|
}
|
|
"towerops.net-txt-mail-spf" = {
|
|
zone_key = "towerops.net"
|
|
type = "TXT"
|
|
name = "mail"
|
|
content = "v=spf1 include:amazonses.com ~all"
|
|
record_id = "76b8314432391c6630e9e1b2edfce65d"
|
|
}
|
|
}
|
|
}
|
|
|
|
# =============================================================================
|
|
# Zones
|
|
# =============================================================================
|
|
|
|
import {
|
|
for_each = local.cloudflare_zones
|
|
to = cloudflare_zone.zones[each.key]
|
|
id = each.value
|
|
}
|
|
|
|
resource "cloudflare_zone" "zones" {
|
|
for_each = local.cloudflare_zones
|
|
|
|
account_id = local.cloudflare_account_id
|
|
zone = each.key
|
|
}
|
|
|
|
# =============================================================================
|
|
# DNS Records (A, AAAA, CNAME, MX, TXT)
|
|
# =============================================================================
|
|
|
|
import {
|
|
for_each = local.cloudflare_records
|
|
to = cloudflare_record.records[each.key]
|
|
id = "${local.cloudflare_zones[each.value.zone_key]}/${each.value.record_id}"
|
|
}
|
|
|
|
resource "cloudflare_record" "records" {
|
|
for_each = local.cloudflare_records
|
|
|
|
zone_id = cloudflare_zone.zones[each.value.zone_key].id
|
|
type = each.value.type
|
|
name = each.value.name
|
|
content = each.value.content
|
|
proxied = lookup(each.value, "proxied", false)
|
|
ttl = lookup(each.value, "ttl", lookup(each.value, "proxied", false) ? 1 : 86400)
|
|
priority = lookup(each.value, "priority", null)
|
|
comment = lookup(each.value, "comment", null)
|
|
}
|
|
|
|
# =============================================================================
|
|
# DNS Records - aprs.me tunnel CNAME
|
|
# =============================================================================
|
|
|
|
resource "cloudflare_record" "aprs_me_tunnel" {
|
|
zone_id = cloudflare_zone.zones["aprs.me"].id
|
|
type = "CNAME"
|
|
name = "aprs.me"
|
|
content = "d3d819ba-925c-4d84-8052-68ed32b686bb.cfargotunnel.com"
|
|
proxied = true
|
|
}
|
|
|
|
# aprs.me - Resend email (DKIM, SPF, DMARC, MX)
|
|
resource "cloudflare_record" "aprs_me_dkim_resend" {
|
|
zone_id = cloudflare_zone.zones["aprs.me"].id
|
|
type = "TXT"
|
|
name = "resend._domainkey"
|
|
content = "p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCrIhTzL7qrNSdbVOWG2WVwXpKrRrkHY4w/giB7JGl9Hj23z1qIQNh8aNyvDaC0Eosf1013TSWvS+bFMETc5kQZ6lQDq6pvZxHeKbAGH1FvUDVQ2uhjV77Qopf95SdoDKsod3hRnfn4kNZBQ2GfrbJmqobIsQRT8IHFA3XOjOn/jwIDAQAB"
|
|
ttl = 86400
|
|
}
|
|
|
|
resource "cloudflare_record" "aprs_me_mx_send" {
|
|
zone_id = cloudflare_zone.zones["aprs.me"].id
|
|
type = "MX"
|
|
name = "send"
|
|
content = "feedback-smtp.us-east-1.amazonses.com"
|
|
priority = 10
|
|
ttl = 86400
|
|
}
|
|
|
|
resource "cloudflare_record" "aprs_me_spf_send" {
|
|
zone_id = cloudflare_zone.zones["aprs.me"].id
|
|
type = "TXT"
|
|
name = "send"
|
|
content = "v=spf1 include:amazonses.com ~all"
|
|
ttl = 86400
|
|
}
|
|
|
|
resource "cloudflare_record" "aprs_me_dmarc" {
