Repository navigation
Expand file tree
/
Copy pathdarklangio.tf
More file actions
110 lines (93 loc) · 3.55 KB
/
Copy pathdarklangio.tf
File metadata and controls
110 lines (93 loc) · 3.55 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
########################
# DNS setup for darklang.io
# NOTE: darklang.com is in darklang-classic project
########################
resource "google_dns_managed_zone" "darklangio" {
name = "darklang-io"
dns_name = "darklang.io."
description = "DNS zone for darklang.io"
dnssec_config {
kind = "dns#managedZoneDnsSecConfig"
non_existence = "nsec3"
state = "on"
default_key_specs {
algorithm = "rsasha256"
key_length = 2048
key_type = "keySigning"
kind = "dns#dnsKeySpec"
}
default_key_specs {
algorithm = "rsasha256"
key_length = 1024
key_type = "zoneSigning"
kind = "dns#dnsKeySpec"
}
}
}
#########################
# DNS setup for *.darklang.io
#########################
resource "google_dns_record_set" "star_darklangio_a" {
name = "*.darklang.io."
type = "A"
ttl = 300
managed_zone = google_dns_managed_zone.darklangio.name
rrdatas = [google_compute_global_address.bwdserver_ip_address.address]
}
resource "google_dns_record_set" "darklangio_a" {
name = "darklang.io."
type = "A"
ttl = 300
managed_zone = google_dns_managed_zone.darklangio.name
rrdatas = [google_compute_global_address.bwdserver_ip_address.address]
}
// add darklang.io to public suffix list
resource "google_dns_record_set" "psl_darklangio" {
name = "_psl.darklang.io."
type = "TXT"
ttl = 5
managed_zone = google_dns_managed_zone.darklangio.name
rrdatas = ["https://github.com/publicsuffix/list/pull/1880"]
}
########################
# Certs
########################
// Enable DNS authorization for Certificate Manager, which allows domains we control
// have certs managed by Google
// https://cloud.google.com/certificate-manager/docs/dns-authorizations#auth-create
resource "google_certificate_manager_dns_authorization" "darklang-io" {
name = "star-darklang-io"
domain = "darklang.io"
}
// DNS entry for Certificate Manager to verify we control the domain
// https://cloud.google.com/certificate-manager/docs/dns-authorizations#cname-record
resource "google_dns_record_set" "darklangio_dns_authorization_cname" {
name = google_certificate_manager_dns_authorization.darklang-io.dns_resource_record[0].name
managed_zone = google_dns_managed_zone.darklangio.name
type = google_certificate_manager_dns_authorization.darklang-io.dns_resource_record[0].type
ttl = 5
rrdatas = [google_certificate_manager_dns_authorization.darklang-io.dns_resource_record[0].data]
}
// Certificate Manager certificate request for darklang.io
// https://cloud.google.com/certificate-manager/docs/certificates#cert-dns-auth
resource "google_certificate_manager_certificate" "darklang-io" {
name = "darklang-io"
managed {
domains = ["darklang.io", "*.darklang.io"]
dns_authorizations = [
google_certificate_manager_dns_authorization.darklang-io.id
]
}
}
resource "google_certificate_manager_certificate_map_entry" "star-darklang-io" {
name = "star-darklangio-entry"
map = google_certificate_manager_certificate_map.bwdserver.name
certificates = [google_certificate_manager_certificate.darklang-io.id]
hostname = "*.darklang.io"
}
resource "google_certificate_manager_certificate_map_entry" "darklang-io" {
name = "darklangio-entry"
map = google_certificate_manager_certificate_map.bwdserver.name
certificates = [google_certificate_manager_certificate.darklang-io.id]
hostname = "darklang.io"
}