migrated to linode dns

tf/monotremata-xyz.tf

@@ -1,66 +1,20 @@
-// Important:
+# todo:
-// Due to API restrictions, SRV and Dynamic DNS Records can't be created with
+# I am also creating the subdomain `wg.monotremata.xyz` manually
-// terraform, so I need to use `MERGE` mode and set those manually on the
+# I decided to manage that subdomain outside of terraform because it has a
-// namecheap web UI
+# dynamic IP that I update with a cron job
-// https://registry.terraform.io/providers/namecheap/namecheap/latest/docs
-//
-// - SRV Record:
-//     service: _matrix
-//     protocol: _tcp
-//     priority: 0
-//     weight: 10
-//     port: 443
-//     target: matrix.monotremata.xyz
-//     TTL: 30 min
-//
-// - SRV Record:
-//     service: _xmpp-client
-//     protocol: _tcp
-//     priority: 5
-//     weight: 0
-//     port: 5222
-//     target: xmpp.monotremata.xyz
-//     TTL: 30 min
-//
-// - SRV Record:
-//     service: _xmpp-server
-//     protocol: _tcp
-//     priority: 5
-//     weight: 0
-//     port: 5269
-//     target: xmpp.monotremata.xyz
-//     TTL: 30 min
-//
-// - A + Dynamic DNS Record:
-//     host: wg
-//
-//  I also enable DNSSEC from the web UI, because I can't do that with
-//  terraform...
 
+locals {
+  domain = "monotremata.xyz"
 
-
-variable "hosts" {
-  default = {
   // Alpine VPS hosted on Linode
   caladan = {
-      v4 = "139.162.137.29"
+    ipv4 = "139.162.137.29"
-      v6 = "2a01:7e01::f03c:92ff:fea2:5d7c"
+    ipv6 = "2a01:7e01::f03c:92ff:fea2:5d7c"
-    }
-    // OpenBSD VPS hosted on Vultr
-    fugu = {
-      v4 = "217.69.5.52"
-      v6 = "2001:19f0:6801:1d34:5400:03ff:fe18:7588"
-    }
-  }
-}
-
     // These are subdomains for services hosted on the host named `caladan`.
     // Both A and AAAA records should be made for them pointing to caladan's ipv4
     // and ipv6 respectively
-variable "caladan-subdomains" {
+    domains = toset([
-  type = set(string)
+      local.domain,
-  default = [
-    "@",
       "git",
       "gts",
       "kb",
@@ -73,17 +27,23 @@ variable "caladan-subdomains" {
       "proxy.xmpp",
       "upload.xmpp",
       "groups.xmpp",
-  ]
+    ])
   }
 
+  // OpenBSD VPS hosted on Vultr
+  fugu = {
+    ipv4 = "217.69.5.52"
+    ipv6 = "2001:19f0:6801:1d34:5400:03ff:fe18:7588"
+  }
+
+  // ODROID-HC4 serving as a NAS
+  narwhal = {
     // These are subdomains for services hosted on the host named `narwhal`.
     // They are only accessible from my internal network and my internal DNS server
     // takes care of that.
     // But I set the public A record to caladan's ipv4 just for renewing their
     // letsencrypt certificates. No need to set the AAAA record.
-variable "narwhal-subdomains" {
+    domains = toset([
-  type = set(string)
-  default = [
       "authelia",
       "calibre",
       "dav",
@@ -111,106 +71,176 @@ variable "narwhal-subdomains" {
       "transmission",
       "wallabag",
       "woodpecker",
-  ]
+    ])
   }
 
+  // Raspberry Pi 4 serving as a media center
+  sloth = {
     // These are subdomains for services hosted on the host named `sloth`.
     // They are only accessible from my internal network and my internal DNS server
     // takes care of that.
     // But I set the public A record to caladan's ipv4 just for renewing their
     // letsencrypt certificates. No need to set the AAAA record.
-variable "sloth-subdomains" {
+    domains = toset([
-  type = set(string)
-  default = [
       "kodi",
       "mympd",
       "snapweb",
+    ])
+  }
+
+  dkim_pub_key = "MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC3dRTQXNdRNKjM/hnTIQ9d6h4qr7hDkoo3D8ySrV4tEcOC9cCD5fWiUzc560GuWPW5nm/VCDt6gHTGbkwsU/ULO+mjKJtvhZtEJnO4WqVG9Hr2whypODkGM9FSwh0yaWV96OJd51upsNRD/S5fKDMRcl09aBYe2rsn/877re/M0wIDAQAB"
+
+}
+
+resource "namecheap_domain_records" "namecheap-monotremata-xyz" {
+  domain = "monotremata.xyz"
+  mode   = "OVERWRITE"
+  nameservers = [
+    "ns1.linode.com",
+    "ns2.linode.com",
+    "ns3.linode.com",
+    "ns4.linode.com",
+    "ns5.linode.com"
   ]
 }
 
-resource "namecheap_domain_records" "monotremata-xyz" {
+resource "linode_domain" "monotremata_xyz" {
-  domain     = "monotremata.xyz"
+  type      = "master"
-  mode       = "MERGE"
+  domain    = local.domain
-  email_type = "MX"
+  soa_email = format("admin@%s", local.domain)
+}
 