|
|
zone_id = cloudflare_zone.zones["aprs.me"].id
|
|
type = "TXT"
|
|
name = "_dmarc"
|
|
content = "v=DMARC1; p=none;"
|
|
ttl = 86400
|
|
}
|
|
|
|
resource "cloudflare_record" "aprs_me_txt_yahoo_verification" {
|
|
zone_id = cloudflare_zone.zones["aprs.me"].id
|
|
type = "TXT"
|
|
name = "aprs.me"
|
|
content = "yahoo-verification-key=FTNt+pQ6IU4l0gQZKNUu3jbVXAgUG/yzm4KVwDzahbE="
|
|
ttl = 86400
|
|
}
|
|
|
|
resource "cloudflare_record" "towerops_txt_yahoo_verification" {
|
|
zone_id = cloudflare_zone.zones["towerops.net"].id
|
|
type = "TXT"
|
|
name = "towerops.net"
|
|
content = "yahoo-verification-key=BWUc1N9CUklaviQyfIGHDwF35WGx3Dcvrag/JCZzyKM="
|
|
ttl = 86400
|
|
}
|
|
|
|
resource "cloudflare_record" "gridmap_org_tunnel" {
|
|
zone_id = cloudflare_zone.zones["gridmap.org"].id
|
|
type = "CNAME"
|
|
name = "gridmap.org"
|
|
content = "d3d819ba-925c-4d84-8052-68ed32b686bb.cfargotunnel.com"
|
|
proxied = true
|
|
}
|
|
|
|
# =============================================================================
|
|
# DNS Records (CAA) - restrict certificate issuance to Cloudflare CAs
|
|
# =============================================================================
|
|
|
|
locals {
|
|
cloudflare_cas = ["letsencrypt.org", "pki.goog", "ssl.com", "sectigo.com"]
|
|
caa_zones = ["aprs.me", "gridmap.org"]
|
|
caa_records = merge([
|
|
for zone in local.caa_zones : {
|
|
for ca in local.cloudflare_cas : "${zone}-${ca}" => {
|
|
zone = zone
|
|
ca = ca
|
|
}
|
|
}
|
|
]...)
|
|
}
|
|
|
|
resource "cloudflare_record" "caa" {
|
|
for_each = local.caa_records
|
|
|
|
zone_id = cloudflare_zone.zones[each.value.zone].id
|
|
type = "CAA"
|
|
name = each.value.zone
|
|
ttl = 86400
|
|
|
|
data {
|
|
flags = "0"
|
|
tag = "issue"
|
|
value = each.value.ca
|
|
}
|
|
}
|
|
|
|
# =============================================================================
|
|
# DNS Records (SRV) - separate due to data block
|
|
# =============================================================================
|
|
|
|
import {
|
|
to = cloudflare_record.towerops_srv_autodiscover
|
|
id = "${local.cloudflare_zones["towerops.net"]}/26db78978535d1d630432970b9a4e279"
|
|
}
|
|
|
|
resource "cloudflare_record" "towerops_srv_autodiscover" {
|
|
zone_id = cloudflare_zone.zones["towerops.net"].id
|
|
type = "SRV"
|
|
name = "_autodiscover._tcp"
|
|
ttl = 86400
|
|
|
|
data {
|
|
priority = 0
|
|
weight = 0
|
|
port = 443
|
|
target = "mail.mcintire.me"
|
|
}
|
|
}
|
|
|
|
# =============================================================================
|
|
# Zone Settings
|
|
#
|
|
# Zone security settings: TLS hardening and HSTS
|
|
# =============================================================================
|
|
resource "cloudflare_zone_settings_override" "aprs_me" {
|
|
zone_id = cloudflare_zone.zones["aprs.me"].id
|
|
|
|
settings {
|
|
min_tls_version = "1.2"
|
|
always_use_https = "on"
|
|
tls_1_3 = "zrt"
|
|
zero_rtt = "on"
|
|
ssl = "strict"
|
|
|
|
security_header {
|
|
enabled = true
|
|
