From c1ddfe80c49c3a3ac263a6d3e12d90d2643429f2 Mon Sep 17 00:00:00 2001 From: Jake Howard Date: Tue, 13 Jan 2026 13:59:30 +0000 Subject: [PATCH 01/12] Move 0rng.one to desec --- terraform/.terraform.lock.hcl | 19 +++++++++++++ terraform/0rng.one.tf | 53 ++++++++++++++++++----------------- terraform/providers.tf | 4 +++ terraform/terraform.tf | 4 +++ terraform/variables.tf | 4 +++ 5 files changed, 58 insertions(+), 26 deletions(-) diff --git a/terraform/.terraform.lock.hcl b/terraform/.terraform.lock.hcl index 29147db..af0ca7a 100644 --- a/terraform/.terraform.lock.hcl +++ b/terraform/.terraform.lock.hcl @@ -173,3 +173,22 @@ provider "registry.terraform.io/linode/linode" { "zh:ee653d5d08cb331ce2d8dc1010e68d363470ae87be62c0515e5d2418727cd02b", ] } + +provider "registry.terraform.io/valodim/desec" { + version = "0.6.1" + constraints = "0.6.1" + hashes = [ + "h1:cXLLxqkdJoiW+p/aDEBH6KK+laPM+RtWyYxd8IZBBN8=", + "zh:08fb06d0654d638ada1e2be948ff1070ff73314d65416a8c50775f6faa3c4730", + "zh:141baab7ef9c63dae9fa8edadfae19fcede4bde0132d576d26010dfddeac3fa3", + "zh:2f41c0ef69de1d75efb567bb54b132ce238dd0cca9f42fd71a67db44b0927d5a", + "zh:305d5137b7003701792a92242dd6010ad61db4fe69d94c9e00a1ae37332a0543", + "zh:70c86277d8929e6af2400fead92f5998f9b1dabddf7e57c85d9c5ccd29fcfe92", + "zh:79163bb3b16df4ebafc2128a2d65daf1f5d85d0d3831577e243094cb34e4fa67", + "zh:8dc0b89e311ca1c7a3c0621b265274b1590fbc0839a66677e0232a61c3ffb78e", + "zh:bc57f2f11a0f8e29387ba852474fe48f2a739d86dcd8f2aad545881e9d763912", + "zh:c0a3cab6728d52fdf5e3147c9033d838f4cd5873aae2b16a12c7027d825737f1", + "zh:dac69febd0e4b7a0aa78ab926a10f8c550f3d85fe180c255912308d2a484b3af", + "zh:ff517fd13df0a539c1e41615daea66fa56ac0e46250bf20a423a36e459cf13be", + ] +} diff --git a/terraform/0rng.one.tf b/terraform/0rng.one.tf index 93ca722..9f58455 100644 --- a/terraform/0rng.one.tf +++ b/terraform/0rng.one.tf @@ -1,34 +1,35 @@ -resource "gandi_livedns_domain" "orngone" { +resource "desec_domain" "orngone" { name = "0rng.one" } -resource "gandi_livedns_record" "orngone_apex" { - zone = gandi_livedns_domain.orngone.id - name = "@" - type = "ALIAS" # Gandi doesn't support CNAME-flattening - ttl = 3600 - values = [ - "${gandi_livedns_record.sys_domain_walker.name}.${gandi_livedns_record.sys_domain_walker.zone}." - ] +resource "desec_rrset" "orngone_apex" { + domain = desec_domain.orngone.name + subname = "" + type = "A" + records = gandi_livedns_record.sys_domain_walker.values + ttl = 3600 } -resource "gandi_livedns_record" "orngone_caa" { - zone = gandi_livedns_domain.orngone.id - name = "@" - type = "CAA" - ttl = 3600 - values = [ - "0 issue \"letsencrypt.org\"" - ] +resource "desec_rrset" "orngone_apex_v6" { + domain = desec_domain.orngone.name + subname = "" + type = "AAAA" + records = gandi_livedns_record.sys_domain_walker_v6.values + ttl = 3600 } - -resource "gandi_livedns_record" "orngone_who" { - zone = gandi_livedns_domain.orngone.id - name = "who" - type = "CNAME" - ttl = 3600 - values = [ - "${gandi_livedns_record.sys_domain_pve.name}.${gandi_livedns_record.sys_domain_pve.zone}." - ] +resource "desec_rrset" "orngone_caa" { + domain = desec_domain.orngone.name + subname = "" + type = "CAA" + records = ["0 issue \"letsencrypt.org\""] + ttl = 3600 +} + +resource "desec_rrset" "orngone_who" { + domain = desec_domain.orngone.name + subname = "who" + type = "CNAME" + records = ["${gandi_livedns_record.sys_domain_pve.name}.${gandi_livedns_record.sys_domain_pve.zone}."] + ttl = 3600 } diff --git a/terraform/providers.tf b/terraform/providers.tf index ac91539..3e1a6a4 100644 --- a/terraform/providers.tf +++ b/terraform/providers.tf @@ -18,3 +18,7 @@ provider "b2" { provider "hcloud" { token = var.hetzner_token } + +provider "desec" { + api_token = var.desec_api_token +} diff --git a/terraform/terraform.tf b/terraform/terraform.tf index 9b1d6c3..f0fadc5 100644 --- a/terraform/terraform.tf +++ b/terraform/terraform.tf @@ -20,5 +20,9 @@ terraform { source = "hetznercloud/hcloud" version = "1.48.1" } + desec = { + source = "Valodim/desec" + version = "0.6.1" + } } } diff --git a/terraform/variables.tf b/terraform/variables.tf index b5bee7a..4c3df98 100644 --- a/terraform/variables.tf +++ b/terraform/variables.tf @@ -17,3 +17,7 @@ variable "backblaze_application_key_id" { variable "hetzner_token" { sensitive = true } + +variable "desec_api_token" { + sensitive = true +} From 6d488fce3b53a465120aa49d4079762bfe672f1f Mon Sep 17 00:00:00 2001 From: Jake Howard Date: Tue, 13 Jan 2026 14:30:05 +0000 Subject: [PATCH 02/12] Add traefik token for desec --- terraform/desec.tf | 21 +++++++++++++++++++++ 1 file changed, 21 insertions(+) create mode 100644 terraform/desec.tf diff --git a/terraform/desec.tf b/terraform/desec.tf new file mode 100644 index 0000000..8206380 --- /dev/null +++ b/terraform/desec.tf @@ -0,0 +1,21 @@ +# Must be created manually and imported, otherwise there's no way to access the token +resource "desec_token" "traefik" { + name = "traefik" + perm_create_domain = false + perm_delete_domain = false + perm_manage_tokens = false +} + +resource "desec_token_policy" "traefik_default" { + token_id = desec_token.traefik.id + perm_write = false +} + +resource "desec_token_policy" "traefik" { + token_id = desec_token.traefik.id + perm_write = true + subname = "_acme_challenge" + type = "TXT" + + depends_on = [desec_token_policy.traefik_default] +} From 7830d16d0971ed63f03f9d826f65161629a476ad Mon Sep 17 00:00:00 2001 From: Jake Howard Date: Wed, 14 Jan 2026 21:45:49 +0000 Subject: [PATCH 03/12] Add desec API token to traefik --- .../roles/traefik/files/docker-compose.yml | 1 + ansible/roles/traefik/vars/vault.yml | 23 +++++++++++-------- 2 files changed, 14 insertions(+), 10 deletions(-) diff --git a/ansible/roles/traefik/files/docker-compose.yml b/ansible/roles/traefik/files/docker-compose.yml index bd7b03b..b2d2e14 100644 --- a/ansible/roles/traefik/files/docker-compose.yml +++ b/ansible/roles/traefik/files/docker-compose.yml @@ -4,6 +4,7 @@ services: user: "{{ docker_user.id }}" environment: - GANDIV5_PERSONAL_ACCESS_TOKEN={{ vault_gandi_personal_access_token if traefik_tls_challenge else "" }} + - DESEC_TOKEN={{ vault_desec_api_token if traefik_tls_challenge else "" }} volumes: - ./traefik:/etc/traefik restart: unless-stopped diff --git a/ansible/roles/traefik/vars/vault.yml b/ansible/roles/traefik/vars/vault.yml index 377f974..b8f329d 100644 --- a/ansible/roles/traefik/vars/vault.yml +++ b/ansible/roles/traefik/vars/vault.yml @@ -1,11 +1,14 @@ $ANSIBLE_VAULT;1.1;AES256 -30386663383635396466373834626430626462383133646239616665323761383466336662663362 -3732373963343133633833376330336432353734656566620a366637623761626635383365396637 -61656634303235373864623431313735633665616633363531313564666230313831386236363430 -6163613365393863620a336364653838633037333062336335303863623064616465313935633039 -37653066386164616634633065656639343637333266356234396163623539386430653232323036 -64666230396330353263383536346532333564303438346564376266653237313737386130386264 -32656566643339666663616539373865613466313731363663613766653832613961313336663938 -30626663663034336466626635663366333162326636363362393437383932306233326531373937 -35316362366539353336336536666431363039393562633665303561363636336364393264613638 -3033643736373566613838316162383739626463303532313865 +35363536626532316139376436633932653737643236306236323030663264336132383963366234 +3064393838323564656164626134393336356364346462620a333730363761653964323637376439 +39366537616633346461636338633763626131346132366634363837626531343636383362663262 +6265343632303862340a363865613636613363396166346566353463353565663864653835303039 +30396630306131343564363839343862666439306362313661363234366663663034653262303232 +39616537313030633435316262343961343634336666636534393436353730383038316564346430 +38303466303265306139663439643437383538333137386334393738306237643062376566383332 +31383335333533383236316233386537366533663237313535363031613739303561663166373365 +31383632316664313334663539303936383239396266623236336333666131393563656662643461 +36383931353461613364373762333330383732626637346139613763616534306563663232396135 +34343835346634653663623664643661626539376231396439653436393666383930343332333961 +30326333306663353035363530653030646138626630656531346133656362623866306337373765 +62643832353961383230626333373262643432626630653930316434663631663234 From 689d95c9c9d5a190ccff6e2f143ebbe7e19d7c89 Mon Sep 17 00:00:00 2001 From: Jake Howard Date: Wed, 14 Jan 2026 21:56:09 +0000 Subject: [PATCH 04/12] Manage desec terraform token in terraform --- terraform/desec.tf | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/terraform/desec.tf b/terraform/desec.tf index 8206380..b2b5402 100644 --- a/terraform/desec.tf +++ b/terraform/desec.tf @@ -1,4 +1,4 @@ -# Must be created manually and imported, otherwise there's no way to access the token +# NOTE: Tokens must be created manually and imported, otherwise there's no way to access the token resource "desec_token" "traefik" { name = "traefik" perm_create_domain = false @@ -6,6 +6,13 @@ resource "desec_token" "traefik" { perm_manage_tokens = false } +resource "desec_token" "terraform" { + name = "Terraform" + perm_create_domain = false + perm_delete_domain = false + perm_manage_tokens = true +} + resource "desec_token_policy" "traefik_default" { token_id = desec_token.traefik.id perm_write = false From 9265893412149b65ac61166424f5b385906948af Mon Sep 17 00:00:00 2001 From: Jake Howard Date: Thu, 19 Feb 2026 08:58:09 +0000 Subject: [PATCH 05/12] Convert jakehoward.tech to desec --- terraform/jakehoward.tech.tf | 410 +++++++++++++++++------------------ 1 file changed, 205 insertions(+), 205 deletions(-) diff --git a/terraform/jakehoward.tech.tf b/terraform/jakehoward.tech.tf index e45f1ff..632c95c 100644 --- a/terraform/jakehoward.tech.tf +++ b/terraform/jakehoward.tech.tf @@ -1,344 +1,344 @@ -data "gandi_livedns_domain" "jakehowardtech" { +resource "desec_domain" "jakehowardtech" { name = "jakehoward.tech" } -resource "gandi_livedns_record" "jakehowardtech_mx" { - zone = data.gandi_livedns_domain.jakehowardtech.id - name = "@" - type = "MX" - ttl = 3600 - values = [ +resource "desec_rrset" "jakehowardtech_mx" { + domain = desec_domain.jakehowardtech.name + subname = "" + type = "MX" + ttl = 3600 + records = [ "10 in1-smtp.messagingengine.com.", "20 in2-smtp.messagingengine.com.", ] } -resource "gandi_livedns_record" "jakehowardtech_dkim_fm1" { - zone = data.gandi_livedns_domain.jakehowardtech.id - name = "fm1._domainkey" - type = "CNAME" - ttl = 3600 - values = [ +resource "desec_rrset" "jakehowardtech_dkim_fm1" { + domain = desec_domain.jakehowardtech.name + subname = "fm1._domainkey" + type = "CNAME" + ttl = 3600 + records = [ "fm1.jakehoward.tech.dkim.fmhosted.com." ] } -resource "gandi_livedns_record" "jakehowardtech_dkim_fm2" { - zone = data.gandi_livedns_domain.jakehowardtech.id - name = "fm2._domainkey" - type = "CNAME" - ttl = 3600 - values = [ +resource "desec_rrset" "jakehowardtech_dkim_fm2" { + domain = desec_domain.jakehowardtech.name + subname = "fm2._domainkey" + type = "CNAME" + ttl = 3600 + records = [ "fm2.jakehoward.tech.dkim.fmhosted.com." ] } -resource "gandi_livedns_record" "jakehowardtech_dkim_fm3" { - zone = data.gandi_livedns_domain.jakehowardtech.id - name = "fm3._domainkey" - type = "CNAME" - ttl = 3600 - values = [ +resource "desec_rrset" "jakehowardtech_dkim_fm3" { + domain = desec_domain.jakehowardtech.name + subname = "fm3._domainkey" + type = "CNAME" + ttl = 3600 + records = [ "fm3.jakehoward.tech.dkim.fmhosted.com." ] } -resource "gandi_livedns_record" "jakehowardtech_dmarc" { - zone = data.gandi_livedns_domain.jakehowardtech.id - name = "_dmarc" - type = "TXT" - ttl = 3600 - values = [ +resource "desec_rrset" "jakehowardtech_dmarc" { + domain = desec_domain.jakehowardtech.name + subname = "_dmarc" + type = "TXT" + ttl = 3600 + records = [ "\"v=DMARC1; p=quarantine; ruf=mailto:dmarc-report@jakehoward.tech;\"" ] } -resource "gandi_livedns_record" "jakehowardtech_txt" { - zone = data.gandi_livedns_domain.jakehowardtech.id - name = "@" - type = "TXT" - ttl = 3600 - values = [ +resource "desec_rrset" "jakehowardtech_txt" { + domain = desec_domain.jakehowardtech.name + subname = "" + type = "TXT" + ttl = 3600 + records = [ "\"v=spf1 include:spf.messagingengine.com -all\"" ] } -resource "gandi_livedns_record" "jakehowardtech_speed" { - zone = data.gandi_livedns_domain.jakehowardtech.id - name = "speed" - type = "CNAME" - ttl = 3600 - values = [ +resource "desec_rrset" "jakehowardtech_speed" { + domain = desec_domain.jakehowardtech.name + subname = "speed" + type = "CNAME" + ttl = 3600 + records = [ "${gandi_livedns_record.sys_domain_pve.name}.${gandi_livedns_record.sys_domain_pve.zone}." ] } -resource "gandi_livedns_record" "jakehowardtech_media" { - zone = data.gandi_livedns_domain.jakehowardtech.id - name = "media" - type = "CNAME" - ttl = 3600 - values = [ +resource "desec_rrset" "jakehowardtech_media" { + domain = desec_domain.jakehowardtech.name + subname = "media" + type = "CNAME" + ttl = 3600 + records = [ "${gandi_livedns_record.sys_domain_pve.name}.${gandi_livedns_record.sys_domain_pve.zone}." ] } -resource "gandi_livedns_record" "jakehowardtech_matrix" { - zone = data.gandi_livedns_domain.jakehowardtech.id - name = "matrix" - type = "CNAME" - ttl = 3600 - values = [ +resource "desec_rrset" "jakehowardtech_matrix" { + domain = desec_domain.jakehowardtech.name + subname = "matrix" + type = "CNAME" + ttl = 3600 + records = [ "${gandi_livedns_record.sys_domain_pve.name}.${gandi_livedns_record.sys_domain_pve.zone}." ] } -resource "gandi_livedns_record" "jakehowardtech_intersect" { - zone = data.gandi_livedns_domain.jakehowardtech.id - name = "intersect" - type = "CNAME" - ttl = 3600 - values = [ +resource "desec_rrset" "jakehowardtech_intersect" { + domain = desec_domain.jakehowardtech.name + subname = "intersect" + type = "CNAME" + ttl = 3600 + records = [ "${gandi_livedns_record.sys_domain_pve.name}.${gandi_livedns_record.sys_domain_pve.zone}." ] } -resource "gandi_livedns_record" "jakehowardtech_calibre" { - zone = data.gandi_livedns_domain.jakehowardtech.id - name = "calibre" - type = "CNAME" - ttl = 3600 - values = [ +resource "desec_rrset" "jakehowardtech_calibre" { + domain = desec_domain.jakehowardtech.name + subname = "calibre" + type = "CNAME" + ttl = 3600 + records = [ "${gandi_livedns_record.sys_domain_pve.name}.${gandi_livedns_record.sys_domain_pve.zone}." ] } -resource "gandi_livedns_record" "jakehowardtech_homeassistant" { - zone = data.gandi_livedns_domain.jakehowardtech.id - name = "homeassistant" - type = "CNAME" - ttl = 3600 - values = [ +resource "desec_rrset" "jakehowardtech_homeassistant" { + domain = desec_domain.jakehowardtech.name + subname = "homeassistant" + type = "CNAME" + ttl = 3600 + records = [ "${gandi_livedns_record.sys_domain_pve_private.name}.${gandi_livedns_record.sys_domain_pve_private.zone}." ] } -resource "gandi_livedns_record" "jakehowardtech_grafana" { - zone = data.gandi_livedns_domain.jakehowardtech.id - name = "grafana" - type = "CNAME" - ttl = 3600 - values = [ +resource "desec_rrset" "jakehowardtech_grafana" { + domain = desec_domain.jakehowardtech.name + subname = "grafana" + type = "CNAME" + ttl = 3600 + records = [ "${gandi_livedns_record.sys_domain_pve.name}.${gandi_livedns_record.sys_domain_pve.zone}." ] } -resource "gandi_livedns_record" "jakehowardtech_vaultwarden" { - zone = data.gandi_livedns_domain.jakehowardtech.id - name = "vaultwarden" - type = "CNAME" - ttl = 3600 - values = [ +resource "desec_rrset" "jakehowardtech_vaultwarden" { + domain = desec_domain.jakehowardtech.name + subname = "vaultwarden" + type = "CNAME" + ttl = 3600 + records = [ "${gandi_livedns_record.sys_domain_pve_private.name}.${gandi_livedns_record.sys_domain_pve_private.zone}." ] } -resource "gandi_livedns_record" "jakehowardtech_recipes" { - zone = data.gandi_livedns_domain.jakehowardtech.id - name = "recipes" - type = "CNAME" - ttl = 3600 - values = [ +resource "desec_rrset" "jakehowardtech_recipes" { + domain = desec_domain.jakehowardtech.name + subname = "recipes" + type = "CNAME" + ttl = 3600 + records = [ "${gandi_livedns_record.sys_domain_pve.name}.${gandi_livedns_record.sys_domain_pve.zone}." ] } -resource "gandi_livedns_record" "jakehowardtech_mailgun_spf" { - zone = data.gandi_livedns_domain.jakehowardtech.id - name = "mg" - type = "TXT" - ttl = 3600 - values = [ +resource "desec_rrset" "jakehowardtech_mailgun_spf" { + domain = desec_domain.jakehowardtech.name + subname = "mg" + type = "TXT" + ttl = 3600 + records = [ "\"v=spf1 include:mailgun.org -all\"" ] } -resource "gandi_livedns_record" "jakehowardtech_mailgun_dkim" { - zone = data.gandi_livedns_domain.jakehowardtech.id - name = "s1._domainkey.mg" - type = "TXT" - ttl = 3600 - values = [ +resource "desec_rrset" "jakehowardtech_mailgun_dkim" { + domain = desec_domain.jakehowardtech.name + subname = "s1._domainkey.mg" + type = "TXT" + ttl = 3600 + records = [ "\"k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA4E4cv86U+sFUjgLys26ZLccTghzGfHiFpitWdFg68lGXG63aoG2/+9bgKVT0ZBG7bjPvj6Kyj4N3TIe4oCJo2saVvtsNK1pvZ\" \"kOadaBPgjzKeRvBaw48ZatUGKoV7q1NCa0kXAfiJleF7bMvbt8rYDmBljr/BG6TtZYPt6XgoZyh8HHXjv/1L6WT3JBVQ8q5UtqVRVujXNHf57FmJTOJpvs0bKn/6TUaXYZmt5z3jpDhc/HfmkzVV22\" \"AwRf9jn7kgKkgaKpkvfSL8gtYNn5oyfS0Y9W9x9ntqb4g72RCbynMppQb1uwxbIuWRVOp0un0koQDm3C8ZzhOOYAwe58BYQIDAQAB\"" ] } -resource "gandi_livedns_record" "jakehowardtech_mailgun_dmarc" { - zone = data.gandi_livedns_domain.jakehowardtech.id - name = "_dmarc.mg" - type = "TXT" - ttl = 3600 - values = [ +resource "desec_rrset" "jakehowardtech_mailgun_dmarc" { + domain = desec_domain.jakehowardtech.name + subname = "_dmarc.mg" + type = "TXT" + ttl = 3600 + records = [ "\"v=DMARC1; p=quarantine; ruf=mailto:dmarc-report@jakehoward.tech;\"" ] } -resource "gandi_livedns_record" "jakehowardtech_synapse_admin" { - zone = data.gandi_livedns_domain.jakehowardtech.id - name = "synapse-admin" - type = "CNAME" - ttl = 3600 - values = [ +resource "desec_rrset" "jakehowardtech_synapse_admin" { + domain = desec_domain.jakehowardtech.name + subname = "synapse-admin" + type = "CNAME" + ttl = 3600 + records = [ "${gandi_livedns_record.sys_domain_pve.name}.${gandi_livedns_record.sys_domain_pve.zone}." ] } -resource "gandi_livedns_record" "jakehowardtech_apex" { - zone = data.gandi_livedns_domain.jakehowardtech.id - name = "@" - type = "ALIAS" - ttl = 3600 - values = [ +resource "desec_rrset" "jakehowardtech_apex" { + domain = desec_domain.jakehowardtech.name + subname = "" + type = "ALIAS" + ttl = 3600 + records = [ "${gandi_livedns_record.sys_domain_walker.name}.${gandi_livedns_record.sys_domain_walker.zone}." ] } -resource "gandi_livedns_record" "jakehowardtech_collabora" { - zone = data.gandi_livedns_domain.jakehowardtech.id - name = "collabora" - type = "CNAME" - ttl = 3600 - values = [ +resource "desec_rrset" "jakehowardtech_collabora" { + domain = desec_domain.jakehowardtech.name + subname = "collabora" + type = "CNAME" + ttl = 3600 + records = [ "${gandi_livedns_record.sys_domain_pve.name}.${gandi_livedns_record.sys_domain_pve.zone}." ] } -resource "gandi_livedns_record" "jakehowardtech_tasks" { - zone = data.gandi_livedns_domain.jakehowardtech.id - name = "tasks" - type = "CNAME" - ttl = 3600 - values = [ +resource "desec_rrset" "jakehowardtech_tasks" { + domain = desec_domain.jakehowardtech.name + subname = "tasks" + type = "CNAME" + ttl = 3600 + records = [ "${gandi_livedns_record.sys_domain_pve.name}.${gandi_livedns_record.sys_domain_pve.zone}." ] } -resource "gandi_livedns_record" "jakehowardtech_auth" { - zone = data.gandi_livedns_domain.jakehowardtech.id - name = "auth" - type = "CNAME" - ttl = 3600 - values = [ +resource "desec_rrset" "jakehowardtech_auth" { + domain = desec_domain.jakehowardtech.name + subname = "auth" + type = "CNAME" + ttl = 3600 + records = [ "${gandi_livedns_record.sys_domain_pve.name}.${gandi_livedns_record.sys_domain_pve.zone}." ] } -resource "gandi_livedns_record" "jakehowardtech_ntfy" { - zone = data.gandi_livedns_domain.jakehowardtech.id - name = "ntfy" - type = "CNAME" - ttl = 3600 - values = [ +resource "desec_rrset" "jakehowardtech_ntfy" { + domain = desec_domain.jakehowardtech.name + subname = "ntfy" + type = "CNAME" + ttl = 3600 + records = [ "${gandi_livedns_record.sys_domain_pve.name}.${gandi_livedns_record.sys_domain_pve.zone}." ] } -resource "gandi_livedns_record" "jakehowardtech_headscale" { - zone = data.gandi_livedns_domain.jakehowardtech.id - name = "headscale" - type = "CNAME" - ttl = 3600 - values = [ +resource "desec_rrset" "jakehowardtech_headscale" { + domain = desec_domain.jakehowardtech.name + subname = "headscale" + type = "CNAME" + ttl = 3600 + records = [ "${gandi_livedns_record.sys_domain_casey.name}.${gandi_livedns_record.sys_domain_casey.zone}." ] } -resource "gandi_livedns_record" "jakehowardtech_slides" { - zone = data.gandi_livedns_domain.jakehowardtech.id - name = "slides" - type = "CNAME" - ttl = 3600 - values = [ +resource "desec_rrset" "jakehowardtech_slides" { + domain = desec_domain.jakehowardtech.name + subname = "slides" + type = "CNAME" + ttl = 3600 + records = [ "${gandi_livedns_record.sys_domain_walker.name}.