Establish clean homelab infrastructure baseline

Reorganize the brownfield repository, remove retired and generated artifacts, harden ignore rules, and record the GitOps/IaC redesign.
2026-09-09 16:47:20 +00:00
commit 88a02ababa
418 changed files with 50579 additions and 0 deletions
@@ -0,0 +1,71 @@
+# Manages the REMOTE (dashboard) config of the token-managed cloudflared tunnel.
+# This is what's actually authoritative when the pod runs with TUNNEL_TOKEN — the
+# in-cluster config.yml ingress is ignored in that mode. Terraform is the source of truth.
+
+resource "cloudflare_zero_trust_tunnel_cloudflared_config" "main" {
+  account_id = var.account_id
+  tunnel_id  = var.tunnel_id
+
+  config = {
+    # First match wins; the http_status:404 catch-all MUST stay last.
+    ingress = [
+      {
+        hostname = "auth.ddupan.top"
+        # Authelia's k8s Service listens on :80 (targetPort -> container 9091).
+        # Hitting :9091 on the service yields 502; the service port is 80.
+        service = "http://authelia.authelia.svc.cluster.local:80"
+      },
+      {
+        hostname = "git.ddupan.top"
+        service  = "http://gitea-http.gitea.svc.cluster.local:3000"
+      },
+      {
+        hostname = "e5renew.ddupan.top"
+        service  = "http://e5renew.e5renew.svc.cluster.local:80"
+      },
+      {
+        hostname = "obj.ddupan.top"
+        service  = "http://seaweedfs-s3.seaweedfs.svc.cluster.local:8333"
+      },
+      {
+        service = "http_status:404"
+      },
+    ]
+
+    origin_request = {
+      no_tls_verify = true
+    }
+  }
+}
+
+# Public DNS: proxied CNAME -> the tunnel. (auth was bootstrapped with
+# `cloudflared tunnel route dns`; import it into state — see README.)
+resource "cloudflare_dns_record" "auth" {
+  zone_id = var.zone_id
+  name    = "auth.ddupan.top"
+  type    = "CNAME"
+  content = "${var.tunnel_id}.cfargotunnel.com"
+  proxied = true
+  ttl     = 1 # 1 = automatic (required when proxied)
+}
+
+# DKIM for Microsoft 365 mail sent as *@ddupan.top (via the smtp-relay). CNAMEs point
+# at the tenant's DKIM keys; must be DNS-only (unproxied). Enable signing in Exchange
+# after these resolve: smtp-relay/scripts/enable-dkim.ps1.
+resource "cloudflare_dns_record" "dkim_selector1" {
+  zone_id = var.zone_id
+  name    = "selector1._domainkey.ddupan.top"
+  type    = "CNAME"
+  content = "selector1-ddupan-top._domainkey.ddupan1.d-v1.dkim.mail.microsoft"
+  proxied = false
+  ttl     = 3600
+}
+
+resource "cloudflare_dns_record" "dkim_selector2" {
+  zone_id = var.zone_id
+  name    = "selector2._domainkey.ddupan.top"
+  type    = "CNAME"
+  content = "selector2-ddupan-top._domainkey.ddupan1.d-v1.dkim.mail.microsoft"
+  proxied = false
+  ttl     = 3600
+}