Skip to content

Commit 59d24c9

Browse files
comborcombor
committed
Deduplicate DNS records with for_each and add moved blocks
- Consolidate internal, external, and DKIM CNAME records using for_each - Replace heredoc JSON policy with jsonencode() - Add moved.tf for automatic state migration
1 parent 68434ff commit 59d24c9

3 files changed

Lines changed: 128 additions & 136 deletions

File tree

‎dns.tf‎

Lines changed: 47 additions & 110 deletions
Original file line numberDiff line numberDiff line change
@@ -1,147 +1,84 @@
1+
locals {
2+
internal_cnames = toset(["unifi", "sonarr", "radarr", "prowlarr", "deluge", "adguard"])
3+
external_cnames = toset(["plex", "overseerr", "photos"])
4+
proton_dkim = toset(["protonmail", "protonmail2", "protonmail3"])
5+
}
6+
17
resource "aws_route53_zone" "kombor-ski" {
28
name = "kombor.ski"
39
}
410

5-
resource "aws_route53_record" "unifi" {
11+
resource "aws_route53_record" "server" {
12+
zone_id = aws_route53_zone.kombor-ski.zone_id
13+
name = "server.kombor.ski"
14+
type = "A"
15+
ttl = 3600
16+
records = ["172.31.255.3"]
17+
}
18+
19+
resource "aws_route53_record" "lidarr" {
620
zone_id = aws_route53_zone.kombor-ski.zone_id
7-
name = "unifi.kombor.ski"
8-
type = "CNAME"
9-
ttl = "3600"
10-
records = ["server.kombor.ski"]
21+
name = "lidarr.kombor.ski"
22+
type = "A"
23+
ttl = 3600
24+
records = ["172.31.255.3"]
25+
}
26+
27+
resource "aws_route53_record" "internal" {
28+
for_each = local.internal_cnames
29+
zone_id = aws_route53_zone.kombor-ski.zone_id
30+
name = "${each.key}.kombor.ski"
31+
type = "CNAME"
32+
ttl = 3600
33+
records = ["server.kombor.ski"]
34+
}
35+
36+
resource "aws_route53_record" "external" {
37+
for_each = local.external_cnames
38+
zone_id = aws_route53_zone.kombor-ski.zone_id
39+
name = "${each.key}.kombor.ski"
40+
type = "CNAME"
41+
ttl = 3600
42+
records = ["ciepla-zupa.chickenkiller.com"]
1143
}
1244

1345
resource "aws_route53_record" "caa" {
1446
zone_id = aws_route53_zone.kombor-ski.zone_id
1547
name = "kombor.ski"
1648
type = "CAA"
17-
ttl = "3600"
49+
ttl = 3600
1850
records = ["0 issue \"letsencrypt.org\""]
1951
}
2052

2153
resource "aws_route53_record" "proton_verification" {
2254
zone_id = aws_route53_zone.kombor-ski.zone_id
2355
name = "kombor.ski"
2456
type = "TXT"
25-
ttl = "3600"
57+
ttl = 3600
2658
records = ["protonmail-verification=3ab66f95a1d68e13eb6e4cb285c8075bccd998db", "v=spf1 include:_spf.protonmail.ch mx ~all", "v=DMARC1; p=quarantine"]
2759
}
2860

2961
resource "aws_route53_record" "dmarc" {
3062
zone_id = aws_route53_zone.kombor-ski.zone_id
3163
name = "_dmarc.kombor.ski"
3264
type = "TXT"
33-
ttl = "3600"
65+
ttl = 3600
3466
records = ["v=DMARC1; p=quarantine"]
3567
}
3668