max_age = 15552000
|
|
include_subdomains = true
|
|
preload = true
|
|
nosniff = true
|
|
}
|
|
}
|
|
}
|
|
|
|
resource "cloudflare_zone_settings_override" "towerops_net" {
|
|
zone_id = cloudflare_zone.zones["towerops.net"].id
|
|
|
|
settings {
|
|
min_tls_version = "1.2"
|
|
always_use_https = "on"
|
|
tls_1_3 = "zrt"
|
|
zero_rtt = "on"
|
|
ssl = "full"
|
|
|
|
security_header {
|
|
enabled = true
|
|
max_age = 15552000
|
|
include_subdomains = true
|
|
preload = true
|
|
nosniff = true
|
|
}
|
|
}
|
|
}
|
|
|
|
resource "cloudflare_zone_settings_override" "gridmap_org" {
|
|
zone_id = cloudflare_zone.zones["gridmap.org"].id
|
|
|
|
settings {
|
|
min_tls_version = "1.2"
|
|
always_use_https = "on"
|
|
tls_1_3 = "zrt"
|
|
zero_rtt = "on"
|
|
ssl = "strict"
|
|
|
|
security_header {
|
|
enabled = true
|
|
max_age = 15552000
|
|
include_subdomains = true
|
|
preload = true
|
|
nosniff = true
|
|
}
|
|
}
|
|
}
|
|
# =============================================================================
|
|
# Firewall - custom rules (applied to all zones)
|
|
# =============================================================================
|
|
|
|
locals {
|
|
firewall_expression = join(" or ", [
|
|
"(ip.src.country in {\"KP\" \"RU\" \"CN\" \"SY\" \"MM\" \"VE\" \"IQ\" \"LY\" \"SO\" \"YE\" \"SS\"})",
|
|
"(http.request.uri.path contains \".php\")",
|
|
"(http.request.uri.path contains \"/wp-content\")",
|
|
"(http.request.uri.path contains \"/wp-login\")",
|
|
"(http.request.uri.path contains \"/wp-admin\")",
|
|
"(http.request.uri.path contains \"/wp-includes\")",
|
|
"(http.request.uri.path contains \"/xmlrpc.php\")",
|
|
"(http.request.uri.path contains \"wlwmanifest.xml\")",
|
|
"(http.request.uri.path contains \"/.env\")",
|
|
"(http.request.uri.path contains \"/.git\")",
|
|
"(http.request.uri.path contains \"/phpmyadmin\")",
|
|
"(http.request.uri.path contains \"/cgi-bin\")",
|
|
"(not http.user_agent ne \"\")",
|
|
])
|
|
}
|
|
|
|
import {
|
|
to = cloudflare_ruleset.towerops_firewall
|
|
id = "zone/${local.cloudflare_zones["towerops.net"]}/3c209e50f21b40388733a7cfe8f62f4e"
|
|
}
|
|
|
|
resource "cloudflare_ruleset" "towerops_firewall" {
|
|
zone_id = cloudflare_zone.zones["towerops.net"].id
|
|
name = "default"
|
|
kind = "zone"
|
|
phase = "http_request_firewall_custom"
|
|
|
|
# Allow agent WebSocket connections (must come before block rules)
|
|
rules {
|
|
action = "skip"
|
|
action_parameters {
|
|
ruleset = "current"
|
|
}
|
|
expression = "(http.request.uri.path eq \"/socket/agent/websocket\")"
|
|
description = "allow agent websocket connections"
|
|
enabled = true
|
|
logging {
|
|
enabled = false
|
|
}
|
|
}
|
|
|
|
rules {
|
|
action = "block"
|
|
expression = local.firewall_expression
|
|
description = "block abusers"
|
|
enabled = true
|
|
}
|
|
}
|
|
|
|
import {
|
|
to = cloudflare_ruleset.gridmap_firewall
|
|
id = "zone/${local.cloudflare_zones["gridmap.org"]}/7dfc79c24a22439ea501865479822df8"
|
|
}
|
|
|
|
resource "cloudflare_ruleset" "gridmap_firewall" {
