main.tf

terraform {
  required_providers {
    digitalocean = {
      source  = "digitalocean/digitalocean"
      version = "~> 2.46"
    }

    cloudflare = {
      source  = "cloudflare/cloudflare"
      version = "5.0.0-rc1"
    }

    namecheap = {
      source  = "namecheap/namecheap"
      version = "~> 2.2"
    }
  }
}

provider "digitalocean" {
  token = var.do_token
}

provider "cloudflare" {
  email   = var.cloudflare_email_address
  api_key = var.cloudflare_api_token
}

provider "namecheap" {
  user_name = "LukeDavia"
  api_user  = "LukeDavia"
  api_key   = var.namecheap_api_key
  client_ip = var.namecheap_static_ip
}

# DigitalOcean Compute
import {
  to = digitalocean_ssh_key.lukesEd25519SshKey
  id = "40810713"
}

resource "digitalocean_ssh_key" "lukesEd25519SshKey" {
  name       = "Luke's Ed25519 SSH Key"
  public_key = file("./resources/id_ed25519.pub")
}

import {
  to = digitalocean_droplet.lukeify
  id = "398099896"
}

# Imported resource. These details should be manually amended when an upgrade needs to be performed:
# 1. The droplet currently runs Ubuntu 22.04 (x64)—but the image ID is custom from the OpenTofu import.
# 2. The SSH key should be manually specified here using the ssh_keys property when the resource is recreated.
resource "digitalocean_droplet" "lukeify" {
  image      = "129211873"
  monitoring = true
  name       = "lukeify"
  region     = "syd1"
  size       = "s-1vcpu-512mb-10gb"
  tags       = ["lukeify"]
}

# It's easier to recreate this in OpenTofu rather than importing it.
resource "digitalocean_firewall" "lukeifyFirewall" {
  name        = "LukeifyFirewall"
  droplet_ids = [digitalocean_droplet.lukeify.id]

  # Allow SSH
  inbound_rule {
    protocol         = "tcp"
    port_range       = "22"
    source_addresses = ["0.0.0.0/0", "::/0"]
  }

  # Allow HTTP
  inbound_rule {
    protocol         = "tcp"
    port_range       = "80"
    source_addresses = ["0.0.0.0/0", "::/0"]
  }

  # Allow HTTPS
  inbound_rule {
    protocol         = "tcp"
    port_range       = "443"
    source_addresses = ["0.0.0.0/0", "::/0"]
  }

  # Allow UDP (for HTTP/3 access)
  inbound_rule {
    protocol         = "udp"
    port_range       = "443"
    source_addresses = ["0.0.0.0/0", "::/0"]
  }

  # Allow TCP egress on all ports
  outbound_rule {
    protocol              = "tcp"
    port_range            = "1-65535"
    destination_addresses = ["0.0.0.0/0", "::/0"]
  }

  # Allow UDP egress on all ports
  outbound_rule {
    protocol              = "udp"
    port_range            = "1-65535"
    destination_addresses = ["0.0.0.0/0", "::/0"]
  }
}

# Namecheap
# My primary site.
resource "namecheap_domain_records" "lukeDotKiwi" {
  domain = "luke.kiwi"

  # We let CloudFlare handle DNS records for luke.kiwi, thus there are no records here.
  nameservers = [
    "dave.ns.cloudflare.com",
    "naya.ns.cloudflare.com"
  ]
}

# Redirects to luke.kiwi.
resource "namecheap_domain_records" "lukeifyDotCom" {
  domain = "lukeify.com"

  # URL redirect record via 301 Moved Permanently. Internally this is handled by pointing an A record at NameCheap's
  # servers, which handles the redirection process.
  record {
    hostname = "@"
    type     = "URL301"
    address  = "https://luke.kiwi"
  }
}

# Domain for email addresses. A parking page is used for this domain to ensure registration is possible on sites
# which check for the presence of an A record (yes, this happens).
resource "namecheap_domain_records" "hiddenDomain07bed711" {
  domain     = var.hidden_domain_07bed711
  email_type = "MX"
  mode       = "OVERWRITE"

