From c1ddfe80c49c3a3ac263a6d3e12d90d2643429f2 Mon Sep 17 00:00:00 2001
From: Jake Howard <git@theorangeone.net>
Date: Tue, 13 Jan 2026 13:59:30 +0000
Subject: [PATCH] Move 0rng.one to desec

---
 terraform/.terraform.lock.hcl | 19 +++++++++++++
 terraform/0rng.one.tf         | 53 ++++++++++++++++++-----------------
 terraform/providers.tf        |  4 +++
 terraform/terraform.tf        |  4 +++
 terraform/variables.tf        |  4 +++
 5 files changed, 58 insertions(+), 26 deletions(-)

diff --git a/terraform/.terraform.lock.hcl b/terraform/.terraform.lock.hcl
index 29147db..af0ca7a 100644
--- a/terraform/.terraform.lock.hcl
+++ b/terraform/.terraform.lock.hcl
@@ -173,3 +173,22 @@ provider "registry.terraform.io/linode/linode" {
     "zh:ee653d5d08cb331ce2d8dc1010e68d363470ae87be62c0515e5d2418727cd02b",
   ]
 }
+
+provider "registry.terraform.io/valodim/desec" {
+  version     = "0.6.1"
+  constraints = "0.6.1"
+  hashes = [
+    "h1:cXLLxqkdJoiW+p/aDEBH6KK+laPM+RtWyYxd8IZBBN8=",
+    "zh:08fb06d0654d638ada1e2be948ff1070ff73314d65416a8c50775f6faa3c4730",
+    "zh:141baab7ef9c63dae9fa8edadfae19fcede4bde0132d576d26010dfddeac3fa3",
+    "zh:2f41c0ef69de1d75efb567bb54b132ce238dd0cca9f42fd71a67db44b0927d5a",
+    "zh:305d5137b7003701792a92242dd6010ad61db4fe69d94c9e00a1ae37332a0543",
+    "zh:70c86277d8929e6af2400fead92f5998f9b1dabddf7e57c85d9c5ccd29fcfe92",
+    "zh:79163bb3b16df4ebafc2128a2d65daf1f5d85d0d3831577e243094cb34e4fa67",
+    "zh:8dc0b89e311ca1c7a3c0621b265274b1590fbc0839a66677e0232a61c3ffb78e",
+    "zh:bc57f2f11a0f8e29387ba852474fe48f2a739d86dcd8f2aad545881e9d763912",
+    "zh:c0a3cab6728d52fdf5e3147c9033d838f4cd5873aae2b16a12c7027d825737f1",
+    "zh:dac69febd0e4b7a0aa78ab926a10f8c550f3d85fe180c255912308d2a484b3af",
+    "zh:ff517fd13df0a539c1e41615daea66fa56ac0e46250bf20a423a36e459cf13be",
+  ]
+}
diff --git a/terraform/0rng.one.tf b/terraform/0rng.one.tf
index 93ca722..9f58455 100644
--- a/terraform/0rng.one.tf
+++ b/terraform/0rng.one.tf
@@ -1,34 +1,35 @@
-resource "gandi_livedns_domain" "orngone" {
+resource "desec_domain" "orngone" {
   name = "0rng.one"
 }
 
-resource "gandi_livedns_record" "orngone_apex" {
-  zone = gandi_livedns_domain.orngone.id
-  name = "@"
-  type = "ALIAS" # Gandi doesn't support CNAME-flattening
-  ttl  = 3600
-  values = [
-    "${gandi_livedns_record.sys_domain_walker.name}.${gandi_livedns_record.sys_domain_walker.zone}."
-  ]
+resource "desec_rrset" "orngone_apex" {
+  domain  = desec_domain.orngone.name
+  subname = ""
+  type    = "A"
+  records = gandi_livedns_record.sys_domain_walker.values
+  ttl     = 3600
 }
 
-resource "gandi_livedns_record" "orngone_caa" {
-  zone = gandi_livedns_domain.orngone.id
-  name = "@"
-  type = "CAA"
-  ttl  = 3600
-  values = [
-    "0 issue \"letsencrypt.org\""
-  ]
+resource "desec_rrset" "orngone_apex_v6" {
+  domain  = desec_domain.orngone.name
+  subname = ""
+  type    = "AAAA"
+  records = gandi_livedns_record.sys_domain_walker_v6.values
+  ttl     = 3600
 }
 
-
-resource "gandi_livedns_record" "orngone_who" {
-  zone = gandi_livedns_domain.orngone.id
-  name = "who"
-  type = "CNAME"
-  ttl  = 3600
-  values = [
-    "${gandi_livedns_record.sys_domain_pve.name}.${gandi_livedns_record.sys_domain_pve.zone}."
-  ]
+resource "desec_rrset" "orngone_caa" {
+  domain  = desec_domain.orngone.name
+  subname = ""
+  type    = "CAA"
+  records = ["0 issue \"letsencrypt.org\""]
+  ttl     = 3600
+}
+
+resource "desec_rrset" "orngone_who" {
+  domain  = desec_domain.orngone.name
+  subname = "who"
+  type    = "CNAME"
+  records = ["${gandi_livedns_record.sys_domain_pve.name}.${gandi_livedns_record.sys_domain_pve.zone}."]
+  ttl     = 3600
 }
diff --git a/terraform/providers.tf b/terraform/providers.tf
index ac91539..3e1a6a4 100644
--- a/terraform/providers.tf
+++ b/terraform/providers.tf
@@ -18,3 +18,7 @@ provider "b2" {
 provider "hcloud" {
   token = var.hetzner_token
 }
+
+provider "desec" {
+  api_token = var.desec_api_token
+}
diff --git a/terraform/terraform.tf b/terraform/terraform.tf
index 9b1d6c3..f0fadc5 100644
--- a/terraform/terraform.tf
+++ b/terraform/terraform.tf
@@ -20,5 +20,9 @@ terraform {
       source  = "hetznercloud/hcloud"
       version = "1.48.1"
     }
+    desec = {
+      source  = "Valodim/desec"
+      version = "0.6.1"
+    }
   }
 }
diff --git a/terraform/variables.tf b/terraform/variables.tf
index b5bee7a..4c3df98 100644
--- a/terraform/variables.tf
+++ b/terraform/variables.tf
@@ -17,3 +17,7 @@ variable "backblaze_application_key_id" {
 variable "hetzner_token" {
   sensitive = true
 }
+
+variable "desec_api_token" {
+  sensitive = true
+}