-  dynamic "record" {
+resource "linode_domain_record" "caladan_a" {
-    for_each = var.caladan-subdomains
+  domain_id   = linode_domain.monotremata_xyz.id
-    content {
+  name        = each.key
-      hostname = record.value
+  record_type = "A"
-      type     = "A"
+  target      = local.caladan.ipv4
-      address  = var.hosts.caladan.v4
+  for_each    = local.caladan.domains
+}
+
+resource "linode_domain_record" "caladan_aaaa" {
+  domain_id   = linode_domain.monotremata_xyz.id
+  name        = each.key
+  record_type = "AAAA"
+  target      = local.caladan.ipv6
+  for_each    = local.caladan.domains
+}
+
+resource "linode_domain_record" "narwhal_a" {
+  domain_id   = linode_domain.monotremata_xyz.id
+  name        = each.key
+  record_type = "A"
+  target      = local.caladan.ipv4
+  for_each    = local.narwhal.domains
+}
+
+resource "linode_domain_record" "sloth_a" {
+  domain_id   = linode_domain.monotremata_xyz.id
+  name        = each.key
+  record_type = "A"
+  target      = local.caladan.ipv4
+  for_each    = local.sloth.domains
+}
+
+resource "linode_domain_record" "mx" {
+  domain_id   = linode_domain.monotremata_xyz.id
+  name        = each.value.name
+  target      = each.value.target
+  record_type = each.key
+  priority    = each.value.priority
+  for_each = {
+    A = {
+      name     = "mail"
+      target   = local.fugu.ipv4
+      priority = null
+    }
+    AAAA = {
+      name     = "mail"
+      target   = local.fugu.ipv6
+      priority = null
+    }
+    MX = {
+      name     = local.domain,
+      target   = format("mail.%s", local.domain)
+      priority = 0
+    }
   }
 }
 
-  dynamic "record" {
+resource "linode_domain_record" "mx2" {
-    for_each = var.narwhal-subdomains
+  domain_id   = linode_domain.monotremata_xyz.id
-    content {
+  name        = each.value.name
-      hostname = record.value
+  target      = each.value.target
-      type     = "A"
+  record_type = each.key
-      address  = var.hosts.caladan.v4
+  priority    = each.value.priority
+  for_each = {
+    A = {
+      name     = "mx2"
+      target   = local.caladan.ipv4
+      priority = null
+    }
+    AAAA = {
+      name     = "mx2"
+      target   = local.caladan.ipv6
+      priority = null
+    }
+    MX = {
+      name     = local.domain
+      target   = format("mx2.%s", local.domain)
+      priority = 5
+    }
   }
 }
 
-  dynamic "record" {
+resource "linode_domain_record" "mail_txt" {
-    for_each = var.sloth-subdomains
+  domain_id   = linode_domain.monotremata_xyz.id
-    content {
+  record_type = "TXT"
-      hostname = record.value
+  name        = each.value.name
-      type     = "A"
+  target      = each.value.target
-      address  = var.hosts.caladan.v4
+  for_each = {
+    spf = {
+      name   = local.domain
+      target = "v=spf1 mx -all"
+    }
+    dmarc = {
+      name   = "_dmarc"
+      target = format("v=DMARC1;p=quarantine;pct=100;rua=mailto:postmaster@%s;;", local.domain)
+    }
+    dkim = {
+      name   = "20201210._domainkey"
+      target = format("v=DKIM1;k=rsa;p=%s;", local.dkim_pub_key)
+    }
   }
 }
 
-  dynamic "record" {
+resource "linode_domain_record" "matrix_srv" {
-    for_each = var.caladan-subdomains
+  domain_id   = linode_domain.monotremata_xyz.id
-    content {
+  record_type = "SRV"
-      hostname = record.value
+  service     = "matrix"
-      type     = "AAAA"
+  protocol    = "tcp"
-      address  = var.hosts.caladan.v6
+  priority    = 0
-    }
+  weight      = 10
+  port        = 443
+  target      = format("matrix.%s", local.domain)
+  ttl_sec     = 1800 // 30 min
 }
 
-  record {
+resource "linode_domain_record" "xmpp_srv" {
-    hostname = "mail"
+  domain_id   = linode_domain.monotremata_xyz.id
-    type     = "A"
+  record_type = "SRV"
-    address  = var.hosts.fugu.v4
+  service     = each.key
+  protocol    = "tcp"
+  port        = each.value.port
+  priority    = 5
+  weight      = 0
+  target      = format("xmpp.%s", local.domain)
+  ttl_sec     = 1800 // 30 min
+  for_each = {
+    xmpp-client = {
+      port = 5222
     }
-
+    xmpp-server = {
-  record {
+      port = 5269
-    hostname = "mail"
-    type     = "AAAA"
-    address  = var.hosts.fugu.v6
     }
-
-  record {
-    hostname = "@"
-    type     = "MX"
-    address  = "mail.monotremata.xyz"
-    mx_pref  = 0
   }
-
-  record {
-    hostname = "@"
-    type     = "MX"
-    address  = "mx2.monotremata.xyz"
-    mx_pref  = 5
-  }
-
-  record {
-    hostname = "@"
-    type     = "TXT"
-    address  = "v=spf1 mx -all"
-  }
-
-  record {
-    hostname = "_dmarc"
-    type     = "TXT"
-    address  = "v=DMARC1;p=quarantine;pct=100;rua=mailto:postmaster@monotremata.xyz;;"
-  }
-
-  record {
-    hostname = "20201210._domainkey"
-    type     = "TXT"
-    address  = "v=DKIM1;k=rsa;p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC3dRTQXNdRNKjM/hnTIQ9d6h4qr7hDkoo3D8ySrV4tEcOC9cCD5fWiUzc560GuWPW5nm/VCDt6gHTGbkwsU/ULO+mjKJtvhZtEJnO4WqVG9Hr2whypODkGM9FSwh0yaWV96OJd51upsNRD/S5fKDMRcl09aBYe2rsn/877re/M0wIDAQAB;"
-  }
-
 }