${gandi_livedns_record.sys_domain_walker.zone}." ] } -resource "gandi_livedns_record" "jakehowardtech_uptime" { - zone = data.gandi_livedns_domain.jakehowardtech.id - name = "uptime" - type = "CNAME" - ttl = 3600 - values = [ +resource "desec_rrset" "jakehowardtech_uptime" { + domain = desec_domain.jakehowardtech.name + subname = "uptime" + type = "CNAME" + ttl = 3600 + records = [ "${gandi_livedns_record.sys_domain_pve.name}.${gandi_livedns_record.sys_domain_pve.zone}." ] } -resource "gandi_livedns_record" "jakehowardtech_baby-buddy" { - zone = data.gandi_livedns_domain.jakehowardtech.id - name = "baby-buddy" - type = "CNAME" - ttl = 3600 - values = [ +resource "desec_rrset" "jakehowardtech_baby-buddy" { + domain = desec_domain.jakehowardtech.name + subname = "baby-buddy" + type = "CNAME" + ttl = 3600 + records = [ "${gandi_livedns_record.sys_domain_pve_private.name}.${gandi_livedns_record.sys_domain_pve_private.zone}." ] } -resource "gandi_livedns_record" "jakehowardtech_immich" { - zone = data.gandi_livedns_domain.jakehowardtech.id - name = "immich" - type = "CNAME" - ttl = 3600 - values = [ +resource "desec_rrset" "jakehowardtech_immich" { + domain = desec_domain.jakehowardtech.name + subname = "immich" + type = "CNAME" + ttl = 3600 + records = [ "${gandi_livedns_record.sys_domain_pve_private.name}.${gandi_livedns_record.sys_domain_pve_private.zone}." ] } -resource "gandi_livedns_record" "jakehowardtech_photos" { - zone = data.gandi_livedns_domain.jakehowardtech.id - name = "photos" - type = "CNAME" - ttl = 3600 - values = [ +resource "desec_rrset" "jakehowardtech_photos" { + domain = desec_domain.jakehowardtech.name + subname = "photos" + type = "CNAME" + ttl = 3600 + records = [ "${gandi_livedns_record.sys_domain_pve.name}.${gandi_livedns_record.sys_domain_pve.zone}." ] } -resource "gandi_livedns_record" "jakehowardtech_freshrss" { - zone = data.gandi_livedns_domain.jakehowardtech.id - name = "freshrss" - type = "CNAME" - ttl = 3600 - values = [ +resource "desec_rrset" "jakehowardtech_freshrss" { + domain = desec_domain.jakehowardtech.name + subname = "freshrss" + type = "CNAME" + ttl = 3600 + records = [ "${gandi_livedns_record.sys_domain_pve_private.name}.${gandi_livedns_record.sys_domain_pve_private.zone}." ] } -resource "gandi_livedns_record" "jakehowardtech_atuin" { - zone = data.gandi_livedns_domain.jakehowardtech.id - name = "atuin" - type = "CNAME" - ttl = 3600 - values = [ +resource "desec_rrset" "jakehowardtech_atuin" { + domain = desec_domain.jakehowardtech.name + subname = "atuin" + type = "CNAME" + ttl = 3600 + records = [ "${gandi_livedns_record.sys_domain_pve_private.name}.${gandi_livedns_record.sys_domain_pve_private.zone}." ] } -resource "gandi_livedns_record" "jakehowardtech_karakeep" { - zone = data.gandi_livedns_domain.jakehowardtech.id - name = "karakeep" - type = "CNAME" - ttl = 3600 - values = [ +resource "desec_rrset" "jakehowardtech_karakeep" { + domain = desec_domain.jakehowardtech.name + subname = "karakeep" + type = "CNAME" + ttl = 3600 + records = [ "${gandi_livedns_record.sys_domain_pve_private.name}.${gandi_livedns_record.sys_domain_pve_private.zone}." ] } -resource "gandi_livedns_record" "jakehowardtech_caa" { - zone = data.gandi_livedns_domain.jakehowardtech.id - name = "@" - type = "CAA" - ttl = 3600 - values = [ +resource "desec_rrset" "jakehowardtech_caa" { + domain = desec_domain.jakehowardtech.name + subname = "" + type = "CAA" + ttl = 3600 + records = [ "0 issue \"letsencrypt.org\"", "0 wildissue \"letsencrypt.org\"", ] From 15520027d4b86f6e5b66f7b15bd513d202f3cd5c Mon Sep 17 00:00:00 2001 From: Jake Howard Date: Thu, 19 Feb 2026 09:01:57 +0000 Subject: [PATCH 06/12] Convert theorangeone.net to desec --- terraform/theorangeone.net.tf | 303 +++++++++++++++++----------------- 1 file changed, 151 insertions(+), 152 deletions(-) diff --git a/terraform/theorangeone.net.tf b/terraform/theorangeone.net.tf index 78123f7..8cb1b51 100644 --- a/terraform/theorangeone.net.tf +++ b/terraform/theorangeone.net.tf @@ -1,254 +1,253 @@ -data "gandi_livedns_domain" "theorangeonenet" { +resource "desec_domain" "theorangeonenet" { name = "theorangeone.net" } -resource "gandi_livedns_record" "theorangeonenet_git" { - zone = data.gandi_livedns_domain.theorangeonenet.id - name = "git" - type = "CNAME" - ttl = 3600 - values = [ +resource "desec_rrset" "theorangeonenet_git" { + domain = desec_domain.theorangeonenet.name + subname = "git" + type = "CNAME" + ttl = 3600 + records = [ "${gandi_livedns_record.sys_domain_pve.name}.${gandi_livedns_record.sys_domain_pve.zone}." ] } -resource "gandi_livedns_record" "theorangeonenet_whoami" { - zone = data.gandi_livedns_domain.theorangeonenet.id - name = "whoami" - type = "CNAME" - ttl = 3600 - values = [ +resource "desec_rrset" "theorangeonenet_whoami" { + domain = desec_domain.theorangeonenet.name + subname = "whoami" + type = "CNAME" + ttl = 3600 + records = [ "${gandi_livedns_record.sys_domain_pve.name}.${gandi_livedns_record.sys_domain_pve.zone}." ] } -resource "gandi_livedns_record" "theorangeonenet_mx" { - zone = data.gandi_livedns_domain.theorangeonenet.id - name = "@" - type = "MX" - ttl = 3600 - values = [ +resource "desec_rrset" "theorangeonenet_mx" { + domain = desec_domain.theorangeonenet.name + subname = "" + type = "MX" + ttl = 3600 + records = [ "10 in1-smtp.messagingengine.com.", "20 in2-smtp.messagingengine.com.", ] } -resource "gandi_livedns_record" "theorangeonenet_dkim_fm1" { - zone = data.gandi_livedns_domain.theorangeonenet.id - name = "fm1._domainkey" - type = "CNAME" - ttl = 3600 - values = [ +resource "desec_rrset" "theorangeonenet_dkim_fm1" { + domain = desec_domain.theorangeonenet.name + subname = "fm1._domainkey" + type = "CNAME" + ttl = 3600 + records = [ "fm1.theorangeone.net.dkim.fmhosted.com." ] } -resource "gandi_livedns_record" "theorangeonenet_dkim_fm2" { - zone = data.gandi_livedns_domain.theorangeonenet.id - name = "fm2._domainkey" - type = "CNAME" - ttl = 3600 - values = [ +resource "desec_rrset" "theorangeonenet_dkim_fm2" { + domain = desec_domain.theorangeonenet.name + subname = "fm2._domainkey" + type = "CNAME" + ttl = 3600 + records = [ "fm2.theorangeone.net.dkim.fmhosted.com." ] } -resource "gandi_livedns_record" "theorangeonenet_dkim_fm3" { - zone = data.gandi_livedns_domain.theorangeonenet.id - name = "fm3._domainkey" - type = "CNAME" - ttl = 3600 - values = [ +resource "desec_rrset" "theorangeonenet_dkim_fm3" { + domain = desec_domain.theorangeonenet.name + subname = "fm3._domainkey" + type = "CNAME" + ttl = 3600 + records = [ "fm3.theorangeone.net.dkim.fmhosted.com." ] } -resource "gandi_livedns_record" "theorangeonenet_dmarc" { - zone = data.gandi_livedns_domain.theorangeonenet.id - name = "_dmarc" - type = "TXT" - ttl = 3600 - values = [ +resource "desec_rrset" "theorangeonenet_dmarc" { + domain = desec_domain.theorangeonenet.name + subname = "_dmarc" + type = "TXT" + ttl = 3600 + records = [ "\"v=DMARC1; p=quarantine; ruf=mailto:dmarc-report@jakehoward.tech;\"" ] } -resource "gandi_livedns_record" "theorangeonenet_dmarc_report" { +resource "desec_rrset" "theorangeonenet_dmarc_report" { for_each = toset([ - data.gandi_livedns_domain.theorangeonenet.name, - data.gandi_livedns_domain.jakehowardtech.name, - "${gandi_livedns_record.theorangeonenet_mailgun_spf.name}.${gandi_livedns_record.theorangeonenet_mailgun_spf.zone}", - "${gandi_livedns_record.jakehowardtech_mailgun_spf.name}.${gandi_livedns_record.jakehowardtech_mailgun_spf.zone}" + desec_domain.theorangeonenet.name, + desec_domain.jakehowardtech.name, + "${desec_rrset.theorangeonenet_mailgun_spf.subname}.${desec_rrset.theorangeonenet_mailgun_spf.domain}", + "${desec_rrset.jakehowardtech_mailgun_spf.subname}.${desec_rrset.jakehowardtech_mailgun_spf.domain}" ]) - zone = data.gandi_livedns_domain.theorangeonenet.id - name = "${each.value}._report._dmarc" - type = "TXT" - ttl = 3600 - values = [ + domain = desec_domain.theorangeonenet.name + subname = "${each.value}._report._dmarc" + type = "TXT" + ttl = 3600 + records = [ "\"v=DMARC1\"" ] } -resource "gandi_livedns_record" "theorangeonenet_txt" { - zone = data.gandi_livedns_domain.theorangeonenet.id - name = "@" - type = "TXT" - ttl = 3600 - values = [ +resource "desec_rrset" "theorangeonenet_txt" { + domain = desec_domain.theorangeonenet.name + subname = "" + type = "TXT" + ttl = 3600 + records = [ "\"google-site-verification=IXY4iSBN_vOcM3cp_f-BgVvEI_shz1GzXuY_8dqY61o\"", "\"v=spf1 include:spf.messagingengine.com -all\"" ] } - -resource "gandi_livedns_record" "theorangeonenet_apex" { - zone = data.gandi_livedns_domain.theorangeonenet.id - name = "@" - type = "ALIAS" - ttl = 3600 - values = [ +resource "desec_rrset" "theorangeonenet_apex" { + domain = desec_domain.theorangeonenet.name + subname = "" + type = "ALIAS" + ttl = 3600 + records = [ "${gandi_livedns_record.sys_domain_walker.name}.${gandi_livedns_record.sys_domain_walker.zone}." ] } -resource "gandi_livedns_record" "theorangeonenet_srv_matrix" { - zone = data.gandi_livedns_domain.theorangeonenet.id - name = "_matrix._tcp" - type = "SRV" - ttl = 3600 - values = [ - "10 0 8448 ${gandi_livedns_record.theorangeonenet_matrix.name}.${gandi_livedns_record.theorangeonenet_matrix.zone}." +resource "desec_rrset" "theorangeonenet_srv_matrix" { + domain = desec_domain.theorangeonenet.name + subname = "_matrix._tcp" + type = "SRV" + ttl = 3600 + records = [ + "10 0 8448 ${desec_rrset.theorangeonenet_matrix.subname}.${desec_rrset.theorangeonenet_matrix.domain}." ] } -resource "gandi_livedns_record" "theorangeonenet_matrix" { - zone = data.gandi_livedns_domain.theorangeonenet.id - name = "matrix" - type = "CNAME" - ttl = 3600 - values = [ +resource "desec_rrset" "theorangeonenet_matrix" { + domain = desec_domain.theorangeonenet.name + subname = "matrix" + type = "CNAME" + ttl = 3600 + records = [ "${gandi_livedns_record.sys_domain_pve.name}.${gandi_livedns_record.sys_domain_pve.zone}." ] } -resource "gandi_livedns_record" "theorangeonenet_plausible" { - zone = data.gandi_livedns_domain.theorangeonenet.id - name = "plausible" - type = "CNAME" - ttl = 3600 - values = [ +resource "desec_rrset" "theorangeonenet_plausible" { + domain = desec_domain.theorangeonenet.name + subname = "plausible" + type = "CNAME" + ttl = 3600 + records = [ "${gandi_livedns_record.sys_domain_walker.name}.${gandi_livedns_record.sys_domain_walker.zone}." ] } -resource "gandi_livedns_record" "theorangeonenet_plausible_bare" { - zone = data.gandi_livedns_domain.theorangeonenet.id - name = "elbisualp" - type = "CNAME" - ttl = 3600 - values = [ +resource "desec_rrset" "theorangeonenet_plausible_bare" { + domain = desec_domain.theorangeonenet.name + subname = "elbisualp" + type = "CNAME" + ttl = 3600 + records = [ "${gandi_livedns_record.sys_domain_walker.name}.