43 lines
1.3 KiB
Terraform
43 lines
1.3 KiB
Terraform
# One Hetzner DNS zone per domain in var.zone_names. Hetzner becomes
|
|
# authoritative for these once the domain's registrar NS records are pointed at
|
|
# the nameservers in the `nameservers` output - that step happens at whichever
|
|
# registrar the domain was bought through, and can't be done from here.
|
|
resource "hcloud_zone" "this" {
|
|
for_each = toset(var.zone_names)
|
|
|
|
name = each.value
|
|
mode = "primary"
|
|
delete_protection = true # API-level guard, in addition to prevent_destroy below
|
|
|
|
lifecycle {
|
|
prevent_destroy = true
|
|
}
|
|
}
|
|
|
|
locals {
|
|
# Group flat var.records entries by zone/name/type into one set of values
|
|
# each, since a Hetzner RRSet is keyed on (zone, name, type) and can hold
|
|
# several values (e.g. an SPF and a google-site-verification TXT both live
|
|
# under the same "@" TXT RRSet).
|
|
rrsets = {
|
|
for key, items in { for r in var.records : "${r.zone}/${r.name}/${r.type}" => r... } : key => {
|
|
zone = items[0].zone
|
|
name = items[0].name
|
|
type = items[0].type
|
|
ttl = items[0].ttl
|
|
values = [for i in items : i.value]
|
|
}
|
|
}
|
|
}
|
|
|
|
resource "hcloud_zone_rrset" "this" {
|
|
for_each = local.rrsets
|
|
|
|
zone = hcloud_zone.this[each.value.zone].id
|
|
name = each.value.name
|
|
type = each.value.type
|
|
ttl = each.value.ttl
|
|
|
|
records = [for v in each.value.values : { value = v }]
|
|
}
|