From 559f53d8fcd1578d42aa67244fe906ce8b3555ca Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Ullrich=20Sch=C3=A4fer?= <hi+github@ullrich.is>
Date: Fri, 27 Mar 2026 13:16:40 +0100
Subject: [PATCH] Use *.internal.trails.cool wildcard for internal services
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Add wildcard DNS record for *.internal.trails.cool (A + AAAA) so
internal services don't leak hostnames in individual DNS entries.
Move Grafana from grafana.trails.cool to grafana.internal.trails.cool.

Future internal services just need a Caddy block — no DNS changes.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
---
 infrastructure/Caddyfile          |  2 +-
 infrastructure/docker-compose.yml |  2 +-
 infrastructure/terraform/main.tf  | 19 +++++++++++++++++++
 3 files changed, 21 insertions(+), 2 deletions(-)

diff --git a/infrastructure/Caddyfile b/infrastructure/Caddyfile
index d798daa..f841f39 100644
--- a/infrastructure/Caddyfile
+++ b/infrastructure/Caddyfile
@@ -28,7 +28,7 @@ www.{$DOMAIN:trails.cool} {
 	redir https://{$DOMAIN:trails.cool}{uri} permanent
 }
 
-grafana.{$DOMAIN:trails.cool} {
+grafana.internal.{$DOMAIN:trails.cool} {
 	basicauth {
 		{$GRAFANA_USER:admin} {$GRAFANA_PASSWORD_HASH}
 	}
diff --git a/infrastructure/docker-compose.yml b/infrastructure/docker-compose.yml
index 461b0d5..e58658c 100644
--- a/infrastructure/docker-compose.yml
+++ b/infrastructure/docker-compose.yml
@@ -107,7 +107,7 @@ services:
     environment:
       GF_SECURITY_ADMIN_USER: ${GRAFANA_USER:-admin}
       GF_SECURITY_ADMIN_PASSWORD: ${GRAFANA_PASSWORD:-admin}
-      GF_SERVER_ROOT_URL: https://grafana.${DOMAIN:-trails.cool}
+      GF_SERVER_ROOT_URL: https://grafana.internal.${DOMAIN:-trails.cool}
     volumes:
       - ./grafana/provisioning:/etc/grafana/provisioning:ro
       - ./grafana/dashboards:/var/lib/grafana/dashboards:ro
diff --git a/infrastructure/terraform/main.tf b/infrastructure/terraform/main.tf
index 46f0fa7..81b770b 100644
--- a/infrastructure/terraform/main.tf
+++ b/infrastructure/terraform/main.tf
@@ -122,6 +122,25 @@ resource "hcloud_zone_rrset" "planner_aaaa" {
   records = [{ value = hcloud_server.trails.ipv6_address }]
 }
 
+# Internal wildcard — all *.internal.trails.cool resolves to the server.
+# Caddy handles routing per-subdomain. No individual DNS entries needed
+# for internal services (Grafana, Prometheus, etc.)
+resource "hcloud_zone_rrset" "internal_wildcard_a" {
+  zone = "trails.cool"
+  name = "*.internal"
+  type = "A"
+  ttl  = 300
+  records = [{ value = hcloud_server.trails.ipv4_address }]
+}
+
+resource "hcloud_zone_rrset" "internal_wildcard_aaaa" {
+  zone = "trails.cool"
+  name = "*.internal"
+  type = "AAAA"
+  ttl  = 300
+  records = [{ value = hcloud_server.trails.ipv6_address }]
+}
+
 resource "hcloud_zone_rrset" "www_cname" {
   zone = "trails.cool"
   name = "www"