${gandi_livedns_record.sys_domain_walker.zone}." ] } -resource "gandi_livedns_record" "theorangeonenet_notes" { - zone = data.gandi_livedns_domain.theorangeonenet.id - name = "notes" - type = "CNAME" - ttl = 3600 - values = [ +resource "desec_rrset" "theorangeonenet_notes" { + domain = desec_domain.theorangeonenet.name + subname = "notes" + type = "CNAME" + ttl = 3600 + records = [ "realorangeone.github.io." ] } -resource "gandi_livedns_record" "theorangeonenet_bin" { - zone = data.gandi_livedns_domain.theorangeonenet.id - name = "bin" - type = "CNAME" - ttl = 3600 - values = [ +resource "desec_rrset" "theorangeonenet_bin" { + domain = desec_domain.theorangeonenet.name + subname = "bin" + type = "CNAME" + ttl = 3600 + records = [ "${gandi_livedns_record.sys_domain_pve.name}.${gandi_livedns_record.sys_domain_pve.zone}." ] } -resource "gandi_livedns_record" "theorangeonenet_mailgun_spf" { - zone = data.gandi_livedns_domain.theorangeonenet.id - name = "mg" - type = "TXT" - ttl = 3600 - values = [ +resource "desec_rrset" "theorangeonenet_mailgun_spf" { + domain = desec_domain.theorangeonenet.name + subname = "mg" + type = "TXT" + ttl = 3600 + records = [ "\"v=spf1 include:mailgun.org -all\"" ] } -resource "gandi_livedns_record" "theorangeonenet_mailgun_dkim" { - zone = data.gandi_livedns_domain.theorangeonenet.id - name = "mta._domainkey.mg" - type = "TXT" - ttl = 3600 - values = [ +resource "desec_rrset" "theorangeonenet_mailgun_dkim" { + domain = desec_domain.theorangeonenet.name + subname = "mta._domainkey.mg" + type = "TXT" + ttl = 3600 + records = [ "\"k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA1Z/MHEzpbWm5EgMkyWb+Xkz44Xrzr4SA5i2u8M2H5yZ1PSb4DpGk3IAX+I05UWax02+WBW3CBb5wU9rH9flgxezBoCf/hiMS1\" \"Wjb9hKGIBa2jMCzpF+wa5fyqLkLoAJZF4bc/BJKyi/ET2c7+DAA/2KlWv/nv4MEjcUR4hNGLPEC9+6PhUp8z2PnUQLzPRWHpKc1oLrnROWaX3XxdDekCzwyOw7ygzZdThVevE+0CqXVOt5SUSUCnd2\" \"tjVbvblGi6DBiQY5Tl6+xLqkQHCRqks9187+EN4FdJXkjQodkFzzyiBH5cXVGiZLOhal4koEvxGirr596qM97bIXiJWArdQIDAQAB\"" ] } -resource "gandi_livedns_record" "theorangeonenet_mailgun_dmarc" { - zone = data.gandi_livedns_domain.theorangeonenet.id - name = "_dmarc.mg" - type = "TXT" - ttl = 3600 - values = [ +resource "desec_rrset" "theorangeonenet_mailgun_dmarc" { + domain = desec_domain.theorangeonenet.name + subname = "_dmarc.mg" + type = "TXT" + ttl = 3600 + records = [ "\"v=DMARC1; p=quarantine; ruf=mailto:dmarc-report@jakehoward.tech;\"" ] } -resource "gandi_livedns_record" "theorangeonenet_mastodon" { - zone = data.gandi_livedns_domain.theorangeonenet.id - name = "mastodon" - type = "CNAME" - ttl = 3600 - values = [ +resource "desec_rrset" "theorangeonenet_mastodon" { + domain = desec_domain.theorangeonenet.name + subname = "mastodon" + type = "CNAME" + ttl = 3600 + records = [ "${gandi_livedns_record.sys_domain_grimes.name}.${gandi_livedns_record.sys_domain_grimes.zone}." ] } -resource "gandi_livedns_record" "theorangeonenet_comentario" { - zone = data.gandi_livedns_domain.theorangeonenet.id - name = "comentario" - type = "CNAME" - ttl = 3600 - values = [ +resource "desec_rrset" "theorangeonenet_comentario" { + domain = desec_domain.theorangeonenet.name + subname = "comentario" + type = "CNAME" + ttl = 3600 + records = [ "${gandi_livedns_record.sys_domain_walker.name}.${gandi_livedns_record.sys_domain_walker.zone}." ] } -resource "gandi_livedns_record" "theorangeonenet_bsky" { - zone = data.gandi_livedns_domain.theorangeonenet.id - name = "bsky" - type = "CNAME" - ttl = 3600 - values = [ +resource "desec_rrset" "theorangeonenet_bsky" { + domain = desec_domain.theorangeonenet.name + subname = "bsky" + type = "CNAME" + ttl = 3600 + records = [ "${gandi_livedns_record.sys_domain_grimes.name}.${gandi_livedns_record.sys_domain_grimes.zone}." ] } -resource "gandi_livedns_record" "theorangeonenet_atproto" { - zone = data.gandi_livedns_domain.theorangeonenet.id - name = "_atproto" - type = "TXT" - ttl = 3600 - values = [ +resource "desec_rrset" "theorangeonenet_atproto" { + domain = desec_domain.theorangeonenet.name + subname = "_atproto" + type = "TXT" + ttl = 3600 + records = [ "\"did=did:plc:pgyg4ih7zsqkwdon34jqkbuz\"" ] } -resource "gandi_livedns_record" "theorangeonenet_caa" { - zone = data.gandi_livedns_domain.theorangeonenet.id - name = "@" - type = "CAA" - ttl = 3600 - values = [ +resource "desec_rrset" "theorangeonenet_caa" { + domain = desec_domain.theorangeonenet.name + subname = "" + type = "CAA" + ttl = 3600 + records = [ "0 issue \"letsencrypt.org\"", "0 wildissue \"letsencrypt.org\"", ] -} +} \ No newline at end of file From 7e00571ecf2656645cfe142132c16d6bfdd8edb3 Mon Sep 17 00:00:00 2001 From: Jake Howard Date: Thu, 19 Feb 2026 09:06:22 +0000 Subject: [PATCH 07/12] Move remaining records to desec --- terraform/0rng.one.tf | 8 +-- terraform/casey_vps.tf | 4 +- terraform/grimes_vps.tf | 4 +- terraform/jakehoward.tech.tf | 48 ++++++++--------- terraform/sys_domains.tf | 98 +++++++++++++++++------------------ terraform/theorangeone.net.tf | 20 +++---- terraform/walker_vps.tf | 4 +- 7 files changed, 93 insertions(+), 93 deletions(-) diff --git a/terraform/0rng.one.tf b/terraform/0rng.one.tf index 9f58455..9d2ae95 100644 --- a/terraform/0rng.one.tf +++ b/terraform/0rng.one.tf @@ -6,7 +6,7 @@ resource "desec_rrset" "orngone_apex" { domain = desec_domain.orngone.name subname = "" type = "A" - records = gandi_livedns_record.sys_domain_walker.values + records = desec_rrset.sys_domain_walker.records ttl = 3600 } @@ -14,7 +14,7 @@ resource "desec_rrset" "orngone_apex_v6" { domain = desec_domain.orngone.name subname = "" type = "AAAA" - records = gandi_livedns_record.sys_domain_walker_v6.values + records = desec_rrset.sys_domain_walker_v6.records ttl = 3600 } @@ -30,6 +30,6 @@ resource "desec_rrset" "orngone_who" { domain = desec_domain.orngone.name subname = "who" type = "CNAME" - records = ["${gandi_livedns_record.sys_domain_pve.name}.${gandi_livedns_record.sys_domain_pve.zone}."] + records = ["${desec_rrset.sys_domain_pve.subname}.${desec_rrset.sys_domain_pve.domain}."] ttl = 3600 -} +} \ No newline at end of file diff --git a/terraform/casey_vps.tf b/terraform/casey_vps.tf index eb129a4..65d7df5 100644 --- a/terraform/casey_vps.tf +++ b/terraform/casey_vps.tf @@ -96,10 +96,10 @@ resource "linode_firewall" "casey" { resource "linode_rdns" "casey_reverse_ipv4" { address = linode_instance.casey.ip_address - rdns = "${gandi_livedns_record.sys_domain_casey.name}.${gandi_livedns_record.sys_domain_casey.zone}" + rdns = "${desec_rrset.sys_domain_casey.subname}.${desec_rrset.sys_domain_casey.domain}" } resource "linode_rdns" "casey_reverse_ipv6" { address = split("/", linode_instance.casey.ipv6)[0] - rdns = "${gandi_livedns_record.sys_domain_casey.name}.${gandi_livedns_record.sys_domain_casey.zone}" + rdns = "${desec_rrset.sys_domain_casey.subname}.${desec_rrset.sys_domain_casey.domain}" } diff --git a/terraform/grimes_vps.tf b/terraform/grimes_vps.tf index 239d92f..d183023 100644 --- a/terraform/grimes_vps.tf +++ b/terraform/grimes_vps.tf @@ -16,11 +16,11 @@ resource "hcloud_server" "grimes" { resource "hcloud_rdns" "grimes_reverse_ipv4" { server_id = hcloud_server.grimes.id ip_address = hcloud_server.grimes.ipv4_address - dns_ptr = "${gandi_livedns_record.sys_domain_grimes.name}.${gandi_livedns_record.sys_domain_grimes.zone}" + dns_ptr = "${desec_rrset.sys_domain_grimes.subname}.${desec_rrset.sys_domain_grimes.domain}" } resource "hcloud_rdns" "grimes_reverse_ipv6" { server_id = hcloud_server.grimes.id ip_address = hcloud_server.grimes.ipv6_address - dns_ptr = "${gandi_livedns_record.sys_domain_grimes.name}.${gandi_livedns_record.sys_domain_grimes.zone}" + dns_ptr = "${desec_rrset.sys_domain_grimes.subname}.${desec_rrset.sys_domain_grimes.domain}" } diff --git a/terraform/jakehoward.tech.tf b/terraform/jakehoward.tech.tf index 632c95c..b9a3866 100644 --- a/terraform/jakehoward.tech.tf +++ b/terraform/jakehoward.tech.tf @@ -69,7 +69,7 @@ resource "desec_rrset" "jakehowardtech_speed" { type = "CNAME" ttl = 3600 records = [ - "${gandi_livedns_record.sys_domain_pve.name}.${gandi_livedns_record.sys_domain_pve.zone}." + "${desec_rrset.sys_domain_pve.subname}.${desec_rrset.sys_domain_pve.domain}." ] } @@ -79,7 +79,7 @@ resource "desec_rrset" "jakehowardtech_media" { type = "CNAME" ttl = 3600 records = [ - "${gandi_livedns_record.sys_domain_pve.name}.${gandi_livedns_record.sys_domain_pve.zone}." + "${desec_rrset.sys_domain_pve.subname}.${desec_rrset.sys_domain_pve.domain}." ] } @@ -89,7 +89,7 @@ resource "desec_rrset" "jakehowardtech_matrix" { type = "CNAME" ttl = 3600 records = [ - "${gandi_livedns_record.sys_domain_pve.name}.${gandi_livedns_record.sys_domain_pve.zone}." + "${desec_rrset.sys_domain_pve.subname}.${desec_rrset.sys_domain_pve.domain}." ] } @@ -99,7 +99,7 @@ resource "desec_rrset" "jakehowardtech_intersect" { type = "CNAME" ttl = 3600 records = [ - "${gandi_livedns_record.sys_domain_pve.name}.${gandi_livedns_record.sys_domain_pve.zone}." + "${desec_rrset.sys_domain_pve.subname}.${desec_rrset.sys_domain_pve.domain}." ] } @@ -109,7 +109,7 @@ resource "desec_rrset" "jakehowardtech_calibre" { type = "CNAME" ttl = 3600 records = [ - "${gandi_livedns_record.sys_domain_pve.name}.${gandi_livedns_record.sys_domain_pve.zone}." + "${desec_rrset.sys_domain_pve.subname}.${desec_rrset.sys_domain_pve.domain}." ] } @@ -119,7 +119,7 @@ resource "desec_rrset" "jakehowardtech_homeassistant" { type = "CNAME" ttl = 3600 records = [ - "${gandi_livedns_record.sys_domain_pve_private.name}.${gandi_livedns_record.sys_domain_pve_private.zone}." + "${desec_rrset.sys_domain_pve_private.subname}.${desec_rrset.sys_domain_pve_private.domain}." ] } @@ -129,7 +129,7 @@ resource "desec_rrset" "jakehowardtech_grafana" { type = "CNAME" ttl = 3600 records = [ - "${gandi_livedns_record.sys_domain_pve.name}.${gandi_livedns_record.sys_domain_pve.zone}." + "${desec_rrset.sys_domain_pve.subname}.${desec_rrset.sys_domain_pve.domain}." ] } @@ -139,7 +139,7 @@ resource "desec_rrset" "jakehowardtech_vaultwarden" { type = "CNAME" ttl = 3600 records = [ - "${gandi_livedns_record.sys_domain_pve_private.name}.${gandi_livedns_record.sys_domain_pve_private.zone}." + "${desec_rrset.sys_domain_pve_private.subname}.${desec_rrset.sys_domain_pve_private.domain}." ] } @@ -149,7 +149,7 @@ resource "desec_rrset" "jakehowardtech_recipes" { type = "CNAME" ttl = 3600 records = [ - "${gandi_livedns_record.sys_domain_pve.name}.${gandi_livedns_record.sys_domain_pve.zone}." + "${desec_rrset.sys_domain_pve.subname}.