From 85603657c68c15e708ecc398be1ecc0a3cc81876 Mon Sep 17 00:00:00 2001 From: Sergei Poljanski Date: Fri, 13 Nov 2026 05:15:21 +0400 Subject: [PATCH] terraform: let a record set opt out of change protection Deleting a protected set takes two applies: first protected = false, then remove it. Used for gf/AAAA (removed). Assisted-by: Claude:opus-5-5 --- terraform/dns.tf | 13 +++++++------ 1 file changed, 7 insertions(+), 6 deletions(-) diff --git a/terraform/dns.tf b/terraform/dns.tf index 506a638..747bb4d 100644 --- a/terraform/dns.tf +++ b/terraform/dns.tf @@ -138,11 +138,12 @@ resource "hcloud_zone" "zone" { } resource "hcloud_zone_rrset" "rr" { - for_each = local.rrsets - zone = hcloud_zone.zone[each.value.zone].name - name = each.value.name - type = each.value.type - ttl = try(each.value.ttl, null) - change_protection = !can(regex(local.unprotected, each.value.name)) + for_each = local.rrsets + zone = hcloud_zone.zone[each.value.zone].name + name = each.value.name + type = each.value.type + ttl = try(each.value.ttl, null) + # A set can opt out with protected = false (e.g. to delete it next apply) + change_protection = try(each.value.protected, !can(regex(local.unprotected, each.value.name))) records = [for value in each.value.records : { value = value }] }