3769
resource "aws_route53_record" "proton_dkim" {
38-
zone_id = aws_route53_zone.kombor-ski.zone_id
39-
name = "protonmail._domainkey.kombor.ski"
40-
type = "CNAME"
41-
ttl = "3600"
42-
records = ["protonmail.domainkey.dbjmzzyfyzyrvfq7cfoza4htlq44zbjkph6eu6zqezt7xx3bgaoxa.domains.proton.ch"]
43-
}
44-
45-
resource "aws_route53_record" "proton_dkim2" {
46-
zone_id = aws_route53_zone.kombor-ski.zone_id
47-
name = "protonmail2._domainkey.kombor.ski"
48-
type = "CNAME"
49-
ttl = "3600"
50-
records = ["protonmail2.domainkey.dbjmzzyfyzyrvfq7cfoza4htlq44zbjkph6eu6zqezt7xx3bgaoxa.domains.proton.ch"]
51-
}
52-
53-
resource "aws_route53_record" "proton_dkim3" {
54-
zone_id = aws_route53_zone.kombor-ski.zone_id
55-
name = "protonmail3._domainkey.kombor.ski"
56-
type = "CNAME"
57-
ttl = "3600"
58-
records = ["protonmail3.domainkey.dbjmzzyfyzyrvfq7cfoza4htlq44zbjkph6eu6zqezt7xx3bgaoxa.domains.proton.ch"]
70+
for_each = local.proton_dkim
71+
zone_id = aws_route53_zone.kombor-ski.zone_id
72+
name = "${each.key}._domainkey.kombor.ski"
73+
type = "CNAME"
74+
ttl = 3600
75+
records = ["${each.key}.domainkey.dbjmzzyfyzyrvfq7cfoza4htlq44zbjkph6eu6zqezt7xx3bgaoxa.domains.proton.ch"]
5976
}
6077

6178
resource "aws_route53_record" "proton_mx" {
6279
zone_id = aws_route53_zone.kombor-ski.zone_id
6380
name = "kombor.ski"
6481
type = "MX"
65-
ttl = "3600"
82+
ttl = 3600
6683
records = ["10 mail.protonmail.ch", "20 mailsec.protonmail.ch"]
6784
}
68-
69-
resource "aws_route53_record" "external" {
70-
zone_id = aws_route53_zone.kombor-ski.zone_id
71-
name = "plex.kombor.ski"
72-
type = "CNAME"
73-
ttl = "3600"
74-
records = ["ciepla-zupa.chickenkiller.com"]
75-
}
76-
77-
resource "aws_route53_record" "overseerr" {
78-
zone_id = aws_route53_zone.kombor-ski.zone_id
79-
name = "overseerr.kombor.ski"
80-
type = "CNAME"
81-
ttl = "3600"
82-
records = ["ciepla-zupa.chickenkiller.com"]
83-
}
84-
85-
resource "aws_route53_record" "server" {
86-
zone_id = aws_route53_zone.kombor-ski.zone_id
87-
name = "server.kombor.ski"
88-
type = "A"
89-
ttl = "3600"
90-
records = ["172.31.255.3"]
91-
}
92-
93-
resource "aws_route53_record" "sonarr" {
94-
zone_id = aws_route53_zone.kombor-ski.zone_id
95-
name = "sonarr.kombor.ski"
96-
type = "CNAME"
97-
ttl = "3600"
98-
records = ["server.kombor.ski"]
99-
}
100-
101-
resource "aws_route53_record" "radarr" {
102-
zone_id = aws_route53_zone.kombor-ski.zone_id
103-
name = "radarr.kombor.ski"
104-
type = "CNAME"
105-
ttl = "3600"
106-
records = ["server.kombor.ski"]
107-
}
108-
109-
resource "aws_route53_record" "prowlarr" {
110-
zone_id = aws_route53_zone.kombor-ski.zone_id
111-
name = "prowlarr.kombor.ski"
112-
type = "CNAME"
113-
ttl = "3600"
114-
records = ["server.kombor.ski"]
115-
}
116-
117-
resource "aws_route53_record" "deluge" {
118-
zone_id = aws_route53_zone.kombor-ski.zone_id
119-
name = "deluge.kombor.ski"
120-
type = "CNAME"
121-
ttl = "3600"
122-
records = ["server.kombor.ski"]
123-
}
124-
125-
resource "aws_route53_record" "adguard" {
126-
zone_id = aws_route53_zone.kombor-ski.zone_id
127-
name = "adguard.kombor.ski"
128-
type = "CNAME"
129-
ttl = "3600"
130-
records = ["server.kombor.ski"]
131-
}
132-
133-
resource "aws_route53_record" "photos" {
134-
zone_id = aws_route53_zone.kombor-ski.zone_id
135-
name = "photos.kombor.ski"
136-
type = "CNAME"
137-
ttl = "3600"
138-
records = ["ciepla-zupa.chickenkiller.com"]
139-
}
140-
141-
resource "aws_route53_record" "lidarr" {
142-
zone_id = aws_route53_zone.kombor-ski.zone_id
143-
name = "lidarr.kombor.ski"
144-
type = "A"
145-
ttl = "3600"
146-
records = ["172.31.255.3"]
147-
}