${desec_rrset.sys_domain_pve.domain}." ] } @@ -189,7 +189,7 @@ resource "desec_rrset" "jakehowardtech_synapse_admin" { type = "CNAME" ttl = 3600 records = [ - "${gandi_livedns_record.sys_domain_pve.name}.${gandi_livedns_record.sys_domain_pve.zone}." + "${desec_rrset.sys_domain_pve.subname}.${desec_rrset.sys_domain_pve.domain}." ] } @@ -199,7 +199,7 @@ resource "desec_rrset" "jakehowardtech_apex" { type = "ALIAS" ttl = 3600 records = [ - "${gandi_livedns_record.sys_domain_walker.name}.${gandi_livedns_record.sys_domain_walker.zone}." + "${desec_rrset.sys_domain_walker.subname}.${desec_rrset.sys_domain_walker.domain}." ] } @@ -209,7 +209,7 @@ resource "desec_rrset" "jakehowardtech_collabora" { type = "CNAME" ttl = 3600 records = [ - "${gandi_livedns_record.sys_domain_pve.name}.${gandi_livedns_record.sys_domain_pve.zone}." + "${desec_rrset.sys_domain_pve.subname}.${desec_rrset.sys_domain_pve.domain}." ] } @@ -219,7 +219,7 @@ resource "desec_rrset" "jakehowardtech_tasks" { type = "CNAME" ttl = 3600 records = [ - "${gandi_livedns_record.sys_domain_pve.name}.${gandi_livedns_record.sys_domain_pve.zone}." + "${desec_rrset.sys_domain_pve.subname}.${desec_rrset.sys_domain_pve.domain}." ] } @@ -229,7 +229,7 @@ resource "desec_rrset" "jakehowardtech_auth" { type = "CNAME" ttl = 3600 records = [ - "${gandi_livedns_record.sys_domain_pve.name}.${gandi_livedns_record.sys_domain_pve.zone}." + "${desec_rrset.sys_domain_pve.subname}.${desec_rrset.sys_domain_pve.domain}." ] } @@ -239,7 +239,7 @@ resource "desec_rrset" "jakehowardtech_ntfy" { type = "CNAME" ttl = 3600 records = [ - "${gandi_livedns_record.sys_domain_pve.name}.${gandi_livedns_record.sys_domain_pve.zone}." + "${desec_rrset.sys_domain_pve.subname}.${desec_rrset.sys_domain_pve.domain}." ] } @@ -249,7 +249,7 @@ resource "desec_rrset" "jakehowardtech_headscale" { type = "CNAME" ttl = 3600 records = [ - "${gandi_livedns_record.sys_domain_casey.name}.${gandi_livedns_record.sys_domain_casey.zone}." + "${desec_rrset.sys_domain_casey.subname}.${desec_rrset.sys_domain_casey.domain}." ] } @@ -259,7 +259,7 @@ resource "desec_rrset" "jakehowardtech_slides" { type = "CNAME" ttl = 3600 records = [ - "${gandi_livedns_record.sys_domain_walker.name}.${gandi_livedns_record.sys_domain_walker.zone}." + "${desec_rrset.sys_domain_walker.subname}.${desec_rrset.sys_domain_walker.domain}." ] } @@ -269,7 +269,7 @@ resource "desec_rrset" "jakehowardtech_uptime" { type = "CNAME" ttl = 3600 records = [ - "${gandi_livedns_record.sys_domain_pve.name}.${gandi_livedns_record.sys_domain_pve.zone}." + "${desec_rrset.sys_domain_pve.subname}.${desec_rrset.sys_domain_pve.domain}." ] } @@ -279,7 +279,7 @@ resource "desec_rrset" "jakehowardtech_baby-buddy" { type = "CNAME" ttl = 3600 records = [ - "${gandi_livedns_record.sys_domain_pve_private.name}.${gandi_livedns_record.sys_domain_pve_private.zone}." + "${desec_rrset.sys_domain_pve_private.subname}.${desec_rrset.sys_domain_pve_private.domain}." ] } @@ -289,7 +289,7 @@ resource "desec_rrset" "jakehowardtech_immich" { type = "CNAME" ttl = 3600 records = [ - "${gandi_livedns_record.sys_domain_pve_private.name}.${gandi_livedns_record.sys_domain_pve_private.zone}." + "${desec_rrset.sys_domain_pve_private.subname}.${desec_rrset.sys_domain_pve_private.domain}." ] } @@ -299,7 +299,7 @@ resource "desec_rrset" "jakehowardtech_photos" { type = "CNAME" ttl = 3600 records = [ - "${gandi_livedns_record.sys_domain_pve.name}.${gandi_livedns_record.sys_domain_pve.zone}." + "${desec_rrset.sys_domain_pve.subname}.${desec_rrset.sys_domain_pve.domain}." ] } @@ -309,7 +309,7 @@ resource "desec_rrset" "jakehowardtech_freshrss" { type = "CNAME" ttl = 3600 records = [ - "${gandi_livedns_record.sys_domain_pve_private.name}.${gandi_livedns_record.sys_domain_pve_private.zone}." + "${desec_rrset.sys_domain_pve_private.subname}.${desec_rrset.sys_domain_pve_private.domain}." ] } @@ -319,7 +319,7 @@ resource "desec_rrset" "jakehowardtech_atuin" { type = "CNAME" ttl = 3600 records = [ - "${gandi_livedns_record.sys_domain_pve_private.name}.${gandi_livedns_record.sys_domain_pve_private.zone}." + "${desec_rrset.sys_domain_pve_private.subname}.${desec_rrset.sys_domain_pve_private.domain}." ] } @@ -329,7 +329,7 @@ resource "desec_rrset" "jakehowardtech_karakeep" { type = "CNAME" ttl = 3600 records = [ - "${gandi_livedns_record.sys_domain_pve_private.name}.${gandi_livedns_record.sys_domain_pve_private.zone}." + "${desec_rrset.sys_domain_pve_private.subname}.${desec_rrset.sys_domain_pve_private.domain}." ] } diff --git a/terraform/sys_domains.tf b/terraform/sys_domains.tf index 156fa22..eabc7c2 100644 --- a/terraform/sys_domains.tf +++ b/terraform/sys_domains.tf @@ -1,79 +1,79 @@ -resource "gandi_livedns_record" "sys_domain_casey" { - zone = data.gandi_livedns_domain.theorangeonenet.id - name = "casey.sys" - type = "A" - ttl = 3600 - values = [ +resource "desec_rrset" "sys_domain_casey" { + domain = desec_domain.theorangeonenet.name + subname = "casey.sys" + type = "A" + ttl = 3600 + records = [ linode_instance.casey.ip_address ] } -resource "gandi_livedns_record" "sys_domain_casey_v6" { - zone = data.gandi_livedns_domain.theorangeonenet.id - name = "casey.sys" - type = "AAAA" - ttl = 3600 - values = [ +resource "desec_rrset" "sys_domain_casey_v6" { + domain = desec_domain.theorangeonenet.name + subname = "casey.sys" + type = "AAAA" + ttl = 3600 + records = [ split("/", linode_instance.casey.ipv6)[0] ] } -resource "gandi_livedns_record" "sys_domain_walker" { - zone = data.gandi_livedns_domain.theorangeonenet.id - name = "walker.sys" - type = "A" - ttl = 3600 - values = [ +resource "desec_rrset" "sys_domain_walker" { + domain = desec_domain.theorangeonenet.name + subname = "walker.sys" + type = "A" + ttl = 3600 + records = [ hcloud_server.walker.ipv4_address ] } -resource "gandi_livedns_record" "sys_domain_walker_v6" { - zone = data.gandi_livedns_domain.theorangeonenet.id - name = "walker.sys" - type = "AAAA" - ttl = 3600 - values = [ +resource "desec_rrset" "sys_domain_walker_v6" { + domain = desec_domain.theorangeonenet.name + subname = "walker.sys" + type = "AAAA" + ttl = 3600 + records = [ hcloud_server.walker.ipv6_address ] } -resource "gandi_livedns_record" "sys_domain_pve" { - zone = data.gandi_livedns_domain.theorangeonenet.id - name = "pve.sys" - type = "A" - ttl = 3600 - values = [ +resource "desec_rrset" "sys_domain_pve" { + domain = desec_domain.theorangeonenet.name + subname = "pve.sys" + type = "A" + ttl = 3600 + records = [ linode_instance.casey.ip_address ] } -resource "gandi_livedns_record" "sys_domain_pve_private" { - zone = data.gandi_livedns_domain.theorangeonenet.id - name = "pve-private.sys" - type = "AAAA" - ttl = 3600 - values = [ +resource "desec_rrset" "sys_domain_pve_private" { + domain = desec_domain.theorangeonenet.name + subname = "pve-private.sys" + type = "AAAA" + ttl = 3600 + records = [ local.private_ipv6_marker ] } -resource "gandi_livedns_record" "sys_domain_grimes" { - zone = data.gandi_livedns_domain.theorangeonenet.id - name = "grimes.sys" - type = "A" - ttl = 3600 - values = [ +resource "desec_rrset" "sys_domain_grimes" { + domain = desec_domain.theorangeonenet.name + subname = "grimes.sys" + type = "A" + ttl = 3600 + records = [ hcloud_server.grimes.ipv4_address ] } -resource "gandi_livedns_record" "sys_domain_grimes_v6" { - zone = data.gandi_livedns_domain.theorangeonenet.id - name = "grimes.sys" - type = "AAAA" - ttl = 3600 - values = [ +resource "desec_rrset" "sys_domain_grimes_v6" { + domain = desec_domain.theorangeonenet.name + subname = "grimes.sys" + type = "AAAA" + ttl = 3600 + records = [ hcloud_server.grimes.ipv6_address ] -} +} \ No newline at end of file diff --git a/terraform/theorangeone.net.tf b/terraform/theorangeone.net.tf index 8cb1b51..d48af9d 100644 --- a/terraform/theorangeone.net.tf +++ b/terraform/theorangeone.net.tf @@ -8,7 +8,7 @@ resource "desec_rrset" "theorangeonenet_git" { type = "CNAME" ttl = 3600 records = [ - "${gandi_livedns_record.sys_domain_pve.name}.${gandi_livedns_record.sys_domain_pve.zone}." + "${desec_rrset.sys_domain_pve.subname}.${desec_rrset.sys_domain_pve.domain}." ] } @@ -18,7 +18,7 @@ resource "desec_rrset" "theorangeonenet_whoami" { type = "CNAME" ttl = 3600 records = [ - "${gandi_livedns_record.sys_domain_pve.name}.${gandi_livedns_record.sys_domain_pve.zone}." + "${desec_rrset.sys_domain_pve.subname}.${desec_rrset.sys_domain_pve.domain}." ] } @@ -107,7 +107,7 @@ resource "desec_rrset" "theorangeonenet_apex" { type = "ALIAS" ttl = 3600 records = [ - "${gandi_livedns_record.sys_domain_walker.name}.${gandi_livedns_record.sys_domain_walker.zone}." + "${desec_rrset.sys_domain_walker.subname}.${desec_rrset.sys_domain_walker.domain}." ] } @@ -127,7 +127,7 @@ resource "desec_rrset" "theorangeonenet_matrix" { type = "CNAME" ttl = 3600 records = [ - "${gandi_livedns_record.sys_domain_pve.name}.${gandi_livedns_record.sys_domain_pve.zone}." + "${desec_rrset.sys_domain_pve.subname}.${desec_rrset.sys_domain_pve.domain}." ] } @@ -137,7 +137,7 @@ resource "desec_rrset" "theorangeonenet_plausible" { type = "CNAME" ttl = 3600 records = [ - "${gandi_livedns_record.sys_domain_walker.name}.${gandi_livedns_record.sys_domain_walker.zone}." + "${desec_rrset.sys_domain_walker.subname}.${desec_rrset.sys_domain_walker.domain}." ] } @@ -147,7 +147,7 @@ resource "desec_rrset" "theorangeonenet_plausible_bare" { type = "CNAME" ttl = 3600 records = [ - "${gandi_livedns_record.sys_domain_walker.name}.${gandi_livedns_record.sys_domain_walker.zone}." + "${desec_rrset.sys_domain_walker.subname}.${desec_rrset.sys_domain_walker.domain}." ] } @@ -167,7 +167,7 @@ resource "desec_rrset" "theorangeonenet_bin" { type = "CNAME" ttl = 3600 records = [ - "${gandi_livedns_record.sys_domain_pve.name}.${gandi_livedns_record.sys_domain_pve.zone}." + "${desec_rrset.sys_domain_pve.subname}.${desec_rrset.sys_domain_pve.domain}." ] } @@ -207,7 +207,7 @@ resource "desec_rrset" "theorangeonenet_mastodon" { type = "CNAME" ttl = 3600 records = [ - "${gandi_livedns_record.sys_domain_grimes.name}.${gandi_livedns_record.sys_domain_grimes.zone}." + "${desec_rrset.sys_domain_grimes.subname}.${desec_rrset.sys_domain_grimes.domain}." ] } @@ -217,7 +217,7 @@ resource "desec_rrset" "theorangeonenet_comentario" { type = "CNAME" ttl = 3600 records = [ - "${gandi_livedns_record.sys_domain_walker.name}.${gandi_livedns_record.sys_domain_walker.zone}." + "${desec_rrset.sys_domain_walker.subname}.${desec_rrset.sys_domain_walker.domain}." ] } @@ -227,7 +227,7 @@ resource "desec_rrset" "theorangeonenet_bsky" { type = "CNAME" ttl = 3600 records = [ - "${gandi_livedns_record.sys_domain_grimes.name}.