  # This domain is used by SimpleLogin and DNS records are managed by NameCheap.
  record {
    hostname = "dkim._domainkey"
    type     = "CNAME"
    address  = "dkim._domainkey.simplelogin.co."
  }

  record {
    hostname = "dkim02._domainkey"
    type     = "CNAME"
    address  = "dkim02._domainkey.simplelogin.co."
  }

  record {
    hostname = "dkim03._domainkey"
    type     = "CNAME"
    address  = "dkim03._domainkey.simplelogin.co."
  }

  record {
    hostname = "www"
    type     = "CNAME"
    address  = "parkingpage.namecheap.com."
  }

  record {
    hostname = "@"
    type     = "TXT"
    address  = "v=spf1 include:simplelogin.co ~all"
  }

  record {
    hostname = "_dmarc"
    type     = "TXT"
    address  = "v=DMARC1; p=quarantine; pct=100; adkim=s; aspf=s"
  }

  record {
    hostname = "@"
    type     = "MX"
    address  = "mx1.simplelogin.co."
    mx_pref  = 10
  }

  record {
    hostname = "@"
    type     = "MX"
    address  = "mx2.simplelogin.co."
    mx_pref  = 20
  }
}

# Alternate domain for email addresses. Not currently used as such though—a redirect is in place to the primary email
# address domain.
resource "namecheap_domain_records" "hiddenDomain22c5fdd4" {
  domain = var.hidden_domain_22c5fdd4

  record {
    hostname = "@"
    type     = "URL301"
    address  = "http://${var.hidden_domain_07bed711}"
  }
}

# Project domain. Nothing here yet.
resource "namecheap_domain_records" "hiddenDomaine891f9e5" {
  domain = var.hidden_domain_e891f9e5
}

# CloudFlare
import {
  to = cloudflare_account.cf_account
  id = "ad114eed4b21db1288538f9267525b0a"
}

resource "cloudflare_account" "cf_account" {
  name = "${var.cloudflare_email_address}'s Account"
  type = "standard"
}

import {
  to = cloudflare_zone.lukeDotKiwiZone
  id = "6d6fb052dbc4e7172304403a026cf478"
}

resource "cloudflare_zone" "lukeDotKiwiZone" {
  account = {
    id = cloudflare_account.cf_account.id
  }
  name = "luke.kiwi"
  type = "full"
}

resource "cloudflare_zone_dnssec" "lukeDotKiwiDnssecConfiguration" {
  zone_id             = cloudflare_zone.lukeDotKiwiZone.id
  dnssec_multi_signer = true
  status              = "active"
}

# A record
resource "cloudflare_dns_record" "lukeDotKiwiARecord" {
  zone_id = cloudflare_zone.lukeDotKiwiZone.id
  name    = "@"
  content = digitalocean_droplet.lukeify.ipv4_address
  type    = "A"
  ttl     = 1
  proxied = true
}

# www.luke.kiwi CNAME Record
resource "cloudflare_dns_record" "lukeDotKiwiHsCnameRecord" {
  zone_id = cloudflare_zone.lukeDotKiwiZone.id
  name    = "hs"
  content = "luke.kiwi"
  type    = "CNAME"
  ttl     = 1
  proxied = true
}

# hs.luke.kiwi CNAME Record
resource "cloudflare_dns_record" "lukeDotKiwiWwwCnameRecord" {
  zone_id = cloudflare_zone.lukeDotKiwiZone.id
  name    = "www"
  content = "luke.kiwi"
  type    = "CNAME"
  ttl     = 1
  proxied = true
}

# direct.luke.kiwi CNAME Record
resource "cloudflare_dns_record" "lukeDotKiwiDirectCnameRecord" {
  zone_id = cloudflare_zone.lukeDotKiwiZone.id
  name    = "direct"
  content = "luke.kiwi"
  type    = "CNAME"
  ttl     = 1
  proxied = false
}

module "simplelogin_luke_dot_kiwi_records" {
  source  = "./modules/simplelogin_email_dns_records"
  zone_id = cloudflare_zone.lukeDotKiwiZone.id
  domain  = "luke.kiwi"
}

module "simplelogin_jobs_dot_luke_dot_kiwi_records" {
  source    = "./modules/simplelogin_email_dns_records"
  zone_id   = cloudflare_zone.lukeDotKiwiZone.id
  domain    = "luke.kiwi"
  subdomain = "jobs"
}

module "simplelogin_acme_dot_luke_dot_kiwi_records" {
  source    = "./modules/simplelogin_email_dns_records"
  zone_id   = cloudflare_zone.lukeDotKiwiZone.id
  domain    = "luke.kiwi"
  subdomain = "acme"
}