DNS — EnclaveStack

Overview

A DNS zone is a domain you own at Cloudflare or Route 53. EnclaveStack keeps the records you add, puts them back if they are changed elsewhere, and can point a record at this machine.

When to use it

Point shop.example.com at this machine.
Wildcard certificates.
All DNS records next to the rest of your setup.

How it works

DNS provider plug-ins: Cloudflare’s API with a scoped token; Route 53’s API signed with SigV4.
Records: A, AAAA, CNAME and TXT; records EnclaveStack manages are marked so others are left alone.

The control plane checks the token’s access, then writes each record at the provider. A record pointed at the machine follows its public address.

Architecture

EnclaveStack keeps records at your DNS provider.

Flows

Pointing a name at the machine

Store a provider token as a secret.
Create the zone, then a record with Point at this machine.
When the machine’s public address changes, the record follows.

Set it up

In the console

Store the provider token as a secret.
Open DNS and choose New zone.
Open the zone and Add record.

With the CLI

enclave zone create example --provider cloudflare --zone example.com --credentials cloudflare-token

With OpenTofu

OpenTofu configuration

resource "enclave_zone" "example" {
  name               = "example"
  dns_provider       = "cloudflare"
  zone               = "example.com"
  credentials_secret = "cloudflare-token"
}

Settings reference

Every setting and output of the OpenTofu resource; the console and the CLI use the same names in their own words. Generated from platform 4d30582.

`enclave_zone`
Name	Type	Use	What it does
`credentials_secret`	text	required	Secret holding {"apiToken"} (Cloudflare: Zone:Read and DNS:Edit) or {"accessKeyId","secretAccessKey"} (Route 53).
`dns_provider`	text	required	cloudflare or route53 ("provider" is reserved by OpenTofu). Changing it replaces the zone.
`name`	text	required	Name of the zone: 3–40 lowercase letters, digits or hyphens, starting with a letter. Changing it replaces the zone.
`zone`	text	required	The zone's name, e.g. example.com. Changing it replaces the zone.
`project`	text	optional	The project to create it in. Defaults to the provider's project (ENCLAVE_PROJECT, else default). Changing it replaces the resource.
`id`	text	output	Resource ID.
`name_servers`	list of text	output	The zone's name servers.
`zone_id`	text	output	The provider's zone ID.

`enclave_record`
Name	Type	Use	What it does
`name`	text	required	Name of the record: 3–40 lowercase letters, digits or hyphens, starting with a letter. Changing it replaces the record.
`record_name`	text	required	Name inside the zone: "api", "@" for the zone itself, "*.dev" for a wildcard.
`type`	text	required	A, AAAA, CNAME or TXT.
`zone`	text	required	Name of the enclave_zone it belongs to.
`machine`	true or false	optional	Point an A or AAAA record at the machine's public address, and follow it when it changes.
`project`	text	optional	The project to create it in. Defaults to the provider's project (ENCLAVE_PROJECT, else default). Changing it replaces the resource.
`ttl`	number	optional	TTL in seconds (60–86400).
`values`	list of text	optional	Values. Exactly one of values or machine.
`fqdn`	text	output	The record's full name.
`id`	text	output	Resource ID.

Limits and security

Good to know

Cloudflare and Route 53.

Security

Give the token only the rights to edit that zone’s DNS; it is stored encrypted.