ryan/lunarfront-infra
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Add registry.lunarfront.tech: DNS-only subdomain with Let's Encrypt cert, no CF upload limit

Browse Source
This commit is contained in:
Ryan Moon
2026-03-31 19:14:03 -05:00
parent c280fb8cbe
commit 1ce49a7ed3
7 changed files with 96 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files

15
terraform/main.tf
View File

@@ -98,17 +98,18 @@ resource "digitalocean_firewall" "gitea" {
source_addresses = ["${var.admin_ip}/32"]
}
# HTTP/HTTPS — Cloudflare IPs only
# HTTP — Cloudflare IPs only (web UI)
inbound_rule {
protocol = "tcp"
port_range = "80"
source_addresses = concat(local.cloudflare_ipv4, local.cloudflare_ipv6)
}
# HTTPS — Cloudflare IPs for proxied domains + all IPs for registry (DNS-only)
inbound_rule {
protocol = "tcp"
port_range = "443"
source_addresses = concat(local.cloudflare_ipv4, local.cloudflare_ipv6)
source_addresses = ["0.0.0.0/0", "::/0"]
}
# Gitea SSH for git push/pull — your IP only
@@ -161,3 +162,13 @@ resource "cloudflare_record" "git_ssh" {
ttl = 3600
}
# DNS only — no Cloudflare proxy, for container registry (no 100MB upload limit)
resource "cloudflare_record" "registry" {
zone_id = data.cloudflare_zone.main.id
name = "registry"
type = "A"
value = digitalocean_droplet.gitea.ipv4_address
proxied = false
ttl = 3600
}