|
|
zone_id = cloudflare_zone.zones["gridmap.org"].id
|
|
name = "default"
|
|
kind = "zone"
|
|
phase = "http_request_firewall_custom"
|
|
|
|
rules {
|
|
action = "block"
|
|
expression = local.firewall_expression
|
|
description = "block abusers"
|
|
enabled = true
|
|
}
|
|
}
|
|
|
|
resource "cloudflare_ruleset" "aprs_me_firewall" {
|
|
zone_id = cloudflare_zone.zones["aprs.me"].id
|
|
name = "default"
|
|
kind = "zone"
|
|
phase = "http_request_firewall_custom"
|
|
|
|
rules {
|
|
action = "block"
|
|
expression = local.firewall_expression
|
|
description = "block abusers"
|
|
enabled = true
|
|
}
|
|
}
|
|
|
|
# =============================================================================
|
|
# Tunnel Configs
|
|
#
|
|
# Tunnel resources themselves are not managed here because the tunnel secrets
|
|
# are not recoverable from the API. The tunnels were created via the dashboard:
|
|
# - towerops: d3d819ba-925c-4d84-8052-68ed32b686bb (healthy)
|
|
# - towerops-dev: db59aa44-79de-4522-9593-43e828f3215a (down)
|
|
# =============================================================================
|
|
|
|
import {
|
|
to = cloudflare_zero_trust_tunnel_cloudflared_config.towerops
|
|
id = "${local.cloudflare_account_id}/d3d819ba-925c-4d84-8052-68ed32b686bb"
|
|
}
|
|
|
|
resource "cloudflare_zero_trust_tunnel_cloudflared_config" "towerops" {
|
|
account_id = local.cloudflare_account_id
|
|
tunnel_id = "d3d819ba-925c-4d84-8052-68ed32b686bb"
|
|
|
|
config {
|
|
ingress_rule {
|
|
hostname = "aprs.me"
|
|
service = "http://aprs.aprs.svc.cluster.local:4000"
|
|
}
|
|
ingress_rule {
|
|
hostname = "gridmap.org"
|
|
service = "http://gridmap.gridmap.svc.cluster.local:4000"
|
|
}
|
|
ingress_rule {
|
|
hostname = "towerops.net"
|
|
service = "http://towerops.towerops.svc.cluster.local:4000"
|
|
}
|
|
ingress_rule {
|
|
hostname = "prop.w5isp.com"
|
|
service = "http://prop.prop.svc.cluster.local:5000"
|
|
}
|
|
ingress_rule {
|
|
service = "http_status:404"
|
|
}
|
|
}
|
|
}
|
|
|
|
import {
|
|
to = cloudflare_zero_trust_tunnel_cloudflared_config.towerops_dev
|
|
id = "${local.cloudflare_account_id}/db59aa44-79de-4522-9593-43e828f3215a"
|
|
}
|
|
|
|
# =============================================================================
|
|
# w5isp.com Zone
|
|
# =============================================================================
|
|
|
|
resource "cloudflare_zone" "w5isp_com" {
|
|
account_id = local.cloudflare_account_id
|
|
zone = "w5isp.com"
|
|
}
|
|
|
|
# =============================================================================
|
|
# w5isp.com - A records
|
|
# =============================================================================
|
|
|
|
resource "cloudflare_record" "w5isp_a_root" {
|
|
zone_id = cloudflare_zone.w5isp_com.id
|
|
type = "A"
|
|
name = "w5isp.com"
|
|
content = "204.110.191.8"
|
|
proxied = false
|
|
ttl = 86400
|
|
}
|
|
|
|
resource "cloudflare_record" "w5isp_a_home" {
|
|
zone_id = cloudflare_zone.w5isp_com.id
|
|
type = "A"