${gandi_livedns_record.sys_domain_grimes.zone}." + "${desec_rrset.sys_domain_grimes.subname}.${desec_rrset.sys_domain_grimes.domain}." ] } diff --git a/terraform/walker_vps.tf b/terraform/walker_vps.tf index 5691946..67d35a9 100644 --- a/terraform/walker_vps.tf +++ b/terraform/walker_vps.tf @@ -16,11 +16,11 @@ resource "hcloud_server" "walker" { resource "hcloud_rdns" "walker_reverse_ipv4" { server_id = hcloud_server.walker.id ip_address = hcloud_server.walker.ipv4_address - dns_ptr = "${gandi_livedns_record.sys_domain_walker.name}.${gandi_livedns_record.sys_domain_walker.zone}" + dns_ptr = "${desec_rrset.sys_domain_walker.subname}.${desec_rrset.sys_domain_walker.domain}" } resource "hcloud_rdns" "walker_reverse_ipv6" { server_id = hcloud_server.walker.id ip_address = hcloud_server.walker.ipv6_address - dns_ptr = "${gandi_livedns_record.sys_domain_walker.name}.${gandi_livedns_record.sys_domain_walker.zone}" + dns_ptr = "${desec_rrset.sys_domain_walker.subname}.${desec_rrset.sys_domain_walker.domain}" } From c2b6fd78664dc261d46cfad5ad39e5fbdca4fcd0 Mon Sep 17 00:00:00 2001 From: Jake Howard Date: Thu, 19 Feb 2026 09:11:02 +0000 Subject: [PATCH 08/12] Replace ALIAS records with direct A/AAAA records --- terraform/jakehoward.tech.tf | 14 ++++++++++---- terraform/theorangeone.net.tf | 16 +++++++++++----- 2 files changed, 21 insertions(+), 9 deletions(-) diff --git a/terraform/jakehoward.tech.tf b/terraform/jakehoward.tech.tf index b9a3866..2153eb3 100644 --- a/terraform/jakehoward.tech.tf +++ b/terraform/jakehoward.tech.tf @@ -196,11 +196,17 @@ resource "desec_rrset" "jakehowardtech_synapse_admin" { resource "desec_rrset" "jakehowardtech_apex" { domain = desec_domain.jakehowardtech.name subname = "" - type = "ALIAS" + type = "A" ttl = 3600 - records = [ - "${desec_rrset.sys_domain_walker.subname}.${desec_rrset.sys_domain_walker.domain}." - ] + records = desec_rrset.sys_domain_walker.records +} + +resource "desec_rrset" "jakehowardtech_apex_v6" { + domain = desec_domain.jakehowardtech.name + subname = "" + type = "AAAA" + ttl = 3600 + records = desec_rrset.sys_domain_walker_v6.records } resource "desec_rrset" "jakehowardtech_collabora" { diff --git a/terraform/theorangeone.net.tf b/terraform/theorangeone.net.tf index d48af9d..6e6f967 100644 --- a/terraform/theorangeone.net.tf +++ b/terraform/theorangeone.net.tf @@ -104,11 +104,17 @@ resource "desec_rrset" "theorangeonenet_txt" { resource "desec_rrset" "theorangeonenet_apex" { domain = desec_domain.theorangeonenet.name subname = "" - type = "ALIAS" + type = "A" ttl = 3600 - records = [ - "${desec_rrset.sys_domain_walker.subname}.${desec_rrset.sys_domain_walker.domain}." - ] + records = desec_rrset.sys_domain_walker.records +} + +resource "desec_rrset" "theorangeonenet_apex_v6" { + domain = desec_domain.theorangeonenet.name + subname = "" + type = "AAAA" + ttl = 3600 + records = desec_rrset.sys_domain_walker_v6.records } resource "desec_rrset" "theorangeonenet_srv_matrix" { @@ -250,4 +256,4 @@ resource "desec_rrset" "theorangeonenet_caa" { "0 issue \"letsencrypt.org\"", "0 wildissue \"letsencrypt.org\"", ] -} \ No newline at end of file +} From 0f5cffbcda181ca4000732fad7a9947bb8697257 Mon Sep 17 00:00:00 2001 From: Jake Howard Date: Fri, 20 Feb 2026 15:37:14 +0000 Subject: [PATCH 09/12] Allow terraform to create domains --- terraform/desec.tf | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/terraform/desec.tf b/terraform/desec.tf index b2b5402..190552c 100644 --- a/terraform/desec.tf +++ b/terraform/desec.tf @@ -8,7 +8,7 @@ resource "desec_token" "traefik" { resource "desec_token" "terraform" { name = "Terraform" - perm_create_domain = false + perm_create_domain = true perm_delete_domain = false perm_manage_tokens = true } From aff534b8a30bbc5309de290bd832f8ed430b6aaa Mon Sep 17 00:00:00 2001 From: Jake Howard Date: Fri, 20 Feb 2026 15:37:57 +0000 Subject: [PATCH 10/12] Move DNS TTL to local --- terraform/0rng.one.tf | 10 ++--- terraform/jakehoward.tech.tf | 70 +++++++++++++++++------------------ terraform/sys_domains.tf | 18 ++++----- terraform/theorangeone.net.tf | 50 ++++++++++++------------- terraform/variables.tf | 4 ++ 5 files changed, 78 insertions(+), 74 deletions(-) diff --git a/terraform/0rng.one.tf b/terraform/0rng.one.tf index 9d2ae95..6fd660e 100644 --- a/terraform/0rng.one.tf +++ b/terraform/0rng.one.tf @@ -7,7 +7,7 @@ resource "desec_rrset" "orngone_apex" { subname = "" type = "A" records = desec_rrset.sys_domain_walker.records - ttl = 3600 + ttl = local.dns_ttl_default } resource "desec_rrset" "orngone_apex_v6" { @@ -15,7 +15,7 @@ resource "desec_rrset" "orngone_apex_v6" { subname = "" type = "AAAA" records = desec_rrset.sys_domain_walker_v6.records - ttl = 3600 + ttl = local.dns_ttl_default } resource "desec_rrset" "orngone_caa" { @@ -23,7 +23,7 @@ resource "desec_rrset" "orngone_caa" { subname = "" type = "CAA" records = ["0 issue \"letsencrypt.org\""] - ttl = 3600 + ttl = local.dns_ttl_default } resource "desec_rrset" "orngone_who" { @@ -31,5 +31,5 @@ resource "desec_rrset" "orngone_who" { subname = "who" type = "CNAME" records = ["${desec_rrset.sys_domain_pve.subname}.${desec_rrset.sys_domain_pve.domain}."] - ttl = 3600 -} \ No newline at end of file + ttl = local.dns_ttl_default +} diff --git a/terraform/jakehoward.tech.tf b/terraform/jakehoward.tech.tf index 2153eb3..f9af508 100644 --- a/terraform/jakehoward.tech.tf +++ b/terraform/jakehoward.tech.tf @@ -6,7 +6,7 @@ resource "desec_rrset" "jakehowardtech_mx" { domain = desec_domain.jakehowardtech.name subname = "" type = "MX" - ttl = 3600 + ttl = local.dns_ttl_default records = [ "10 in1-smtp.messagingengine.com.", "20 in2-smtp.messagingengine.com.", @@ -17,7 +17,7 @@ resource "desec_rrset" "jakehowardtech_dkim_fm1" { domain = desec_domain.jakehowardtech.name subname = "fm1._domainkey" type = "CNAME" - ttl = 3600 + ttl = local.dns_ttl_default records = [ "fm1.jakehoward.tech.dkim.fmhosted.com." ] @@ -27,7 +27,7 @@ resource "desec_rrset" "jakehowardtech_dkim_fm2" { domain = desec_domain.jakehowardtech.name subname = "fm2._domainkey" type = "CNAME" - ttl = 3600 + ttl = local.dns_ttl_default records = [ "fm2.jakehoward.tech.dkim.fmhosted.com." ] @@ -37,7 +37,7 @@ resource "desec_rrset" "jakehowardtech_dkim_fm3" { domain = desec_domain.jakehowardtech.name subname = "fm3._domainkey" type = "CNAME" - ttl = 3600 + ttl = local.dns_ttl_default records = [ "fm3.jakehoward.tech.dkim.fmhosted.com." ] @@ -47,7 +47,7 @@ resource "desec_rrset" "jakehowardtech_dmarc" { domain = desec_domain.jakehowardtech.name subname = "_dmarc" type = "TXT" - ttl = 3600 + ttl = local.dns_ttl_default records = [ "\"v=DMARC1; p=quarantine; ruf=mailto:dmarc-report@jakehoward.tech;\"" ] @@ -57,7 +57,7 @@ resource "desec_rrset" "jakehowardtech_txt" { domain = desec_domain.jakehowardtech.name subname = "" type = "TXT" - ttl = 3600 + ttl = local.dns_ttl_default records = [ "\"v=spf1 include:spf.messagingengine.com -all\"" ] @@ -67,7 +67,7 @@ resource "desec_rrset" "jakehowardtech_speed" { domain = desec_domain.jakehowardtech.name subname = "speed" type = "CNAME" - ttl = 3600 + ttl = local.dns_ttl_default records = [ "${desec_rrset.sys_domain_pve.subname}.${desec_rrset.sys_domain_pve.domain}." ] @@ -77,7 +77,7 @@ resource "desec_rrset" "jakehowardtech_media" { domain = desec_domain.jakehowardtech.name subname = "media" type = "CNAME" - ttl = 3600 + ttl = local.dns_ttl_default records = [ "${desec_rrset.sys_domain_pve.subname}.${desec_rrset.sys_domain_pve.domain}." ] @@ -87,7 +87,7 @@ resource "desec_rrset" "jakehowardtech_matrix" { domain = desec_domain.jakehowardtech.name subname = "matrix" type = "CNAME" - ttl = 3600 + ttl = local.dns_ttl_default records = [ "${desec_rrset.sys_domain_pve.subname}.${desec_rrset.sys_domain_pve.domain}." ] @@ -97,7 +97,7 @@ resource "desec_rrset" "jakehowardtech_intersect" { domain = desec_domain.jakehowardtech.name subname = "intersect" type = "CNAME" - ttl = 3600 + ttl = local.dns_ttl_default records = [ "${desec_rrset.sys_domain_pve.subname}.${desec_rrset.sys_domain_pve.domain}." ] @@ -107,7 +107,7 @@ resource "desec_rrset" "jakehowardtech_calibre" { domain = desec_domain.jakehowardtech.name subname = "calibre" type = "CNAME" - ttl = 3600 + ttl = local.dns_ttl_default records = [ "${desec_rrset.sys_domain_pve.subname}.${desec_rrset.sys_domain_pve.domain}." ] @@ -117,7 +117,7 @@ resource "desec_rrset" "jakehowardtech_homeassistant" { domain = desec_domain.jakehowardtech.name subname = "homeassistant" type = "CNAME" - ttl = 3600 + ttl = local.dns_ttl_default records = [ "${desec_rrset.sys_domain_pve_private.subname}.${desec_rrset.sys_domain_pve_private.domain}." ] @@ -127,7 +127,7 @@ resource "desec_rrset" "jakehowardtech_grafana" { domain = desec_domain.jakehowardtech.name subname = "grafana" type = "CNAME" - ttl = 3600 + ttl = local.dns_ttl_default records = [ "${desec_rrset.sys_domain_pve.subname}.${desec_rrset.sys_domain_pve.domain}." ] @@ -137,7 +137,7 @@ resource "desec_rrset" "jakehowardtech_vaultwarden" { domain = desec_domain.jakehowardtech.name subname = "vaultwarden" type = "CNAME" - ttl = 3600 + ttl = local.dns_ttl_default records = [ "${desec_rrset.sys_domain_pve_private.subname}.${desec_rrset.sys_domain_pve_private.domain}." ] @@ -147,7 +147,7 @@ resource "desec_rrset" "jakehowardtech_recipes" { domain = desec_domain.jakehowardtech.name subname = "recipes" type = "CNAME" - ttl = 3600 + ttl = local.dns_ttl_default records = [ "${desec_rrset.sys_domain_pve.subname}.${desec_rrset.sys_domain_pve.domain}." ] @@ -157,7 +157,7 @@ resource "desec_rrset" "jakehowardtech_mailgun_spf" { domain = desec_domain.jakehowardtech.name subname = "mg" type = "TXT" - ttl = 3600 + ttl = local.dns_ttl_default records = [ "\"v=spf1 include:mailgun.org -all\"" ] @@ -167,7 +167,7 @@ resource "desec_rrset" "jakehowardtech_mailgun_dkim" { domain = desec_domain.jakehowardtech.name subname = "s1._domainkey.mg" type = "TXT" - ttl = 3600 + ttl = local.dns_ttl_default records = [ "\"k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA4E4cv86U+sFUjgLys26ZLccTghzGfHiFpitWdFg68lGXG63aoG2/+9bgKVT0ZBG7bjPvj6Kyj4N3TIe4oCJo2saVvtsNK1pvZ\" \"kOadaBPgjzKeRvBaw48ZatUGKoV7q1NCa0kXAfiJleF7bMvbt8rYDmBljr/BG6TtZYPt6XgoZyh8HHXjv/1L6WT3JBVQ8q5UtqVRVujXNHf57FmJTOJpvs0bKn/6TUaXYZmt5z3jpDhc/HfmkzVV22\" \"AwRf9jn7kgKkgaKpkvfSL8gtYNn5oyfS0Y9W9x9ntqb4g72RCbynMppQb1uwxbIuWRVOp0un0koQDm3C8ZzhOOYAwe58BYQIDAQAB\"" ] @@ -177,7 +177,7 @@ resource "desec_rrset" "jakehowardtech_mailgun_dmarc" { domain = desec_domain.jakehowardtech.name subname = "_dmarc.mg" type = "TXT" - ttl = 3600 + ttl = local.dns_ttl_default records = [ "\"v=DMARC1; p=quarantine; ruf=mailto:dmarc-report@jakehoward.tech;\"" ] @@ -187,7 +187,7 @@ resource "desec_rrset" "jakehowardtech_synapse_admin" { domain = desec_domain.jakehowardtech.name subname = "synapse-admin" type = "CNAME" - ttl = 3600 + ttl = local.dns_ttl_default records = [ "${desec_rrset.sys_domain_pve.subname}.