AI: Terraform DNS scaffold (BIND9) — terraform/records.tf

terraform/records.tf

@@ -1,58 +1,64 @@
-# One A record set per name that points at the home server.
-# Adding a subdomain later = adding one entry to home_names + apply.
-locals {
-  home_names = ["@", "www"]
+# One resource per record set. Each apply sends BIND a signed update
+# making the live RRset match what's declared here - and nothing else:
+# records BIND holds that Terraform doesn't declare are left alone.
+
+# The apex: jonathanmccaffrey.com itself.
+resource "dns_a_record_set" "root" {
+  zone      = "${var.domain}."
+  addresses = [var.home_ip]
+  ttl       = 300
 }
 
-resource "powerdns_record" "home_a" {
-  for_each = toset(local.home_names)
-
-  zone    = powerdns_zone.main.name
-  name    = each.value == "@" ? "${var.domain}." : "${each.value}.${var.domain}."
-  type    = "A"
-  ttl     = 300
-  records = [var.home_ip]
+resource "dns_a_record_set" "www" {
+  zone      = "${var.domain}."
+  name      = "www"
+  addresses = [var.home_ip]
+  ttl       = 300
 }
 
 # The nameserver's own name needs an A record in the zone too.
 # (The copy the registrar holds is the glue; this is the in-zone one.
 # They must agree.)
-resource "powerdns_record" "ns1_a" {
-  zone    = powerdns_zone.main.name
-  name    = "ns1.${var.domain}."
-  type    = "A"
-  ttl     = 3600
-  records = [var.home_ip]
+resource "dns_a_record_set" "ns1" {
+  zone      = "${var.domain}."
+  name      = "ns1"
+  addresses = [var.home_ip]
+  ttl       = 3600
 }
 
+# The apex NS records and the SOA live in the seed zone file only
+# (../bind9/zones/): this provider can't address an NS set at the
+# zone apex - its name argument refuses to be empty. BIND serves
+# them from the file; they change about as often as the delegation
+# does, i.e. almost never. If the secondary changes someday, edit
+# the NS lines in the zone file to match the CanSpace delegation.
+
 # --- Everything else in the current CanSpace zone goes into blocks
 # --- like the ones below. Copy the real values over BEFORE delegating
 # --- anything to this server, or the records stop existing in public.
 
 # MX example (delete the block if the domain has no mail):
-# resource "powerdns_record" "mx" {
-#   zone    = powerdns_zone.main.name
-#   name    = "${var.domain}."
-#   type    = "MX"
-#   ttl     = 3600
-#   records = ["10 mail.${var.domain}."]
+# resource "dns_mx_record_set" "mx" {
+#   zone = "${var.domain}."
+#   ttl  = 3600
+#
+#   exchange {
+#     preference = 10
+#     exchange   = "mail.${var.domain}."
+#   }
 # }
 
-# TXT example (SPF, domain verification, ...). Note the embedded
-# quotes: PowerDNS stores TXT content quoted.
-# resource "powerdns_record" "txt_root" {
-#   zone    = powerdns_zone.main.name
-#   name    = "${var.domain}."
-#   type    = "TXT"
-#   ttl     = 3600
-#   records = ["\"v=spf1 -all\""]
+# TXT example (SPF, domain verification, ...):
+# resource "dns_txt_record_set" "txt_root" {
+#   zone = "${var.domain}."
+#   ttl  = 3600
+#   txt  = ["v=spf1 -all"]
 # }
 
 # CNAME example:
-# resource "powerdns_record" "blog" {
-#   zone    = powerdns_zone.main.name
-#   name    = "blog.${var.domain}."
-#   type    = "CNAME"
-#   ttl     = 3600
-#   records = ["${var.domain}."]
+# resource "dns_cname_record" "blog" {
+#   zone  = "${var.domain}."
+#   name  = "blog"
+#   ttl   = 3600
+#   cname = "${var.domain}."
 # }