tfroot-cloudflare

Requirements

Name	Version
terraform	> 1.3
cloudflare	~> 5.0

Providers

Name	Version
cloudflare	~> 5.0
sops	n/a

Modules

No modules.

Resources

Name	Type
cloudflare_dns_record.cluster_bootstrap	resource
cloudflare_dns_record.mx_primary	resource
cloudflare_dns_record.mx_secondary	resource
cloudflare_dns_record.onion	resource
cloudflare_dns_record.root	resource
cloudflare_dns_record.spf	resource
cloudflare_dns_record.www	resource
cloudflare_dns_record.xnoto_dev_root	resource
cloudflare_dns_record.xnoto_dev_www	resource
cloudflare_ruleset.cache_rules	resource
cloudflare_ruleset.response_headers	resource
cloudflare_zero_trust_access_application.alertmanager	resource
cloudflare_zero_trust_access_application.grafana_alerts	resource
cloudflare_zero_trust_access_application.k3s	resource
cloudflare_zero_trust_access_application.mcp_gateway	resource
cloudflare_zero_trust_access_application.mcp_gateway_backend	resource
cloudflare_zero_trust_access_application.warp	resource
cloudflare_zero_trust_access_group.admins	resource
cloudflare_zero_trust_access_identity_provider.github	resource
cloudflare_zero_trust_access_service_token.hero_host_config_warp	resource
cloudflare_zero_trust_access_service_token.mcp_gateway	resource
cloudflare_zero_trust_organization.main	resource
cloudflare_zero_trust_tunnel_cloudflared.cluster_apps	resource
cloudflare_zero_trust_tunnel_cloudflared.warp	resource
cloudflare_zero_trust_tunnel_cloudflared_route.private_network	resource
cloudflare_zone.xnoto_dev	resource
cloudflare_zone_setting.brotli	resource
cloudflare_zone_setting.browser_cache_ttl	resource
cloudflare_zone_setting.browser_check	resource
cloudflare_zone_setting.cache_level	resource
cloudflare_zone_setting.challenge_ttl	resource
cloudflare_zone_setting.early_hints	resource
cloudflare_zone_setting.minify	resource
cloudflare_zone_setting.polish	resource
cloudflare_zone_setting.rocket_loader	resource
cloudflare_zone_setting.xnoto_dev_ssl	resource
cloudflare_zone.makeitwork_cloud	data source
sops_file.secret_vars	data source

Inputs

No inputs.

Outputs

Name	Description
hero_host_config_warp_service_token_client_id	Cloudflare Access service-token client ID for hero-host-config WARP enrollment
hero_host_config_warp_service_token_client_secret	Cloudflare Access service-token client secret for hero-host-config WARP enrollment
mcp_gateway_service_token_client_id	CF-Access-Client-Id for MCP gateway clients
mcp_gateway_service_token_client_secret	CF-Access-Client-Secret for MCP gateway clients
tunnel_ids	Cloudflare Tunnel IDs for reference in kustomize-cluster ConfigMaps

Kubernetes API access

This root manages the Cloudflare side of kubectl connectivity:

• cf-warp.tf defines the GitHub identity provider and makeitworkcloud:admins Access group.
• cf-access-k3s.tf applies that group to the migration fallback at k3s.makeitwork.cloud.
• cf-tunnels.tf owns the api and k3s CNAMEs.
• The ClusterTunnel and TunnelBinding manifests in kustomize-cluster/workloads/kubectl-tunnel own their routes with DNS updates disabled.

Normal kubectl access connects directly to https://api.makeitwork.cloud and relies on a Dex-issued OIDC token plus Kubernetes RBAC. Cloudflare Access still protects the legacy TCP route at k3s.makeitwork.cloud during migration. The canonical kubeconfig and kubelogin procedure lives in the kustomize-cluster README. Do not store kubeconfigs, Access tokens, client certificates, or Cloudflare credentials in this repository.

This root owns only the bootstrap tunnel DNS required to reach the Kubernetes API before cluster workloads are available. TunnelBinding owns workload tunnel DNS, including the MCP gateway endpoints. Do not add a workload hostname to this OpenTofu root.

OpenCode HSTS

cf-opencode-hsts.tf configures the zone response-header ruleset with a rule matching only HTTPS requests to opencode.makeitwork.cloud. It sets Strict-Transport-Security: max-age=86400 (one day), without includeSubDomains or preload. Native OpenCode authentication and existing HTTPS redirection are unchanged. No Cloudflare Access, workload DNS/tunnel, or AWX cleanup is included.

This root owns the response-header entrypoint. Review and preserve its full rule list before adding other header rules; do not create a competing entrypoint or adopt an existing one without reviewing its rules. PR CI plans validate the proposed changes; main runs a fresh environment-associated apply, not the saved PR plan. Merge and apply authorization are separate.

After approved apply, verify the HTTPS UI and unauthenticated API responses carry the header, native phone login and session continuity still work, and sibling hostnames are unaffected. A successful plan is not live verification.

For rollback, first serve max-age=0 over HTTPS through this rule, then remove it after the rollback has been reviewed and applied. Simply removing the header does not clear browser policies; they otherwise expire up to one day after their last receipt. Preserve HTTPS throughout.