asxpi/iac
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 1

terraform: let a record set opt out of change protection

Browse source 
Deleting a protected set takes two applies: first protected = false,
then remove it. Used for gf/AAAA (removed).

Assisted-by: Claude:opus-5-5
This commit is contained in:
Sergei Poljanski 2026-11-13 05:15:21 +04:00
commit 85603657c6
Signed by: asxpi
GPG key ID: 4F8851660FA4121B
1 changed files with 7 additions and 6 deletions
Download patch file Download diff file Expand all files Collapse all files

13
terraform/dns.tf
View file

@ -138,11 +138,12 @@ resource "hcloud_zone" "zone" {
}
resource "hcloud_zone_rrset" "rr" {
for_each = local.rrsets
zone = hcloud_zone.zone[each.value.zone].name
name = each.value.name
type = each.value.type
ttl = try(each.value.ttl, null)
change_protection = !can(regex(local.unprotected, each.value.name))
for_each = local.rrsets
zone = hcloud_zone.zone[each.value.zone].name
name = each.value.name
type = each.value.type
ttl = try(each.value.ttl, null)
# A set can opt out with protected = false (e.g. to delete it next apply)
change_protection = try(each.value.protected, !can(regex(local.unprotected, each.value.name)))
records = [for value in each.value.records : { value = value }]
}