chore: clarify configuration guidance

.gitignore

@@ -1,18 +1,14 @@
-# vim swap files
 **/*.sw[po]
 
 # don't commit terraform state or lock. the repo code is the only state we care about.
 # the provider state cache is auto-upgraded by default to ensure compatibility with upstream cloud provider APIs
 **/.terraform.lock.hcl
 **/.terraform
 
-# IDE Folders
 **/.vscode
 
-# Mac Finder cache
 **/.DS_Store
 
-# Plan output
 plan-output.txt
 
 # Generated pre-commit configuration

AGENTS.md

@@ -51,3 +51,17 @@ Cloudflare provider 5.20 and later supports `dns_search_suffixes` on Zero Trust
 device profiles. Local Domain Fallback is different: it selects which resolver
 handles matching domains and does not configure the operating system's DNS
 search suffix list.
+
+## Importing Zone Settings
+
+Cloudflare zone-setting import IDs use `<zone-id>/<setting-id>`. Obtain the
+zone ID through the approved local secret workflow, then import each managed
+setting explicitly, for example:
+
+```bash
+tofu import cloudflare_zone_setting.cache_level "$ZONE_ID/cache_level"
+tofu import cloudflare_zone_setting.browser_cache_ttl "$ZONE_ID/browser_cache_ttl"
+tofu import cloudflare_zone_setting.browser_check "$ZONE_ID/browser_check"
+tofu import cloudflare_zone_setting.challenge_ttl "$ZONE_ID/challenge_ttl"
+tofu import cloudflare_zone_setting.minify "$ZONE_ID/minify"
+```

cf-access-k3s.tf

@@ -1,5 +1,3 @@
-# Cloudflare Access application protecting the k3s API server tunnel.
-#
 # Pairs with the TunnelBinding in kustomize-cluster (workloads/kubectl-tunnel)
 # that fronts kubernetes.default.svc:443 over k3s.makeitwork.cloud as a TCP
 # tunnel. Clients reach the apiserver via:

cf-cache.tf

@@ -1,11 +1,3 @@
-# Zone-level cache and performance settings
-# Import commands (replace $ZONE_ID with cloudflare_zone_id from secrets):
-#   tofu import cloudflare_zone_setting.cache_level $ZONE_ID/cache_level
-#   tofu import cloudflare_zone_setting.browser_cache_ttl $ZONE_ID/browser_cache_ttl
-#   tofu import cloudflare_zone_setting.browser_check $ZONE_ID/browser_check
-#   tofu import cloudflare_zone_setting.challenge_ttl $ZONE_ID/challenge_ttl
-#   tofu import cloudflare_zone_setting.minify $ZONE_ID/minify
-
 resource "cloudflare_zone_setting" "cache_level" {
   zone_id    = local.zone_id
   setting_id = "cache_level"
@@ -64,9 +56,6 @@ resource "cloudflare_zone_setting" "polish" {
   value      = "off"
 }
 
-# Note: prefetch_preload requires Cloudflare Pro plan or higher
-
-# Cache rule for static HTML at root domain
 resource "cloudflare_ruleset" "cache_rules" {
   zone_id     = local.zone_id
   name        = "Cache Rules"
@@ -81,7 +70,7 @@ resource "cloudflare_ruleset" "cache_rules" {
         cache = true
         edge_ttl = {
           mode    = "override_origin"
-          default = 3600 # 1 hour edge cache
+          default = 3600
         }
         browser_ttl = {
           mode = "respect_origin"

cf-dns.tf

@@ -42,7 +42,6 @@ resource "cloudflare_dns_record" "spf" {
   ttl     = 1
 }
 
-# Onion hidden service static site
 resource "cloudflare_dns_record" "onion" {
   zone_id = local.zone_id
   type    = "CNAME"

cf-tunnels.tf

@@ -1,5 +1,3 @@
-# Cloudflare Tunnels — connect cloudflared pods to Cloudflare's edge.
-#
 # The cluster-apps tunnel is created and owned by cloudflare-operator
 # (see kustomize-cluster/operators/cloudflare/cluster-tunnel.yaml). Tunnel
 # credentials live in the cluster's Secret. CNAME records for the apps

cf-warp.tf

@@ -1,6 +1,3 @@
-# Zero Trust / WARP configuration
-
-# Organization settings
 resource "cloudflare_zero_trust_organization" "main" {
   account_id  = local.account_id
   name        = "makeitworkcloud.cloudflareaccess.com"
@@ -13,7 +10,6 @@ resource "cloudflare_zero_trust_organization" "main" {
   is_ui_read_only             = false
 }
 
-# GitHub identity provider for WARP enrollment
 resource "cloudflare_zero_trust_access_identity_provider" "github" {
   account_id = local.account_id
   name       = "GitHub"
@@ -25,7 +21,6 @@ resource "cloudflare_zero_trust_access_identity_provider" "github" {
   }
 }
 
-# Access group for makeitworkcloud admins
 resource "cloudflare_zero_trust_access_group" "admins" {
   account_id = local.account_id
   name       = "makeitworkcloud-admins"
@@ -39,19 +34,16 @@ resource "cloudflare_zero_trust_access_group" "admins" {
   }]
 }
 
-# WARP enrollment application
 resource "cloudflare_zero_trust_access_application" "warp" {
   account_id       = local.account_id
   name             = "Warp Login App"
   type             = "warp"
   session_duration = "24h"
 
-  # Only GitHub SSO allowed for WARP enrollment
   allowed_idps = [
     cloudflare_zero_trust_access_identity_provider.github.id,
   ]
 
-  # Policies managed by Terraform
   policies = [
     {
       name             = "makeitworkcloud-admins"

main.tf

@@ -8,7 +8,6 @@ locals {
   github_warp_client_id     = data.sops_file.secret_vars.data["github_warp_client_id"]
   github_warp_client_secret = data.sops_file.secret_vars.data["github_warp_client_secret"]
 
-  # Private networks (CIDR protected via SOPS)
   warp_private_network = data.sops_file.secret_vars.data["warp_private_network"]
 
 }

opencode.json

@@ -16,6 +16,7 @@
     "aws-prod": {"enabled": false},
     "grafana": {"enabled": false},
     "terraform-docs": {"enabled": false},
+    "argocd-makeitwork": {"enabled": true},
     "argocd-staging-eks": {"enabled": false},
     "argocd-prod-eks": {"enabled": false}
   },
@@ -30,6 +31,7 @@
     "aws-prod_*": false,
     "grafana_*": false,
     "terraform-docs_*": false,
+    "argocd-makeitwork_*": true,
     "argocd-staging-eks_*": false,
     "argocd-prod-eks_*": false
   }