chadtmiller.com/knotless

# The names knotless-serve answers at: the apex, and www, which the proxy
# redirects to it.

data "cloudflare_zone" "main" {
  name = var.zone
}

# DNS-only, not proxied: the gateway is the zone's did:web, whose document
# and OAuth client metadata PDSes fetch from the origin, and git clones want
# bodies Cloudflare's proxy would cap. The reverse proxy on the host holds
# the certificate.
resource "cloudflare_record" "apex_a" {
  zone_id = data.cloudflare_zone.main.id
  name    = "@"
  type    = "A"
  content = var.host_ipv4
  ttl     = 1
  proxied = false
  comment = "knotless-serve"
}

resource "cloudflare_record" "apex_aaaa" {
  count   = var.host_ipv6 == "" ? 0 : 1
  zone_id = data.cloudflare_zone.main.id
  name    = "@"
  type    = "AAAA"
  content = var.host_ipv6
  ttl     = 1
  proxied = false
  comment = "knotless-serve"
}

resource "cloudflare_record" "www" {
  zone_id = data.cloudflare_zone.main.id
  name    = "www"
  type    = "CNAME"
  content = var.zone
  ttl     = 1
  proxied = false
  comment = "redirects to the apex"
}