document srv and dynamic records

namecheap.tf

@@ -1,24 +1,218 @@
+// Important:
+// Due to API restrictions, SRV and Dynamic DNS Records can't be created with
+// terraform, so I need to use `MERGE` mode and set those manually on the
+// namecheap web UI
 // https://registry.terraform.io/providers/namecheap/namecheap/latest/docs
+//
+// - SRV Record:
+//     service: _matrix
+//     protocol: _tcp
+//     priority: 0
+//     weight: 10
+//     port: 443
+//     target: matrix.monotremata.xyz
+//     TTL: 30 min
+//
+// - SRV Record:
+//     service: _xmpp-client
+//     protocol: _tcp
+//     priority: 5
+//     weight: 0
+//     port: 5222
+//     target: xmpp.monotremata.xyz
+//     TTL: 30 min
+//
+// - SRV Record:
+//     service: _xmpp-server
+//     protocol: _tcp
+//     priority: 5
+//     weight: 0
+//     port: 5269
+//     target: xmpp.monotremata.xyz
+//     TTL: 30 min
+//
+// - A + Dynamic DNS Record:
+//     host: wg
 
-variable "caladan-ip" {
-  type = string
-  default = "139.162.137.29"
+
+
+variable "hosts" {
+  default = {
+    // Alpine VPS hosted on Linode
+    caladan = {
+      v4 = "139.162.137.29"
+      v6 = "2a01:7e01::f03c:92ff:fea2:5d7c"
+    }
+    // OpenBSD VPS hosted on Vultr
+    fugu = {
+      v4 = "217.69.5.52"
+      v6 = "2001:19f0:6801:1d34:5400:03ff:fe18:7588"
+    }
+  }
+}
+
+// These are subdomains for services hosted on the host named `caladan`.
+// Both A and AAAA records should be made for them pointing to caladan's ipv4
+// and ipv6 respectively
+variable "caladan-subdomains" {
+  type = set(string)
+  default = [
+    "@",
+    "filite",
+    "git",
+    "gts",
+    "kb",
+    "keyoxide",
+    "matrix",
+    "mx2",
+    "pleroma",
+    "xmpp",
+    "groups.xmpp",
+    "proxy.xmpp",
+    "upload.xmpp",
+  ]
+}
+
+// These are subdomains for services hosted on the host named `narwhal`.
+// They are only accessible from my internal network and my internal DNS server
+// takes care of that.
+// But I set the public A record to caladan's ipv4 just for renewing their
+// letsencrypt certificates. No need to set the AAAA record.
+variable "narwhal-subdomains" {
+  type = set(string)
+  default = [
+    "authelia",
+    "calibre",
+    "dav",
+    "esphome",
+    "git.narwhal",
+    "gotify",
+    "grafana",
+    "hass",
+    "homer",
+    "influxdb",
+    "jellyfin",
+    "kodi",
+    "mirrors",
+    "mpd",
+    "music",
+    "nextcloud",
+    "nodered",
+    "openbooks",
+    "pg",
+    "rainloop",
+    "registry",
+    "rss-bridge",
+    "syncthing",
+    "transmission",
+    "wallabag",
+    "woodpecker",
+  ]
+}
+
+// These are subdomains for services hosted on the host named `sloth`.
+// They are only accessible from my internal network and my internal DNS server
+// takes care of that.
+// But I set the public A record to caladan's ipv4 just for renewing their
+// letsencrypt certificates. No need to set the AAAA record.
+variable "sloth-subdomains" {
+  type = set(string)
+  default = [
+    "kodi",
+    "mympd",
+    "snapweb",
+  ]
 }
 
 provider "namecheap" {
-  user_name = "gthar"
-  api_user = "gthar"
-  client_ip = var.caladan-ip
+  user_name   = "gthar"
+  api_user    = "gthar"
+  client_ip   = var.hosts.caladan.v4
   use_sandbox = false
 }
 
 resource "namecheap_domain_records" "monotremata-xyz" {
   domain = "monotremata.xyz"
-  mode = "MERGE"  // maybe eventually move to OVERWRITE
+  mode   = "MERGE"
+
+  dynamic "record" {
+    for_each = var.caladan-subdomains
+    content {
+      hostname = record.value
+      type     = "A"
+      address  = var.hosts.caladan.v4
+    }
+  }
+
+  dynamic "record" {
+    for_each = var.narwhal-subdomains
+    content {
+      hostname = record.value
+      type     = "A"
+      address  = var.hosts.caladan.v4
+    }
+  }
+
+  dynamic "record" {
+    for_each = var.sloth-subdomains
+    content {
+      hostname = record.value
+      type     = "A"
+      address  = var.hosts.caladan.v4
+    }
+  }
+
+  dynamic "record" {
+    for_each = var.caladan-subdomains
+    content {
+      hostname = record.value
+      type     = "AAAA"
+      address  = var.hosts.caladan.v6
+    }
+  }
+
+  record {
+    hostname = "mail"
+    type     = "A"
+    address  = var.hosts.fugu.v4
+  }
+
+  record {
+    hostname = "mail"
+    type     = "AAAA"
+    address  = var.hosts.fugu.v6
+  }
 
   record {
     hostname = "@"
-    type = "A"
-    address = var.caladan-ip
+    type     = "MX"
+    address  = "mail.monotremata.xyz"
+    mx_pref  = 0
   }
+
+  record {
+    hostname = "@"
+    type     = "MX"
+    address  = "mx2.monotremata.xyz"
+    mx_pref  = 5
+  }
+
+  record {
+    hostname = "@"
+    type     = "TXT"
+    address  = "v=spf1 mx -all"
+  }
+
+  record {
+    hostname = "_dmarc"
+    type     = "TXT"
+    address  = "v=DMARC1;p=quarantine;pct=100;rua=mailto:postmaster@monotremata.xyz;;"
+  }
+
+  record {
+    hostname = "20201210._domainkey"
+    type     = "TXT"
+    address  = "v=DKIM1;k=rsa;p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC3dRTQXNdRNKjM/hnTIQ9d6h4qr7hDkoo3D8ySrV4tEcOC9cCD5fWiUzc560GuWPW5nm/VCDt6gHTGbkwsU/ULO+mjKJtvhZtEJnO4WqVG9Hr2whypODkGM9FSwh0yaWV96OJd51upsNRD/S5fKDMRcl09aBYe2rsn/877re/M0wIDAQAB;"
+  }
+
 }