${desec_rrset.sys_domain_pve.domain}." ] @@ -197,7 +197,7 @@ resource "desec_rrset" "jakehowardtech_apex" { domain = desec_domain.jakehowardtech.name subname = "" type = "A" - ttl = 3600 + ttl = local.dns_ttl_default records = desec_rrset.sys_domain_walker.records } @@ -205,7 +205,7 @@ resource "desec_rrset" "jakehowardtech_apex_v6" { domain = desec_domain.jakehowardtech.name subname = "" type = "AAAA" - ttl = 3600 + ttl = local.dns_ttl_default records = desec_rrset.sys_domain_walker_v6.records } @@ -213,7 +213,7 @@ resource "desec_rrset" "jakehowardtech_collabora" { domain = desec_domain.jakehowardtech.name subname = "collabora" type = "CNAME" - ttl = 3600 + ttl = local.dns_ttl_default records = [ "${desec_rrset.sys_domain_pve.subname}.${desec_rrset.sys_domain_pve.domain}." ] @@ -223,7 +223,7 @@ resource "desec_rrset" "jakehowardtech_tasks" { domain = desec_domain.jakehowardtech.name subname = "tasks" type = "CNAME" - ttl = 3600 + ttl = local.dns_ttl_default records = [ "${desec_rrset.sys_domain_pve.subname}.${desec_rrset.sys_domain_pve.domain}." ] @@ -233,7 +233,7 @@ resource "desec_rrset" "jakehowardtech_auth" { domain = desec_domain.jakehowardtech.name subname = "auth" type = "CNAME" - ttl = 3600 + ttl = local.dns_ttl_default records = [ "${desec_rrset.sys_domain_pve.subname}.${desec_rrset.sys_domain_pve.domain}." ] @@ -243,7 +243,7 @@ resource "desec_rrset" "jakehowardtech_ntfy" { domain = desec_domain.jakehowardtech.name subname = "ntfy" type = "CNAME" - ttl = 3600 + ttl = local.dns_ttl_default records = [ "${desec_rrset.sys_domain_pve.subname}.${desec_rrset.sys_domain_pve.domain}." ] @@ -253,7 +253,7 @@ resource "desec_rrset" "jakehowardtech_headscale" { domain = desec_domain.jakehowardtech.name subname = "headscale" type = "CNAME" - ttl = 3600 + ttl = local.dns_ttl_default records = [ "${desec_rrset.sys_domain_casey.subname}.${desec_rrset.sys_domain_casey.domain}." ] @@ -263,7 +263,7 @@ resource "desec_rrset" "jakehowardtech_slides" { domain = desec_domain.jakehowardtech.name subname = "slides" type = "CNAME" - ttl = 3600 + ttl = local.dns_ttl_default records = [ "${desec_rrset.sys_domain_walker.subname}.${desec_rrset.sys_domain_walker.domain}." ] @@ -273,7 +273,7 @@ resource "desec_rrset" "jakehowardtech_uptime" { domain = desec_domain.jakehowardtech.name subname = "uptime" type = "CNAME" - ttl = 3600 + ttl = local.dns_ttl_default records = [ "${desec_rrset.sys_domain_pve.subname}.${desec_rrset.sys_domain_pve.domain}." ] @@ -283,7 +283,7 @@ resource "desec_rrset" "jakehowardtech_baby-buddy" { domain = desec_domain.jakehowardtech.name subname = "baby-buddy" type = "CNAME" - ttl = 3600 + ttl = local.dns_ttl_default records = [ "${desec_rrset.sys_domain_pve_private.subname}.${desec_rrset.sys_domain_pve_private.domain}." ] @@ -293,7 +293,7 @@ resource "desec_rrset" "jakehowardtech_immich" { domain = desec_domain.jakehowardtech.name subname = "immich" type = "CNAME" - ttl = 3600 + ttl = local.dns_ttl_default records = [ "${desec_rrset.sys_domain_pve_private.subname}.${desec_rrset.sys_domain_pve_private.domain}." ] @@ -303,7 +303,7 @@ resource "desec_rrset" "jakehowardtech_photos" { domain = desec_domain.jakehowardtech.name subname = "photos" type = "CNAME" - ttl = 3600 + ttl = local.dns_ttl_default records = [ "${desec_rrset.sys_domain_pve.subname}.${desec_rrset.sys_domain_pve.domain}." ] @@ -313,7 +313,7 @@ resource "desec_rrset" "jakehowardtech_freshrss" { domain = desec_domain.jakehowardtech.name subname = "freshrss" type = "CNAME" - ttl = 3600 + ttl = local.dns_ttl_default records = [ "${desec_rrset.sys_domain_pve_private.subname}.${desec_rrset.sys_domain_pve_private.domain}." ] @@ -323,7 +323,7 @@ resource "desec_rrset" "jakehowardtech_atuin" { domain = desec_domain.jakehowardtech.name subname = "atuin" type = "CNAME" - ttl = 3600 + ttl = local.dns_ttl_default records = [ "${desec_rrset.sys_domain_pve_private.subname}.${desec_rrset.sys_domain_pve_private.domain}." ] @@ -333,7 +333,7 @@ resource "desec_rrset" "jakehowardtech_karakeep" { domain = desec_domain.jakehowardtech.name subname = "karakeep" type = "CNAME" - ttl = 3600 + ttl = local.dns_ttl_default records = [ "${desec_rrset.sys_domain_pve_private.subname}.${desec_rrset.sys_domain_pve_private.domain}." ] @@ -343,7 +343,7 @@ resource "desec_rrset" "jakehowardtech_caa" { domain = desec_domain.jakehowardtech.name subname = "" type = "CAA" - ttl = 3600 + ttl = local.dns_ttl_default records = [ "0 issue \"letsencrypt.org\"", "0 wildissue \"letsencrypt.org\"", diff --git a/terraform/sys_domains.tf b/terraform/sys_domains.tf index eabc7c2..140767d 100644 --- a/terraform/sys_domains.tf +++ b/terraform/sys_domains.tf @@ -2,7 +2,7 @@ resource "desec_rrset" "sys_domain_casey" { domain = desec_domain.theorangeonenet.name subname = "casey.sys" type = "A" - ttl = 3600 + ttl = local.dns_ttl_default records = [ linode_instance.casey.ip_address ] @@ -12,7 +12,7 @@ resource "desec_rrset" "sys_domain_casey_v6" { domain = desec_domain.theorangeonenet.name subname = "casey.sys" type = "AAAA" - ttl = 3600 + ttl = local.dns_ttl_default records = [ split("/", linode_instance.casey.ipv6)[0] ] @@ -22,7 +22,7 @@ resource "desec_rrset" "sys_domain_walker" { domain = desec_domain.theorangeonenet.name subname = "walker.sys" type = "A" - ttl = 3600 + ttl = local.dns_ttl_default records = [ hcloud_server.walker.ipv4_address ] @@ -32,7 +32,7 @@ resource "desec_rrset" "sys_domain_walker_v6" { domain = desec_domain.theorangeonenet.name subname = "walker.sys" type = "AAAA" - ttl = 3600 + ttl = local.dns_ttl_default records = [ hcloud_server.walker.ipv6_address ] @@ -42,7 +42,7 @@ resource "desec_rrset" "sys_domain_pve" { domain = desec_domain.theorangeonenet.name subname = "pve.sys" type = "A" - ttl = 3600 + ttl = local.dns_ttl_default records = [ linode_instance.casey.ip_address ] @@ -52,7 +52,7 @@ resource "desec_rrset" "sys_domain_pve_private" { domain = desec_domain.theorangeonenet.name subname = "pve-private.sys" type = "AAAA" - ttl = 3600 + ttl = local.dns_ttl_default records = [ local.private_ipv6_marker ] @@ -62,7 +62,7 @@ resource "desec_rrset" "sys_domain_grimes" { domain = desec_domain.theorangeonenet.name subname = "grimes.sys" type = "A" - ttl = 3600 + ttl = local.dns_ttl_default records = [ hcloud_server.grimes.ipv4_address ] @@ -72,8 +72,8 @@ resource "desec_rrset" "sys_domain_grimes_v6" { domain = desec_domain.theorangeonenet.name subname = "grimes.sys" type = "AAAA" - ttl = 3600 + ttl = local.dns_ttl_default records = [ hcloud_server.grimes.ipv6_address ] -} \ No newline at end of file +} diff --git a/terraform/theorangeone.net.tf b/terraform/theorangeone.net.tf index 6e6f967..10a7d0c 100644 --- a/terraform/theorangeone.net.tf +++ b/terraform/theorangeone.net.tf @@ -6,7 +6,7 @@ resource "desec_rrset" "theorangeonenet_git" { domain = desec_domain.theorangeonenet.name subname = "git" type = "CNAME" - ttl = 3600 + ttl = local.dns_ttl_default records = [ "${desec_rrset.sys_domain_pve.subname}.${desec_rrset.sys_domain_pve.domain}." ] @@ -16,7 +16,7 @@ resource "desec_rrset" "theorangeonenet_whoami" { domain = desec_domain.theorangeonenet.name subname = "whoami" type = "CNAME" - ttl = 3600 + ttl = local.dns_ttl_default records = [ "${desec_rrset.sys_domain_pve.subname}.${desec_rrset.sys_domain_pve.domain}." ] @@ -26,7 +26,7 @@ resource "desec_rrset" "theorangeonenet_mx" { domain = desec_domain.theorangeonenet.name subname = "" type = "MX" - ttl = 3600 + ttl = local.dns_ttl_default records = [ "10 in1-smtp.messagingengine.com.", "20 in2-smtp.messagingengine.com.", @@ -37,7 +37,7 @@ resource "desec_rrset" "theorangeonenet_dkim_fm1" { domain = desec_domain.theorangeonenet.name subname = "fm1._domainkey" type = "CNAME" - ttl = 3600 + ttl = local.dns_ttl_default records = [ "fm1.theorangeone.net.dkim.fmhosted.com." ] @@ -47,7 +47,7 @@ resource "desec_rrset" "theorangeonenet_dkim_fm2" { domain = desec_domain.theorangeonenet.name subname = "fm2._domainkey" type = "CNAME" - ttl = 3600 + ttl = local.dns_ttl_default records = [ "fm2.theorangeone.net.dkim.fmhosted.com." ] @@ -57,7 +57,7 @@ resource "desec_rrset" "theorangeonenet_dkim_fm3" { domain = desec_domain.theorangeonenet.name subname = "fm3._domainkey" type = "CNAME" - ttl = 3600 + ttl = local.dns_ttl_default records = [ "fm3.theorangeone.net.dkim.fmhosted.com." ] @@ -67,7 +67,7 @@ resource "desec_rrset" "theorangeonenet_dmarc" { domain = desec_domain.theorangeonenet.name subname = "_dmarc" type = "TXT" - ttl = 3600 + ttl = local.dns_ttl_default records = [ "\"v=DMARC1; p=quarantine; ruf=mailto:dmarc-report@jakehoward.tech;\"" ] @@ -84,7 +84,7 @@ resource "desec_rrset" "theorangeonenet_dmarc_report" { domain = desec_domain.theorangeonenet.name subname = "${each.value}._report._dmarc" type = "TXT" - ttl = 3600 + ttl = local.dns_ttl_default records = [ "\"v=DMARC1\"" ] @@ -94,7 +94,7 @@ resource "desec_rrset" "theorangeonenet_txt" { domain = desec_domain.theorangeonenet.name subname = "" type = "TXT" - ttl = 3600 + ttl = local.dns_ttl_default records = [ "\"google-site-verification=IXY4iSBN_vOcM3cp_f-BgVvEI_shz1GzXuY_8dqY61o\"", "\"v=spf1 include:spf.messagingengine.com -all\"" @@ -105,7 +105,7 @@ resource "desec_rrset" "theorangeonenet_apex" { domain = desec_domain.theorangeonenet.name subname = "" type = "A" - ttl = 3600 + ttl = local.dns_ttl_default records = desec_rrset.sys_domain_walker.records } @@ -113,7 +113,7 @@ resource "desec_rrset" "theorangeonenet_apex_v6" { domain = desec_domain.theorangeonenet.name subname = "" type = "AAAA" - ttl = 3600 + ttl = local.dns_ttl_default records = desec_rrset.sys_domain_walker_v6.records } @@ -121,7 +121,7 @@ resource "desec_rrset" "theorangeonenet_srv_matrix" { domain = desec_domain.theorangeonenet.name subname = "_matrix._tcp" type = "SRV" - ttl = 3600 + ttl = local.dns_ttl_default records = [ "10 0 8448 ${desec_rrset.theorangeonenet_matrix.subname}.${desec_rrset.theorangeonenet_matrix.domain}." ] @@ -131,7 +131,7 @@ resource "desec_rrset" "theorangeonenet_matrix" { domain = desec_domain.theorangeonenet.name subname = "matrix" type = "CNAME" - ttl = 3600 + ttl = local.dns_ttl_default records = [ "${desec_rrset.sys_domain_pve.subname}.${desec_rrset.sys_domain_pve.domain}." ] @@ -141,7 +141,7 @@ resource "desec_rrset" "theorangeonenet_plausible" { domain = desec_domain.theorangeonenet.name subname = "plausible" type = "CNAME" - ttl = 3600 + ttl = local.dns_ttl_default records = [ "${desec_rrset.sys_domain_walker.subname}.