dns/terraform/search.gov.tf at main · GSA-TTS/dns · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
resource "aws_route53_zone" "search_toplevel" {
  name = "search.gov"

  tags = {
    Project = "dns"
  }
}

resource "aws_route53_record" "search_gov_apex" {
  zone_id = aws_route53_zone.search_toplevel.zone_id
  name    = "search.gov."
  type    = "A"

  alias {
    name                   = "d3b0ro7nh4961l.cloudfront.net."
    zone_id                = local.cloudfront_zone_id
    evaluate_target_health = false
  }
}

resource "aws_route53_record" "search_gov_apex_aaaa" {
  zone_id = aws_route53_zone.search_toplevel.zone_id
  name    = "search.gov."
  type    = "AAAA"

  alias {
    name                   = "d3b0ro7nh4961l.cloudfront.net."
    zone_id                = local.cloudfront_zone_id
    evaluate_target_health = false
  }
}

resource "aws_route53_record" "search_gov_www_cname" {
  zone_id = aws_route53_zone.search_toplevel.zone_id
  name    = "www.search.gov."
  type    = "CNAME"
  ttl     = 120
  records = ["www.search.gov.external-domains-production.cloud.gov."]
}

resource "aws_route53_record" "search_gov_acme_challenge" {
  zone_id = aws_route53_zone.search_toplevel.zone_id
  name    = "_acme-challenge.search.gov."
  type    = "CNAME"
  ttl     = 120
  records = ["_acme-challenge.search.gov.external-domains-production.cloud.gov."]
}

resource "aws_route53_record" "www_search_gov_acme_challenge" {
  zone_id = aws_route53_zone.search_toplevel.zone_id
  name    = "_acme-challenge.www.search.gov."
  type    = "CNAME"
  ttl     = 120
  records = ["_acme-challenge.www.search.gov.external-domains-production.cloud.gov."]
}


## TEMPORARY for validation of planned hosting setup 2025-08-08
resource "aws_route53_record" "whtnfrvemzeq_search_gov_acme_challenge" {
  zone_id = aws_route53_zone.search_toplevel.zone_id
  name    = "_acme-challenge.whtnfrvemzeq.search.gov."
  type    = "CNAME"
  ttl     = 120
  records = ["_acme-challenge.whtnfrvemzeq.search.gov.external-domains-production.cloud.gov."]
}

## TEMPORARY for validation of planned hosting setup 2025-08-08
resource "aws_route53_record" "search_gov_whtnfrvemzeq" {
  zone_id = aws_route53_zone.search_toplevel.zone_id
  name    = "whtnfrvemzeq.search.gov."
  type    = "CNAME"
  ttl     = 120
  records = ["whtnfrvemzeq.search.gov.external-domains-production.cloud.gov."]
}

# find.search.gov
resource "aws_route53_record" "search_gov_find" {
  zone_id = aws_route53_zone.search_toplevel.zone_id
  name    = "find.search.gov."
  type    = "CNAME"
  ttl     = 5
  records = ["search.usa.gov."]
}

# admin-center-downtime.search.gov
resource "aws_route53_record" "search_gov_downtime" {
  zone_id = aws_route53_zone.search_toplevel.zone_id
  name    = "admin-center-downtime.search.gov."
  type    = "CNAME"
  records = ["admin-center-downtime.search.usa.gov."]
  ttl     = "300"
}

# Email
resource "aws_route53_record" "search_gov_mx" {
  zone_id = aws_route53_zone.search_toplevel.zone_id
  name    = "search.gov."
  type    = "MX"
  ttl     = 300
  records = ["10 inbound-smtp.us-east-1.amazonaws.com."]
}

resource "aws_route53_record" "search_gov__amazonses_search_gov_txt" {
  zone_id = aws_route53_zone.search_toplevel.zone_id
  name    = "_amazonses.search.gov."
  type    = "TXT"
  ttl     = 300
  records = ["bhZh0ZXP7e8vJ1zeTFVBUn/n1rE5NHWBzOIgVG71swI="]
}

# Proof of ownership over the domain for DKIM
resource "aws_route53_record" "search_gov_ses_cname_1" {
  zone_id = aws_route53_zone.search_toplevel.zone_id
  name    = "xwqqkvd3oiguazj5xtri4l2quk2slsjr._domainkey.search.gov"
  type    = "CNAME"
  ttl     = 1800
  records = ["xwqqkvd3oiguazj5xtri4l2quk2slsjr.dkim.amazonses.com"]
}

resource "aws_route53_record" "search_gov_ses_cname_2" {
  zone_id = aws_route53_zone.search_toplevel.zone_id
  name    = "e6bt5rkriehhccrznsjdtdftttuzacn7._domainkey.search.gov"
  type    = "CNAME"
  ttl     = 1800
  records = ["e6bt5rkriehhccrznsjdtdftttuzacn7.dkim.amazonses.com"]
}

resource "aws_route53_record" "search_gov_ses_cname_3" {
  zone_id = aws_route53_zone.search_toplevel.zone_id
  name    = "476wutugvn6kvv42jtwtgaggzogsyvje._domainkey.search.gov"
  type    = "CNAME"
  ttl     = 1800
  records = ["476wutugvn6kvv42jtwtgaggzogsyvje.dkim.amazonses.com"]
}

module "search_gov__email_security" {
  source = "./email_security"

  zone_id     = aws_route53_zone.search_toplevel.zone_id
  txt_records = ["v=spf1 include:amazonses.com include:mail.zendesk.com include:_spf.google.com -all"]
}

output "search_ns" {
  value = aws_route53_zone.search_toplevel.name_servers
}