‎moved.tf‎

Lines changed: 59 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,59 @@
1+
moved {
2+
from = aws_route53_record.unifi
3+
to = aws_route53_record.internal["unifi"]
4+
}
5+
6+
moved {
7+
from = aws_route53_record.sonarr
8+
to = aws_route53_record.internal["sonarr"]
9+
}
10+
11+
moved {
12+
from = aws_route53_record.radarr
13+
to = aws_route53_record.internal["radarr"]
14+
}
15+
16+
moved {
17+
from = aws_route53_record.prowlarr
18+
to = aws_route53_record.internal["prowlarr"]
19+
}
20+
21+
moved {
22+
from = aws_route53_record.deluge
23+
to = aws_route53_record.internal["deluge"]
24+
}
25+
26+
moved {
27+
from = aws_route53_record.adguard
28+
to = aws_route53_record.internal["adguard"]
29+
}
30+
31+
moved {
32+
from = aws_route53_record.external
33+
to = aws_route53_record.external["plex"]
34+
}
35+
36+
moved {
37+
from = aws_route53_record.overseerr
38+
to = aws_route53_record.external["overseerr"]
39+
}
40+
41+
moved {
42+
from = aws_route53_record.photos
43+
to = aws_route53_record.external["photos"]
44+
}
45+
46+
moved {
47+
from = aws_route53_record.proton_dkim
48+
to = aws_route53_record.proton_dkim["protonmail"]
49+
}
50+
51+
moved {
52+
from = aws_route53_record.proton_dkim2
53+
to = aws_route53_record.proton_dkim["protonmail2"]
54+
}
55+
56+
moved {
57+
from = aws_route53_record.proton_dkim3
58+
to = aws_route53_record.proton_dkim["protonmail3"]
59+
}

‎users.tf‎

Lines changed: 22 additions & 26 deletions
Original file line numberDiff line numberDiff line change
@@ -15,30 +15,26 @@ resource "aws_iam_user_policy" "traefik" {
1515
name = "traefik"
1616
user = aws_iam_user.traefik.name
1717

18-
policy = <<EOF
19-
{
20-
"Version": "2012-10-17",
21-
"Statement": [
22-
{
23-
"Sid": "",
24-
"Effect": "Allow",
25-
"Action": [
26-
"route53:GetChange",
27-
"route53:ChangeResourceRecordSets",
28-
"route53:ListResourceRecordSets"
29-
],
30-
"Resource": [
31-
"arn:aws:route53:::hostedzone/*",
32-
"arn:aws:route53:::change/*"
33-
]
34-
},
35-
{
36-
"Sid": "",
37-
"Effect": "Allow",
38-
"Action": [ "route53:ListHostedZonesByName", "route53:ListHostedZones" ],
39-
"Resource": "*"
40-
}
41-
]
42-
}
43-
EOF
18+
policy = jsonencode({
19+
Version = "2012-10-17"
20+
Statement = [
21+
{
22+
Effect = "Allow"
23+
Action = [
24+
"route53:GetChange",
25+
"route53:ChangeResourceRecordSets",
26+
"route53:ListResourceRecordSets",
27+
]
28+
Resource = [
29+
"arn:aws:route53:::hostedzone/*",
30+
"arn:aws:route53:::change/*",
31+
]
32+
},
33+
{
34+
Effect = "Allow"
35+
Action = ["route53:ListHostedZonesByName", "route53:ListHostedZones"]
36+
Resource = "*"
37+
},
38+
]
39+
})
4440
}

0 commit comments

Comments
 (0)