|
|
name = "home"
|
|
content = "204.110.191.1"
|
|
proxied = false
|
|
ttl = 86400
|
|
}
|
|
|
|
resource "cloudflare_record" "w5isp_a_photos" {
|
|
zone_id = cloudflare_zone.w5isp_com.id
|
|
type = "A"
|
|
name = "photos"
|
|
content = "204.110.191.8"
|
|
proxied = false
|
|
ttl = 86400
|
|
}
|
|
|
|
resource "cloudflare_record" "w5isp_a_skippy" {
|
|
zone_id = cloudflare_zone.w5isp_com.id
|
|
type = "A"
|
|
name = "skippy"
|
|
content = "204.110.191.8"
|
|
proxied = false
|
|
ttl = 86400
|
|
}
|
|
|
|
resource "cloudflare_record" "w5isp_a_mail" {
|
|
zone_id = cloudflare_zone.w5isp_com.id
|
|
type = "A"
|
|
name = "mail"
|
|
content = "107.174.178.20"
|
|
proxied = false
|
|
ttl = 86400
|
|
}
|
|
|
|
resource "cloudflare_record" "w5isp_a_dokku" {
|
|
zone_id = cloudflare_zone.w5isp_com.id
|
|
type = "A"
|
|
name = "dokku"
|
|
content = "204.110.191.218"
|
|
proxied = false
|
|
ttl = 86400
|
|
}
|
|
|
|
resource "cloudflare_record" "w5isp_a_feedback" {
|
|
zone_id = cloudflare_zone.w5isp_com.id
|
|
type = "A"
|
|
name = "feedback"
|
|
content = "204.110.191.8"
|
|
proxied = false
|
|
ttl = 86400
|
|
}
|
|
|
|
resource "cloudflare_record" "w5isp_a_vm1" {
|
|
zone_id = cloudflare_zone.w5isp_com.id
|
|
type = "A"
|
|
name = "vm1"
|
|
content = "172.245.56.83"
|
|
proxied = false
|
|
ttl = 86400
|
|
}
|
|
|
|
resource "cloudflare_record" "w5isp_a_log" {
|
|
zone_id = cloudflare_zone.w5isp_com.id
|
|
type = "A"
|
|
name = "log"
|
|
content = "204.110.191.8"
|
|
proxied = false
|
|
ttl = 86400
|
|
}
|
|
|
|
resource "cloudflare_record" "w5isp_a_vaprs" {
|
|
zone_id = cloudflare_zone.w5isp_com.id
|
|
type = "A"
|
|
name = "vaprs"
|
|
content = "204.110.191.8"
|
|
proxied = false
|
|
ttl = 86400
|
|
}
|
|
|
|
resource "cloudflare_record" "w5isp_a_srtm" {
|
|
zone_id = cloudflare_zone.w5isp_com.id
|
|
type = "A"
|
|
name = "srtm"
|
|
content = "204.110.191.8"
|
|
proxied = false
|
|
ttl = 86400
|
|
}
|
|
|
|
resource "cloudflare_record" "w5isp_a_aprs" {
|
|
zone_id = cloudflare_zone.w5isp_com.id
|
|
type = "A"
|
|
name = "aprs"
|
|
content = "204.110.191.232"
|
|
proxied = false
|
|
ttl = 86400
|
|
}
|
|
|
|
resource "cloudflare_record" "w5isp_cname_prop" {
|
|
zone_id = cloudflare_zone.w5isp_com.id
|
|
type = "CNAME"
|
|
name = "prop"
|
|
content = "d3d819ba-925c-4d84-8052-68ed32b686bb.cfargotunnel.com"
|
|
proxied = true
|
|
}
|
|
|
|
# =============================================================================
|
|
# w5isp.com - MX records
|
|
# =============================================================================
|
|
|
|
resource "cloudflare_record" "w5isp_mx_root" {
|
|
zone_id = cloudflare_zone.w5isp_com.id
|
|
type = "MX"
|
|
name = "w5isp.com"
|
|
content = "mail.w5isp.com"
|
|
priority = 10
|
|
ttl = 86400
|
|
}
|
|
|
|
# =============================================================================
|
|
# w5isp.com - CNAME records
|
|
# =============================================================================
|
|
|
|
resource "cloudflare_record" "w5isp_cname_autodiscover" {
