# 🤖 The DNSimple side of the dev mesh: the NS delegation that hands the
# dev.11ch.at subtree to the Route53 zone (route53.tf), plus the one dev record
# that stays on elevenmessenger.com. The two *.<cc>.dev.11ch.at wildcards that
# used to live here MOVED into the Route53 zone (route53.tf) — see there for why.

variable "fi_node_ip" {
  description = "The Helsinki (Hetzner) node's public IP (the *.fi.dev.11ch.at target)"
  type        = string
  default     = "157.180.123.183"
}

# Delegate dev.11ch.at from the prod 11ch.at DNSimple zone (Eleven account
# 176940) to the Route53 hosted zone. One NS record per Route53 nameserver, all
# named "dev". After this propagates, DNSimple answers anything under dev.11ch.at
# with an NS referral and Route53 is authoritative — which is the whole reason the
# per-country wildcards had to move into that zone.
#
# ⚠️ This is the ONLY record this dev stack writes into the prod DNSimple zone,
# and it touches ONLY the dev subtree — it cannot affect 11ch.at itself or any
# member space. The 176940 token comes from the vault at apply time
# (aws-dev-agent-james.env), never a dev box, never committed.
# count (not for_each): a Route53 hosted zone's delegation set is ALWAYS exactly
# four nameservers, and their names are known only after the zone is created — a
# for_each keyed on them can't plan. A static count of 4 sidesteps that and still
# creates one `dev` NS record per Route53 nameserver.
resource "dnsimple_zone_record" "dev_delegation" {
  count = 4

  zone_name = "11ch.at"
  name      = "dev"
  type      = "NS"
  value     = aws_route53_zone.dev.name_servers[count.index]
  ttl       = 3600
}

# The dev home server lives on elevenmessenger.com (mirroring prod's
# home.elevenmessenger.com), not 11ch.at — the WebAuthn RP identity, and where
# native dev alts point HomeClient. It is OUTSIDE the dev.11ch.at delegation, so
# it stays a plain DNSimple A record on the Dublin (ie) box (the dev "primary"
# that also hosts the global home + the ie cloud provisioner).
resource "dnsimple_zone_record" "home_dev" {
  zone_name = "elevenmessenger.com"
  name      = "home.dev"
  type      = "A"
  value     = aws_eip.ie_node.public_ip
  ttl       = 60
}