asxpi/iac
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

terraform: manage DNS for asxp.io and czsk.it

Browse source 
The zones were edited by hand in the console, and it showed: dozens of
records for servers that no longer existed, a CNAME and a TXT record
missing their trailing dot, and a 24 h default TTL that made today's
XMPP move linger in resolver caches.

Now both zones live in the asxpio project, so describe them here,
adopted with import blocks (the first apply imported 87 and changed
nothing but protection). Our servers' records reference hcloud_server
instead of literal IPs. Every record set is change-protected except
those of the test XMPP servers, and both zones are delete-protected.

Assisted-by: Claude:opus-5-5
This commit is contained in:
Sergei Poljanski 2026-11-12 22:46:53 +04:00
commit 32836d5d53
2 changed files with 172 additions and 33 deletions
Download patch file Download diff file Expand all files Collapse all files

12
terraform/README.md
View file

@ -27,6 +27,18 @@ day-to-day configuration is in `../ansible`.
- asxpio-backups-repl (fsn1)
## DNS
`dns.tf` holds the zones asxp.io and czsk.it (Hetzner DNS, this project)
and every record set except SOA and NS. Our servers' records reference
`hcloud_server`, so moving a service is one edit.
All record sets are change-protected except the test XMPP servers'
(`prosody`, `ejabberd`, `anotherim`); both zones are delete-protected.
To change a protected record set, apply twice: first with the set
excluded from protection, then with the new value. Hand edits in the
console show up as drift in `terraform plan`.
## Network
- VPC: 10.10.0.0/20