| 1 | # 🤖 The DNSimple side of the dev mesh: the NS delegation that hands the |
| 2 | # dev.11ch.at subtree to the Route53 zone (route53.tf), plus the one dev record |
| 3 | # that stays on elevenmessenger.com. The two *.<cc>.dev.11ch.at wildcards that |
| 4 | # used to live here MOVED into the Route53 zone (route53.tf) — see there for why. |
| 5 | |
| 6 | variable "fi_node_ip" { |
| 7 | description = "The Helsinki (Hetzner) node's public IP (the *.fi.dev.11ch.at target)" |
| 8 | type = string |
| 9 | default = "157.180.123.183" |
| 10 | } |
| 11 | |
| 12 | # Delegate dev.11ch.at from the prod 11ch.at DNSimple zone (Eleven account |
| 13 | # 176940) to the Route53 hosted zone. One NS record per Route53 nameserver, all |
| 14 | # named "dev". After this propagates, DNSimple answers anything under dev.11ch.at |
| 15 | # with an NS referral and Route53 is authoritative — which is the whole reason the |
| 16 | # per-country wildcards had to move into that zone. |
| 17 | # |
| 18 | # ⚠️ This is the ONLY record this dev stack writes into the prod DNSimple zone, |
| 19 | # and it touches ONLY the dev subtree — it cannot affect 11ch.at itself or any |
| 20 | # member space. The 176940 token comes from the vault at apply time |
| 21 | # (aws-dev-agent-james.env), never a dev box, never committed. |
| 22 | # count (not for_each): a Route53 hosted zone's delegation set is ALWAYS exactly |
| 23 | # four nameservers, and their names are known only after the zone is created — a |
| 24 | # for_each keyed on them can't plan. A static count of 4 sidesteps that and still |
| 25 | # creates one `dev` NS record per Route53 nameserver. |
| 26 | resource "dnsimple_zone_record" "dev_delegation" { |
| 27 | count = 4 |
| 28 | |
| 29 | zone_name = "11ch.at" |
| 30 | name = "dev" |
| 31 | type = "NS" |
| 32 | value = aws_route53_zone.dev.name_servers[count.index] |
| 33 | ttl = 3600 |
| 34 | } |
| 35 | |
| 36 | # The dev home server lives on elevenmessenger.com (mirroring prod's |
| 37 | # home.elevenmessenger.com), not 11ch.at — the WebAuthn RP identity, and where |
| 38 | # native dev alts point HomeClient. It is OUTSIDE the dev.11ch.at delegation, so |
| 39 | # it stays a plain DNSimple A record on the Dublin (ie) box (the dev "primary" |
| 40 | # that also hosts the global home + the ie cloud provisioner). |
| 41 | resource "dnsimple_zone_record" "home_dev" { |
| 42 | zone_name = "elevenmessenger.com" |
| 43 | name = "home.dev" |
| 44 | type = "A" |
| 45 | value = aws_eip.ie_node.public_ip |
| 46 | ttl = 60 |
| 47 | } |
| 48 | |
amadan