# One Hetzner DNS zone per domain in var.zone_names. Hetzner becomes
# authoritative for these once the domain's registrar NS records are pointed at
# the nameservers in the `nameservers` output - that step happens at whichever
# registrar the domain was bought through, and can't be done from here.
resource "hcloud_zone" "this" {
  for_each = toset(var.zone_names)

  name              = each.value
  mode              = "primary"
  delete_protection = true # API-level guard, in addition to prevent_destroy below

  lifecycle {
    prevent_destroy = true
  }
}

resource "hcloud_zone_rrset" "a" {
  for_each = { for r in var.records : "${r.zone}/${r.name}" => r }

  zone = hcloud_zone.this[each.value.zone].id
  name = each.value.name
  type = "A"
  ttl  = each.value.ttl

  records = [
    { value = each.value.value }
  ]
}