|
|
zone_id = cloudflare_zone.w5isp_com.id
|
|
type = "CNAME"
|
|
name = "autodiscover"
|
|
content = "mail.w5isp.com"
|
|
proxied = false
|
|
ttl = 86400
|
|
}
|
|
|
|
resource "cloudflare_record" "w5isp_cname_autoconfig" {
|
|
zone_id = cloudflare_zone.w5isp_com.id
|
|
type = "CNAME"
|
|
name = "autoconfig"
|
|
content = "mail.w5isp.com"
|
|
proxied = false
|
|
ttl = 86400
|
|
}
|
|
|
|
resource "cloudflare_record" "w5isp_cname_em40" {
|
|
zone_id = cloudflare_zone.w5isp_com.id
|
|
type = "CNAME"
|
|
name = "em40"
|
|
content = "u177982.wl233.sendgrid.net"
|
|
proxied = false
|
|
ttl = 86400
|
|
}
|
|
|
|
resource "cloudflare_record" "w5isp_cname_dkim_s1" {
|
|
zone_id = cloudflare_zone.w5isp_com.id
|
|
type = "CNAME"
|
|
name = "s1._domainkey"
|
|
content = "s1.domainkey.u177982.wl233.sendgrid.net"
|
|
proxied = false
|
|
ttl = 86400
|
|
}
|
|
|
|
resource "cloudflare_record" "w5isp_cname_dkim_s2" {
|
|
zone_id = cloudflare_zone.w5isp_com.id
|
|
type = "CNAME"
|
|
name = "s2._domainkey"
|
|
content = "s2.domainkey.u177982.wl233.sendgrid.net"
|
|
proxied = false
|
|
ttl = 86400
|
|
}
|
|
|
|
resource "cloudflare_record" "w5isp_cname_uptime" {
|
|
zone_id = cloudflare_zone.w5isp_com.id
|
|
type = "CNAME"
|
|
name = "uptime"
|
|
content = "stats.uptimerobot.com"
|
|
proxied = false
|
|
ttl = 86400
|
|
}
|
|
|
|
resource "cloudflare_record" "w5isp_cname_em977211" {
|
|
zone_id = cloudflare_zone.w5isp_com.id
|
|
type = "CNAME"
|
|
name = "em977211"
|
|
content = "return.smtp2go.net"
|
|
proxied = false
|
|
ttl = 86400
|
|
}
|
|
|
|
resource "cloudflare_record" "w5isp_cname_dkim_s977211" {
|
|
zone_id = cloudflare_zone.w5isp_com.id
|
|
type = "CNAME"
|
|
name = "s977211._domainkey"
|
|
content = "dkim.smtp2go.net"
|
|
proxied = false
|
|
ttl = 86400
|
|
}
|
|
|
|
resource "cloudflare_record" "w5isp_cname_link" {
|
|
zone_id = cloudflare_zone.w5isp_com.id
|
|
type = "CNAME"
|
|
name = "link"
|
|
content = "track.smtp2go.net"
|
|
proxied = false
|
|
ttl = 86400
|
|
}
|
|
|
|
# =============================================================================
|
|
# w5isp.com - TXT records
|
|
# =============================================================================
|
|
|
|
resource "cloudflare_record" "w5isp_txt_spf" {
|
|
zone_id = cloudflare_zone.w5isp_com.id
|
|
type = "TXT"
|
|
name = "w5isp.com"
|
|
content = "v=spf1 mx a ip4:107.174.178.20 ~all"
|
|
ttl = 86400
|
|
}
|
|
|
|
resource "cloudflare_record" "w5isp_txt_dkim" {
|
|
zone_id = cloudflare_zone.w5isp_com.id
|
|
type = "TXT"
|
|
name = "dkim._domainkey"
|
|
content = "v=DKIM1;k=rsa;t=s;s=email;p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAxti2t8TvzIqKF9BpKn3rQExKg3sS1SyQuwtQgL0r/ELEJ0D9cKU/iM+eB1ROJctKHoMqKDJoRCMP6eibFcgq2kLKqf+aceEOIBx2OK2WCXML+CNqQZA6yO+A8/Jq7iFZPq8D5FmOoxbwRZkso7CkSennSz/+F7nBPI/OfyEiiI4xJzWH3t8SaAkkcy46O+1K0iCkTpsthon7E2PHa3SPkrjbep/5NImTJLK5LuffiLJtLsiK+73mvsAYCDmrNxPTaDjXkj0TWdKl/d/TnlVJl+YloqWIDt/7LtZQM0C7GZ9flIr7z9hHpSWERXAA5Gj5NQ0/hcY3nF4dPoqWs3VeeQIDAQAB"
