diff --git a/.gitignore b/.gitignore index 2b2cdd2..de2b79d 100644 --- a/.gitignore +++ b/.gitignore @@ -1,4 +1,3 @@ -# vim swap files **/*.sw[po] # don't commit terraform state or lock. the repo code is the only state we care about. @@ -6,13 +5,10 @@ **/.terraform.lock.hcl **/.terraform -# IDE Folders **/.vscode -# Mac Finder cache **/.DS_Store -# Plan output plan-output.txt # Generated pre-commit configuration diff --git a/AGENTS.md b/AGENTS.md index f6ab334..d1eae6b 100644 --- a/AGENTS.md +++ b/AGENTS.md @@ -51,3 +51,17 @@ Cloudflare provider 5.20 and later supports `dns_search_suffixes` on Zero Trust device profiles. Local Domain Fallback is different: it selects which resolver handles matching domains and does not configure the operating system's DNS search suffix list. + +## Importing Zone Settings + +Cloudflare zone-setting import IDs use `/`. Obtain the +zone ID through the approved local secret workflow, then import each managed +setting explicitly, for example: + +```bash +tofu import cloudflare_zone_setting.cache_level "$ZONE_ID/cache_level" +tofu import cloudflare_zone_setting.browser_cache_ttl "$ZONE_ID/browser_cache_ttl" +tofu import cloudflare_zone_setting.browser_check "$ZONE_ID/browser_check" +tofu import cloudflare_zone_setting.challenge_ttl "$ZONE_ID/challenge_ttl" +tofu import cloudflare_zone_setting.minify "$ZONE_ID/minify" +``` diff --git a/cf-access-k3s.tf b/cf-access-k3s.tf index ab0616f..15b6659 100644 --- a/cf-access-k3s.tf +++ b/cf-access-k3s.tf @@ -1,5 +1,3 @@ -# Cloudflare Access application protecting the k3s API server tunnel. -# # Pairs with the TunnelBinding in kustomize-cluster (workloads/kubectl-tunnel) # that fronts kubernetes.default.svc:443 over k3s.makeitwork.cloud as a TCP # tunnel. Clients reach the apiserver via: diff --git a/cf-cache.tf b/cf-cache.tf index a7e7305..adaf84a 100644 --- a/cf-cache.tf +++ b/cf-cache.tf @@ -1,11 +1,3 @@ -# Zone-level cache and performance settings -# Import commands (replace $ZONE_ID with cloudflare_zone_id from secrets): -# tofu import cloudflare_zone_setting.cache_level $ZONE_ID/cache_level -# tofu import cloudflare_zone_setting.browser_cache_ttl $ZONE_ID/browser_cache_ttl -# tofu import cloudflare_zone_setting.browser_check $ZONE_ID/browser_check -# tofu import cloudflare_zone_setting.challenge_ttl $ZONE_ID/challenge_ttl -# tofu import cloudflare_zone_setting.minify $ZONE_ID/minify - resource "cloudflare_zone_setting" "cache_level" { zone_id = local.zone_id setting_id = "cache_level" @@ -64,9 +56,6 @@ resource "cloudflare_zone_setting" "polish" { value = "off" } -# Note: prefetch_preload requires Cloudflare Pro plan or higher - -# Cache rule for static HTML at root domain resource "cloudflare_ruleset" "cache_rules" { zone_id = local.zone_id name = "Cache Rules" @@ -81,7 +70,7 @@ resource "cloudflare_ruleset" "cache_rules" { cache = true edge_ttl = { mode = "override_origin" - default = 3600 # 1 hour edge cache + default = 3600 } browser_ttl = { mode = "respect_origin" diff --git a/cf-dns.tf b/cf-dns.tf index af7f49c..0df6b5e 100644 --- a/cf-dns.tf +++ b/cf-dns.tf @@ -42,7 +42,6 @@ resource "cloudflare_dns_record" "spf" { ttl = 1 } -# Onion hidden service static site resource "cloudflare_dns_record" "onion" { zone_id = local.zone_id type = "CNAME" diff --git a/cf-tunnels.tf b/cf-tunnels.tf index 09b6592..7840ddc 100644 --- a/cf-tunnels.tf +++ b/cf-tunnels.tf @@ -1,5 +1,3 @@ -# Cloudflare Tunnels — connect cloudflared pods to Cloudflare's edge. -# # The cluster-apps tunnel is created and owned by cloudflare-operator # (see kustomize-cluster/operators/cloudflare/cluster-tunnel.yaml). Tunnel # credentials live in the cluster's Secret. CNAME records for the apps diff --git a/cf-warp.tf b/cf-warp.tf index 0583a95..75f3cad 100644 --- a/cf-warp.tf +++ b/cf-warp.tf @@ -1,6 +1,3 @@ -# Zero Trust / WARP configuration - -# Organization settings resource "cloudflare_zero_trust_organization" "main" { account_id = local.account_id name = "makeitworkcloud.cloudflareaccess.com" @@ -13,7 +10,6 @@ resource "cloudflare_zero_trust_organization" "main" { is_ui_read_only = false } -# GitHub identity provider for WARP enrollment resource "cloudflare_zero_trust_access_identity_provider" "github" { account_id = local.account_id name = "GitHub" @@ -25,7 +21,6 @@ resource "cloudflare_zero_trust_access_identity_provider" "github" { } } -# Access group for makeitworkcloud admins resource "cloudflare_zero_trust_access_group" "admins" { account_id = local.account_id name = "makeitworkcloud-admins" @@ -39,19 +34,16 @@ resource "cloudflare_zero_trust_access_group" "admins" { }] } -# WARP enrollment application resource "cloudflare_zero_trust_access_application" "warp" { account_id = local.account_id name = "Warp Login App" type = "warp" session_duration = "24h" - # Only GitHub SSO allowed for WARP enrollment allowed_idps = [ cloudflare_zero_trust_access_identity_provider.github.id, ] - # Policies managed by Terraform policies = [ { name = "makeitworkcloud-admins" diff --git a/main.tf b/main.tf index 8874340..8f16a8e 100644 --- a/main.tf +++ b/main.tf @@ -8,7 +8,6 @@ locals { github_warp_client_id = data.sops_file.secret_vars.data["github_warp_client_id"] github_warp_client_secret = data.sops_file.secret_vars.data["github_warp_client_secret"] - # Private networks (CIDR protected via SOPS) warp_private_network = data.sops_file.secret_vars.data["warp_private_network"] } diff --git a/opencode.json b/opencode.json index 5289d54..f7777ca 100644 --- a/opencode.json +++ b/opencode.json @@ -16,6 +16,7 @@ "aws-prod": {"enabled": false}, "grafana": {"enabled": false}, "terraform-docs": {"enabled": false}, + "argocd-makeitwork": {"enabled": true}, "argocd-staging-eks": {"enabled": false}, "argocd-prod-eks": {"enabled": false} }, @@ -30,6 +31,7 @@ "aws-prod_*": false, "grafana_*": false, "terraform-docs_*": false, + "argocd-makeitwork_*": true, "argocd-staging-eks_*": false, "argocd-prod-eks_*": false }