b1d152be1f
## Context
Deploying new services required manually adding hostnames to
cloudflare_proxied_names/cloudflare_non_proxied_names in config.tfvars —
a separate file from the service stack. This was frequently forgotten,
leaving services unreachable externally.
## This change:
- Add `dns_type` parameter to `ingress_factory` and `reverse_proxy/factory`
modules. Setting `dns_type = "proxied"` or `"non-proxied"` auto-creates
the Cloudflare DNS record (CNAME to tunnel or A/AAAA to public IP).
- Simplify cloudflared tunnel from 100 per-hostname rules to wildcard
`*.viktorbarzin.me → Traefik`. Traefik still handles host-based routing.
- Add global Cloudflare provider via terragrunt.hcl (separate
cloudflare_provider.tf with Vault-sourced API key).
- Migrate 118 hostnames from centralized config.tfvars to per-service
dns_type. 17 hostnames remain centrally managed (Helm ingresses,
special cases).
- Update docs, AGENTS.md, CLAUDE.md, dns.md runbook.
```
BEFORE AFTER
config.tfvars (manual list) stacks/<svc>/main.tf
| module "ingress" {
v dns_type = "proxied"
stacks/cloudflared/ }
for_each = list |
cloudflare_record auto-creates
tunnel per-hostname cloudflare_record + annotation
```
## What is NOT in this change:
- Uptime Kuma monitor migration (still reads from config.tfvars)
- 17 remaining centrally-managed hostnames (Helm, special cases)
- Removal of allow_overwrite (keep until migration confirmed stable)
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
114 lines
2.6 KiB
HCL
114 lines
2.6 KiB
HCL
# Root Terragrunt configuration
|
|
# Provides DRY provider, backend, and variable loading for all stacks.
|
|
|
|
# Each stack gets its own local state file under state/<stack-name>/
|
|
remote_state {
|
|
backend = "local"
|
|
generate = {
|
|
path = "backend.tf"
|
|
if_exists = "overwrite_terragrunt"
|
|
}
|
|
config = {
|
|
path = "${get_repo_root()}/state/${path_relative_to_include()}/terraform.tfstate"
|
|
}
|
|
}
|
|
|
|
# Load config.tfvars (plaintext). Secrets come from Vault KV — authenticate via `vault login -method=oidc`.
|
|
terraform {
|
|
extra_arguments "common_vars" {
|
|
commands = get_terraform_commands_that_need_vars()
|
|
required_var_files = [
|
|
"${get_repo_root()}/config.tfvars"
|
|
]
|
|
}
|
|
|
|
extra_arguments "no_backup" {
|
|
commands = ["apply", "plan", "destroy", "import"]
|
|
arguments = ["-backup=-"]
|
|
}
|
|
|
|
extra_arguments "kube_config" {
|
|
commands = get_terraform_commands_that_need_vars()
|
|
arguments = [
|
|
"-var", "kube_config_path=${get_repo_root()}/config"
|
|
]
|
|
}
|
|
}
|
|
|
|
# Generate kubernetes + helm + cloudflare providers for all stacks.
|
|
# The infra stack overrides this to add the proxmox provider.
|
|
generate "k8s_providers" {
|
|
path = "providers.tf"
|
|
if_exists = "overwrite_terragrunt"
|
|
contents = <<EOF
|
|
terraform {
|
|
required_providers {
|
|
vault = {
|
|
source = "hashicorp/vault"
|
|
version = "~> 4.0"
|
|
}
|
|
cloudflare = {
|
|
source = "cloudflare/cloudflare"
|
|
version = "~> 4"
|
|
}
|
|
}
|
|
}
|
|
|
|
variable "kube_config_path" {
|
|
type = string
|
|
default = "~/.kube/config"
|
|
}
|
|
|
|
provider "kubernetes" {
|
|
config_path = var.kube_config_path
|
|
}
|
|
|
|
provider "helm" {
|
|
kubernetes = {
|
|
config_path = var.kube_config_path
|
|
}
|
|
}
|
|
|
|
provider "vault" {
|
|
address = "https://vault.viktorbarzin.me"
|
|
skip_child_token = true
|
|
}
|
|
EOF
|
|
}
|
|
|
|
# Generate Cloudflare provider config (separate file to avoid conflicts
|
|
# with stacks that override providers.tf, e.g. infra stack).
|
|
# DNS records are created per-service via ingress_factory's dns_type param.
|
|
generate "cloudflare_provider" {
|
|
path = "cloudflare_provider.tf"
|
|
if_exists = "overwrite_terragrunt"
|
|
contents = <<EOF
|
|
data "vault_kv_secret_v2" "cf_platform" {
|
|
mount = "secret"
|
|
name = "platform"
|
|
}
|
|
|
|
provider "cloudflare" {
|
|
api_key = data.vault_kv_secret_v2.cf_platform.data["cloudflare_api_key"]
|
|
email = "vbarzin@gmail.com"
|
|
}
|
|
EOF
|
|
}
|
|
|
|
# Generate shared tiers locals for all stacks.
|
|
# Previously duplicated in 67+ stacks; now defined once here.
|
|
generate "tiers" {
|
|
path = "tiers.tf"
|
|
if_exists = "overwrite_terragrunt"
|
|
contents = <<EOF
|
|
locals {
|
|
tiers = {
|
|
core = "0-core"
|
|
cluster = "1-cluster"
|
|
gpu = "2-gpu"
|
|
edge = "3-edge"
|
|
aux = "4-aux"
|
|
}
|
|
}
|
|
EOF
|
|
}
|