${desec_rrset.sys_domain_walker.domain}." ] @@ -151,7 +151,7 @@ resource "desec_rrset" "theorangeonenet_plausible_bare" { domain = desec_domain.theorangeonenet.name subname = "elbisualp" type = "CNAME" - ttl = 3600 + ttl = local.dns_ttl_default records = [ "${desec_rrset.sys_domain_walker.subname}.${desec_rrset.sys_domain_walker.domain}." ] @@ -161,7 +161,7 @@ resource "desec_rrset" "theorangeonenet_notes" { domain = desec_domain.theorangeonenet.name subname = "notes" type = "CNAME" - ttl = 3600 + ttl = local.dns_ttl_default records = [ "realorangeone.github.io." ] @@ -171,7 +171,7 @@ resource "desec_rrset" "theorangeonenet_bin" { domain = desec_domain.theorangeonenet.name subname = "bin" type = "CNAME" - ttl = 3600 + ttl = local.dns_ttl_default records = [ "${desec_rrset.sys_domain_pve.subname}.${desec_rrset.sys_domain_pve.domain}." ] @@ -181,7 +181,7 @@ resource "desec_rrset" "theorangeonenet_mailgun_spf" { domain = desec_domain.theorangeonenet.name subname = "mg" type = "TXT" - ttl = 3600 + ttl = local.dns_ttl_default records = [ "\"v=spf1 include:mailgun.org -all\"" ] @@ -191,7 +191,7 @@ resource "desec_rrset" "theorangeonenet_mailgun_dkim" { domain = desec_domain.theorangeonenet.name subname = "mta._domainkey.mg" type = "TXT" - ttl = 3600 + ttl = local.dns_ttl_default records = [ "\"k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA1Z/MHEzpbWm5EgMkyWb+Xkz44Xrzr4SA5i2u8M2H5yZ1PSb4DpGk3IAX+I05UWax02+WBW3CBb5wU9rH9flgxezBoCf/hiMS1\" \"Wjb9hKGIBa2jMCzpF+wa5fyqLkLoAJZF4bc/BJKyi/ET2c7+DAA/2KlWv/nv4MEjcUR4hNGLPEC9+6PhUp8z2PnUQLzPRWHpKc1oLrnROWaX3XxdDekCzwyOw7ygzZdThVevE+0CqXVOt5SUSUCnd2\" \"tjVbvblGi6DBiQY5Tl6+xLqkQHCRqks9187+EN4FdJXkjQodkFzzyiBH5cXVGiZLOhal4koEvxGirr596qM97bIXiJWArdQIDAQAB\"" ] @@ -201,7 +201,7 @@ resource "desec_rrset" "theorangeonenet_mailgun_dmarc" { domain = desec_domain.theorangeonenet.name subname = "_dmarc.mg" type = "TXT" - ttl = 3600 + ttl = local.dns_ttl_default records = [ "\"v=DMARC1; p=quarantine; ruf=mailto:dmarc-report@jakehoward.tech;\"" ] @@ -211,7 +211,7 @@ resource "desec_rrset" "theorangeonenet_mastodon" { domain = desec_domain.theorangeonenet.name subname = "mastodon" type = "CNAME" - ttl = 3600 + ttl = local.dns_ttl_default records = [ "${desec_rrset.sys_domain_grimes.subname}.${desec_rrset.sys_domain_grimes.domain}." ] @@ -221,7 +221,7 @@ resource "desec_rrset" "theorangeonenet_comentario" { domain = desec_domain.theorangeonenet.name subname = "comentario" type = "CNAME" - ttl = 3600 + ttl = local.dns_ttl_default records = [ "${desec_rrset.sys_domain_walker.subname}.${desec_rrset.sys_domain_walker.domain}." ] @@ -231,7 +231,7 @@ resource "desec_rrset" "theorangeonenet_bsky" { domain = desec_domain.theorangeonenet.name subname = "bsky" type = "CNAME" - ttl = 3600 + ttl = local.dns_ttl_default records = [ "${desec_rrset.sys_domain_grimes.subname}.${desec_rrset.sys_domain_grimes.domain}." ] @@ -241,7 +241,7 @@ resource "desec_rrset" "theorangeonenet_atproto" { domain = desec_domain.theorangeonenet.name subname = "_atproto" type = "TXT" - ttl = 3600 + ttl = local.dns_ttl_default records = [ "\"did=did:plc:pgyg4ih7zsqkwdon34jqkbuz\"" ] @@ -251,7 +251,7 @@ resource "desec_rrset" "theorangeonenet_caa" { domain = desec_domain.theorangeonenet.name subname = "" type = "CAA" - ttl = 3600 + ttl = local.dns_ttl_default records = [ "0 issue \"letsencrypt.org\"", "0 wildissue \"letsencrypt.org\"", diff --git a/terraform/variables.tf b/terraform/variables.tf index 4c3df98..545aa22 100644 --- a/terraform/variables.tf +++ b/terraform/variables.tf @@ -1,3 +1,7 @@ +locals { + dns_ttl_default = 60 * 60 +} + variable "linode_personal_access_token" { sensitive = true } From 24383bc8e008df685833bb1b2d87f62264d6f720 Mon Sep 17 00:00:00 2001 From: Jake Howard Date: Fri, 20 Feb 2026 15:49:09 +0000 Subject: [PATCH 11/12] Uninstall gandi terraform provider --- terraform/.terraform.lock.hcl | 31 ------------------------------- terraform/providers.tf | 4 ---- terraform/terraform.tf | 4 ---- terraform/variables.tf | 4 ---- 4 files changed, 43 deletions(-) diff --git a/terraform/.terraform.lock.hcl b/terraform/.terraform.lock.hcl index af0ca7a..69450e1 100644 --- a/terraform/.terraform.lock.hcl +++ b/terraform/.terraform.lock.hcl @@ -18,37 +18,6 @@ provider "registry.terraform.io/backblaze/b2" { ] } -provider "registry.terraform.io/go-gandi/gandi" { - version = "2.3.0" - constraints = "2.3.0" - hashes = [ - "h1:+QRivNRiQfXbOzSJwIKOmpqRLjfSbgGTVIot5HHaxzU=", - "h1:9kqWL+eFk/ogrQSltL9zVqjMcOqbvs3EgIJEeyNPb8U=", - "h1:Fv/rdRU74oVDL6Tmu63qNl3fUrlOfMVPUFeLaPfWAGY=", - "h1:GC+kfSRx3FdF0dhh0LZrWXV+hLSFQd3cQ3mjQ3lBloU=", - "h1:M6MNub0wFKc/2MKOns9uWsgkFEjqNx1oucz+wGemBRM=", - "h1:Os/cyXb2LCyYLvaQ7inZPBdgjR7Ie5AsyIIHvYaMZB4=", - "h1:PH6KI61eli5OL/aN3Oi7NV9qkNbjGLoOYjJK3gvULj4=", - "h1:ZYWkA1hdIjQySftM5bWAQjiH50V5qMl9nJroYzCoqb0=", - "h1:aRZN5KmJwfLJ+sSYo4xd6MHS2oNk3Zlk417md3e9ry0=", - "h1:iTw/xbYXtScXLdhbjzF15Bf9wWu/r41ZertHYl9vDec=", - "h1:q/JXh50l2WZKxRpVTXzWp7nToqaU4TXD883k6Xi+8Jk=", - "h1:sSjatD9sHwGI8jJYF7Ps7BTBbmmCmLAdlUPDs3i/vQA=", - "zh:0936d011cf75bb5162c6027d00575a586807adc9008f4152def157b6ad22bae9", - "zh:2170e671f04d3346ea416fcc404be6d05f637eab7df77e289a6898a928885f0b", - "zh:250329baae3cb09cfb88dd004d45f003ba76fbe7b8daf9d18fd640b93a2b7252", - "zh:2ccd9f253424738ca5fbbcb2127bf3713c20e87bfb3829f8c4565569424fd0bd", - "zh:3607b48bc4691cd209528f9ffe16a6cc666bd284b0d0bdfe8c4e1d538559a408", - "zh:3bc1d2b770fe0f50027da59c405b2468d1322243235367014f75f765124f458d", - "zh:6c8a9092847ee2e2890825432b54424c456638d494e49b7d1845f055214714f5", - "zh:8e0b62a330876005d52bcd65d7b1d9a679a7ac79c626e0f86661519e8f9b5698", - "zh:8f44f4d52583ff249e2001ea2a8b8841010489dd43e1a01a9ec3a6813d121c28", - "zh:9a617927d4a3a2897ff10999a19a6d1f0ef634b8c6b8fc3be12cf53948cfd9cf", - "zh:cab3c82c54e38e6001eed5b80a2d16b7824921f8f8b3909049e174c48e6e8804", - "zh:f78cc685aa4ba5056ea53a7f8ce585f87a911f0a8a387a44a33d7dfb69db7663", - ] -} - provider "registry.terraform.io/hashicorp/aws" { version = "4.67.0" constraints = "4.67.0" diff --git a/terraform/providers.tf b/terraform/providers.tf index 3e1a6a4..51f218b 100644 --- a/terraform/providers.tf +++ b/terraform/providers.tf @@ -6,10 +6,6 @@ provider "linode" { token = var.linode_personal_access_token } -provider "gandi" { - personal_access_token = var.gandi_personal_access_token -} - provider "b2" { application_key = var.backblaze_application_key application_key_id = var.backblaze_application_key_id diff --git a/terraform/terraform.tf b/terraform/terraform.tf index f0fadc5..4966907 100644 --- a/terraform/terraform.tf +++ b/terraform/terraform.tf @@ -8,10 +8,6 @@ terraform { source = "linode/linode" version = "1.30.0" } - gandi = { - source = "go-gandi/gandi" - version = "2.3.0" - } b2 = { source = "Backblaze/b2" version = "0.10.0" diff --git a/terraform/variables.tf b/terraform/variables.tf index 545aa22..5cbed5a 100644 --- a/terraform/variables.tf +++ b/terraform/variables.tf @@ -6,10 +6,6 @@ variable "linode_personal_access_token" { sensitive = true } -variable "gandi_personal_access_token" { - sensitive = true -} - variable "backblaze_application_key" { sensitive = true } From 312c318d3b6263bf76c9859679d70bd045749150 Mon Sep 17 00:00:00 2001 From: Jake Howard Date: Fri, 20 Feb 2026 15:49:29 +0000 Subject: [PATCH 12/12] Let traefik use desec terraform provider --- .../roles/traefik/files/docker-compose.yml | 1 - ansible/roles/traefik/files/traefik.yml | 2 +- ansible/roles/traefik/vars/vault.yml | 22 ++++++++----------- 3 files changed, 10 insertions(+), 15 deletions(-) diff --git a/ansible/roles/traefik/files/docker-compose.yml b/ansible/roles/traefik/files/docker-compose.yml index b2d2e14..dbca10c 100644 --- a/ansible/roles/traefik/files/docker-compose.yml +++ b/ansible/roles/traefik/files/docker-compose.yml @@ -3,7 +3,6 @@ services: image: traefik:v3 user: "{{ docker_user.id }}" environment: - - GANDIV5_PERSONAL_ACCESS_TOKEN={{ vault_gandi_personal_access_token if traefik_tls_challenge else "" }} - DESEC_TOKEN={{ vault_desec_api_token if traefik_tls_challenge else "" }} volumes: - ./traefik:/etc/traefik diff --git a/ansible/roles/traefik/files/traefik.yml b/ansible/roles/traefik/files/traefik.yml index 15adeef..be68893 100644 --- a/ansible/roles/traefik/files/traefik.yml +++ b/ansible/roles/traefik/files/traefik.yml @@ -68,7 +68,7 @@ certificatesResolvers: email: "{{ vault_letsencrypt_email }}" storage: /etc/traefik/acme.json dnsChallenge: - provider: gandiv5 + provider: desec delayBeforeCheck: 0s resolvers: - 9.9.9.9:53 diff --git a/ansible/roles/traefik/vars/vault.yml b/ansible/roles/traefik/vars/vault.yml index b8f329d..1daad4b 100644 --- a/ansible/roles/traefik/vars/vault.yml +++ b/ansible/roles/traefik/vars/vault.yml @@ -1,14 +1,10 @@ $ANSIBLE_VAULT;1.1;AES256 -35363536626532316139376436633932653737643236306236323030663264336132383963366234 -3064393838323564656164626134393336356364346462620a333730363761653964323637376439 -39366537616633346461636338633763626131346132366634363837626531343636383362663262 -6265343632303862340a363865613636613363396166346566353463353565663864653835303039 -30396630306131343564363839343862666439306362313661363234366663663034653262303232 -39616537313030633435316262343961343634336666636534393436353730383038316564346430 -38303466303265306139663439643437383538333137386334393738306237643062376566383332 -31383335333533383236316233386537366533663237313535363031613739303561663166373365 -31383632316664313334663539303936383239396266623236336333666131393563656662643461 -36383931353461613364373762333330383732626637346139613763616534306563663232396135 -34343835346634653663623664643661626539376231396439653436393666383930343332333961 -30326333306663353035363530653030646138626630656531346133656362623866306337373765 -62643832353961383230626333373262643432626630653930316434663631663234 +37396663623335333737663732353637333533363237653532633865663063343933373566383565 +6434663864643236616564623062306135326333346533620a663864326137653563656134316639 +64623865656164373337626231656638386363376133666366323738386639616530353937336338 +3764333064323231310a373463353764633562316233656366373561373731653836316136333730 +31373734326665666462363330326161303038646363326165653366666663333836313137633161 +33316130303539616337633262303731326562663932343139646463653034306562313065613137 +65346539346464303438653838643939313362313437623938623938636562366561623264646538 +32383432616566326466336336336537356539366563653765323039363236363738363234633633 +32613330646132346364343234613765313365616230623061353764363662303236