|
|
ttl = 86400
|
|
}
|
|
|
|
resource "cloudflare_record" "w5isp_txt_dmarc" {
|
|
zone_id = cloudflare_zone.w5isp_com.id
|
|
type = "TXT"
|
|
name = "_dmarc"
|
|
content = "v=DMARC1; p=quarantine; rua=mailto:postmaster@w5isp.com; ruf=mailto:postmaster@w5isp.com; fo=1"
|
|
ttl = 86400
|
|
}
|
|
|
|
resource "cloudflare_record" "w5isp_txt_yahoo_verification" {
|
|
zone_id = cloudflare_zone.w5isp_com.id
|
|
type = "TXT"
|
|
name = "w5isp.com"
|
|
content = "yahoo-verification-key=CX5h64q8On4rlR/1/DCyvASxTv3rlDmDcNQhwSapyk4="
|
|
ttl = 86400
|
|
}
|
|
|
|
# =============================================================================
|
|
# w5isp.com - SRV records
|
|
# =============================================================================
|
|
|
|
resource "cloudflare_record" "w5isp_srv_autodiscover" {
|
|
zone_id = cloudflare_zone.w5isp_com.id
|
|
type = "SRV"
|
|
name = "_autodiscover._tcp"
|
|
ttl = 86400
|
|
|
|
data {
|
|
priority = 0
|
|
weight = 0
|
|
port = 443
|
|
target = "mail.w5isp.com"
|
|
}
|
|
}
|
|
|
|
# =============================================================================
|
|
# w5isp.com - Zone settings
|
|
# =============================================================================
|
|
|
|
resource "cloudflare_zone_settings_override" "w5isp_com" {
|
|
zone_id = cloudflare_zone.w5isp_com.id
|
|
|
|
settings {
|
|
min_tls_version = "1.2"
|
|
always_use_https = "on"
|
|
tls_1_3 = "zrt"
|
|
zero_rtt = "on"
|
|
ssl = "full"
|
|
|
|
security_header {
|
|
enabled = true
|
|
max_age = 15552000
|
|
include_subdomains = true
|
|
preload = true
|
|
nosniff = true
|
|
}
|
|
}
|
|
}
|
|
|
|
# =============================================================================
|
|
# w5isp.com - Firewall
|
|
# =============================================================================
|
|
|
|
resource "cloudflare_ruleset" "w5isp_firewall" {
|
|
zone_id = cloudflare_zone.w5isp_com.id
|
|
name = "default"
|
|
kind = "zone"
|
|
phase = "http_request_firewall_custom"
|
|
|
|
rules {
|
|
action = "block"
|
|
expression = local.firewall_expression
|
|
description = "block abusers"
|
|
enabled = true
|
|
}
|
|
}
|
|
|
|
# =============================================================================
|
|
# w5isp.com - CAA records
|
|
# =============================================================================
|
|
|
|
resource "cloudflare_record" "w5isp_caa" {
|
|
for_each = toset(local.cloudflare_cas)
|
|
|
|
zone_id = cloudflare_zone.w5isp_com.id
|
|
type = "CAA"
|
|
name = "w5isp.com"
|
|
ttl = 86400
|
|
|
|
data {
|
|
flags = "0"
|
|
tag = "issue"
|
|
value = each.value
|
|
}
|
|
}
|
|
|
|
resource "cloudflare_zero_trust_tunnel_cloudflared_config" "towerops_dev" {
|
|
account_id = local.cloudflare_account_id
|
|
tunnel_id = "db59aa44-79de-4522-9593-43e828f3215a"
|
|
|
|
config {
|
|
ingress_rule {
|
|
hostname = "dev.towerops.net"
|
|
service = "http://localhost:4000"
|
|
}
|
|
ingress_rule {
|
|
service = "http_status:404"
|
|
}
|
|
}
|
|
}
|