feat: Added DNS control to tofu

infra/modules/dns/main.tf

@@ -0,0 +1,28 @@
+# One Hetzner DNS zone per domain in var.zone_names. Hetzner becomes
+# authoritative for these once the domain's registrar NS records are pointed at
+# the nameservers in the `nameservers` output - that step happens at whichever
+# registrar the domain was bought through, and can't be done from here.
+resource "hcloud_zone" "this" {
+  for_each = toset(var.zone_names)
+
+  name              = each.value
+  mode              = "primary"
+  delete_protection = true # API-level guard, in addition to prevent_destroy below
+
+  lifecycle {
+    prevent_destroy = true
+  }
+}
+
+resource "hcloud_zone_rrset" "a" {
+  for_each = { for r in var.records : "${r.zone}/${r.name}" => r }
+
+  zone = hcloud_zone.this[each.value.zone].id
+  name = each.value.name
+  type = "A"
+  ttl  = each.value.ttl
+
+  records = [
+    { value = each.value.value }
+  ]
+}

infra/modules/dns/outputs.tf

@@ -0,0 +1,9 @@
+output "zone_ids" {
+  description = "Map of domain name to Hetzner zone ID."
+  value       = { for name, z in hcloud_zone.this : name => z.id }
+}
+
+output "nameservers" {
+  description = "Map of domain name to the nameservers Hetzner assigned it - point your registrar's NS records at these to delegate DNS."
+  value       = { for name, z in hcloud_zone.this : name => z.authoritative_nameservers.assigned }
+}

infra/modules/dns/variables.tf

@@ -0,0 +1,15 @@
+variable "zone_names" {
+  description = "Domains to create as Hetzner DNS zones."
+  type        = list(string)
+}
+
+variable "records" {
+  description = "A records to create across the zones in var.zone_names. Use name = \"@\" for the zone apex."
+  type = list(object({
+    zone  = string
+    name  = string
+    value = string
+    ttl   = optional(number, 300)
+  }))
+  default = []
+}