tfroot-cloudflare

Requirements

Name	Version
terraform	> 1.3
cloudflare	~> 5.0

Providers

Name	Version
cloudflare	~> 5.0
sops	n/a

Modules

No modules.

Resources

Name	Type
cloudflare_dns_record.cluster_bootstrap	resource
cloudflare_dns_record.mx_primary	resource
cloudflare_dns_record.mx_secondary	resource
cloudflare_dns_record.onion	resource
cloudflare_dns_record.root	resource
cloudflare_dns_record.spf	resource
cloudflare_dns_record.www	resource
cloudflare_ruleset.cache_rules	resource
cloudflare_zero_trust_access_application.alertmanager	resource
cloudflare_zero_trust_access_application.grafana_alerts	resource
cloudflare_zero_trust_access_application.k3s	resource
cloudflare_zero_trust_access_application.mcp_gateway	resource
cloudflare_zero_trust_access_application.mcp_gateway_backend	resource
cloudflare_zero_trust_access_application.warp	resource
cloudflare_zero_trust_access_group.admins	resource
cloudflare_zero_trust_access_identity_provider.github	resource
cloudflare_zero_trust_access_service_token.mcp_gateway	resource
cloudflare_zero_trust_organization.main	resource
cloudflare_zero_trust_tunnel_cloudflared.cluster_apps	resource
cloudflare_zero_trust_tunnel_cloudflared.warp	resource
cloudflare_zero_trust_tunnel_cloudflared_route.private_network	resource
cloudflare_zone.xnoto_dev	resource
cloudflare_zone_setting.brotli	resource
cloudflare_zone_setting.browser_cache_ttl	resource
cloudflare_zone_setting.browser_check	resource
cloudflare_zone_setting.cache_level	resource
cloudflare_zone_setting.challenge_ttl	resource
cloudflare_zone_setting.early_hints	resource
cloudflare_zone_setting.minify	resource
cloudflare_zone_setting.polish	resource
cloudflare_zone_setting.rocket_loader	resource
cloudflare_zone.makeitwork_cloud	data source
sops_file.secret_vars	data source

Inputs

No inputs.

Outputs

Name	Description
mcp_gateway_service_token_client_id	CF-Access-Client-Id for MCP gateway clients
mcp_gateway_service_token_client_secret	CF-Access-Client-Secret for MCP gateway clients
tunnel_ids	Cloudflare Tunnel IDs for reference in kustomize-cluster ConfigMaps

Kubernetes API access

This root manages the Cloudflare side of kubectl connectivity:

• cf-warp.tf defines the GitHub identity provider and makeitworkcloud:admins Access group.
• cf-access-k3s.tf applies that group to the migration fallback at k3s.makeitwork.cloud.
• cf-tunnels.tf owns the api and k3s CNAMEs.
• The ClusterTunnel and TunnelBinding manifests in kustomize-cluster/workloads/kubectl-tunnel own their routes with DNS updates disabled.

Normal kubectl access connects directly to https://api.makeitwork.cloud and relies on a Dex-issued OIDC token plus Kubernetes RBAC. Cloudflare Access still protects the legacy TCP route at k3s.makeitwork.cloud during migration. The canonical kubeconfig and kubelogin procedure lives in the kustomize-cluster README. Do not store kubeconfigs, Access tokens, client certificates, or Cloudflare credentials in this repository.

This root owns only the bootstrap tunnel DNS required to reach the Kubernetes API before cluster workloads are available. TunnelBinding owns workload tunnel DNS, including the MCP gateway endpoints. Do not add a workload hostname to this OpenTofu root.