---
# Homelab DNS desired state. This file is the canonical inventory; individual
# backends consume only the views they own.
homelab_dns:
  samba:
    # Samba remains authoritative for the AD zone. Only these explicitly listed
    # RRsets are reconciled; Samba-generated AD/Kerberos records are untouched.
    records:
      - { zone: ad.ddupan.top, name: bao, type: A, values: [192.168.10.8] }
      - { zone: ad.ddupan.top, name: pve1, type: A, values: [192.168.10.4] }
      - { zone: ad.ddupan.top, name: pve2, type: A, values: [192.168.10.7] }
      - { zone: ad.ddupan.top, name: pve3, type: A, values: [192.168.10.9] }
      - { zone: ad.ddupan.top, name: sandbox1, type: A, values: [10.60.0.11] }
      - { zone: ad.ddupan.top, name: sandbox2, type: A, values: [10.60.0.12] }
      - { zone: ad.ddupan.top, name: sandbox-k8s, type: A, values: [10.60.0.13] }
      - { zone: ad.ddupan.top, name: retrolab, type: A, values: [10.60.0.10] }
      - { zone: ad.ddupan.top, name: grafana, type: A, values: [192.168.10.127] }
      - { zone: ad.ddupan.top, name: metrics-write, type: A, values: [192.168.10.127] }
      - { zone: ad.ddupan.top, name: netbox, type: A, values: [192.168.10.127] }
      - { zone: ad.ddupan.top, name: nats, type: A, values: [192.168.10.127] }
      - { zone: ad.ddupan.top, name: s3, type: A, values: [192.168.10.127] }
      - { zone: ad.ddupan.top, name: spire-oidc, type: A, values: [192.168.10.127] }
      - { zone: ad.ddupan.top, name: zot, type: A, values: [192.168.10.127] }
      - { zone: ad.ddupan.top, name: zot-push, type: A, values: [192.168.10.127] }

  split_horizon:
    # backends records the current adoption boundary. obj is deliberately not
    # emitted to CoreDNS yet, preserving the current pod resolver behaviour.
    records:
      - { name: git.ddupan.top, type: A, values: [192.168.10.127], backends: [blocky, coredns] }
      - { name: auth.ddupan.top, type: A, values: [192.168.10.127], backends: [blocky, coredns] }
      - { name: obj.ddupan.top, type: A, values: [192.168.10.127], backends: [blocky] }

  public:
    # Names expected at Cloudflare. Terraform adoption is a separate change;
    # complete RRsets here make the current ownership gap explicit.
    records:
      - name: auth.ddupan.top
        type: CNAME
        values: [ff392451-b0b1-45bb-964e-6d9372c3a9e3.cfargotunnel.com]
        proxied: true
        terraform:
          managed: true
          resource_name: auth
      - name: git.ddupan.top
        type: CNAME
        values: [ff392451-b0b1-45bb-964e-6d9372c3a9e3.cfargotunnel.com]
        proxied: true
        terraform: { managed: false }
      - name: obj.ddupan.top
        type: CNAME
        values: [ff392451-b0b1-45bb-964e-6d9372c3a9e3.cfargotunnel.com]
        proxied: true
        terraform: { managed: false }
      - name: e5renew.ddupan.top
        type: CNAME
        values: [ff392451-b0b1-45bb-964e-6d9372c3a9e3.cfargotunnel.com]
        proxied: true
        terraform: { managed: false }
      # OCI 主机直接解析公网 IP，SSH 不经过 Cloudflare 代理。
      - name: oci-arm.ddupan.top
        type: A
        values:
          - 129.225.138.179
        proxied: false
        ttl: 300
        terraform: { managed: false }
      - name: oci-amd.ddupan.top
        type: A
        values:
          - 129.225.176.134
        proxied: false
        ttl: 300
        terraform: { managed: false }