feat(cloudflare): import email DNS records for perish.dev

.gitignore

@@ -199,3 +199,6 @@ terraform.rc
 # Optional: ignore plan files saved before destroying Terraform configuration
 # Uncomment the line below if you want to ignore planout files.
 # planout
+
+# cf-terraforming auto-downloads a terraform binary into each working dir
+/terraform/*/terraform

docs/import.md

@@ -42,22 +42,39 @@ cd terraform/cloudflare
 
 terraform init -backend=false          # cf-terraforming requires an initialised dir
 
+# Zone-scoped resources (DNS records) — --account and --zone are mutually exclusive.
 cf-terraforming generate \
-  --resource-type "cloudflare_dns_record,cloudflare_r2_bucket,cloudflare_pages_project,cloudflare_workers_kv_namespace" \
+  --terraform-binary-path "$(which terraform)" \
+  --resource-type "cloudflare_dns_record" \
   --zone "$CLOUDFLARE_ZONE_ID" \
-  --account "$CLOUDFLARE_ACCOUNT_ID" \
   > generated.tf
+
+# Account-scoped resources.
+cf-terraforming generate \
+  --terraform-binary-path "$(which terraform)" \
+  --resource-type "cloudflare_r2_bucket,cloudflare_pages_project,cloudflare_workers_kv_namespace" \
+  --account "$CLOUDFLARE_ACCOUNT_ID" \
+  >> generated.tf
 ```
 
+Without `--terraform-binary-path`, cf-terraforming downloads its own terraform binary into the current directory. The flag tells it to reuse the one already on PATH.
+
 `generated.tf` is the file the existing comment in `main.tf` references. Review it: rename resource labels to something readable (cf-terraforming uses `terraform_managed_resource` placeholders), drop anything you don't actually want managed, and commit.
 
 ## Emit `import` blocks
 
 ```sh
 cf-terraforming import \
   --modern-import-block \
-  --resource-type "cloudflare_dns_record,cloudflare_r2_bucket,cloudflare_pages_project,cloudflare_workers_kv_namespace" \
+  --terraform-binary-path "$(which terraform)" \
+  --resource-type "cloudflare_dns_record" \
   --zone "$CLOUDFLARE_ZONE_ID" \
+  >> generated.tf
+
+cf-terraforming import \
+  --modern-import-block \
+  --terraform-binary-path "$(which terraform)" \
+  --resource-type "cloudflare_r2_bucket,cloudflare_pages_project,cloudflare_workers_kv_namespace" \
   --account "$CLOUDFLARE_ACCOUNT_ID" \
   >> generated.tf
 ```

terraform/cloudflare/dns.tf

@@ -0,0 +1,116 @@
+# DNS records for perish.dev.
+#
+# Imported from existing Cloudflare state via `cf-terraforming` (see
+# docs/import.md). Resource labels were renamed for readability — the
+# `id` values inside `import` blocks remain the canonical Cloudflare
+# record IDs.
+#
+# Apex / www records (A perish.dev, A www.perish.dev) are intentionally
+# absent from this file. They currently point at the IANA documentation
+# IP 192.0.2.1 (unroutable) with a Cloudflare Redirect Rule serving
+# perish.dev -> github.com/perishdev at the edge. The follow-up PR
+# replaces them with GitHub Pages records (4× apex A records + www
+# CNAME) once perishdev/perishdev.github.io is live.
+
+# ── Email routing (Cloudflare-managed) ─────────────────────────────
+
+import {
+  to = cloudflare_dns_record.mx_route1
+  id = "${local.zone_id}/20010945014f7700d4e7c7a5866d2049"
+}
+
+resource "cloudflare_dns_record" "mx_route1" {
+  zone_id  = local.zone_id
+  type     = "MX"
+  name     = local.domain
+  content  = "route1.mx.cloudflare.net"
+  priority = 86
+  proxied  = false
+  tags     = []
+  ttl      = 1
+  settings = {}
+}
+
+import {
+  to = cloudflare_dns_record.mx_route2
+  id = "${local.zone_id}/9bdbcd39cd11cfa3e24b0edb97a3662c"
+}
+
+resource "cloudflare_dns_record" "mx_route2" {
+  zone_id  = local.zone_id
+  type     = "MX"
+  name     = local.domain
+  content  = "route2.mx.cloudflare.net"
+  priority = 42
+  proxied  = false
+  tags     = []
+  ttl      = 1
+  settings = {}
+}
+
+import {
+  to = cloudflare_dns_record.mx_route3
+  id = "${local.zone_id}/9ec5860b93cbcdd1f5ede53edf1b0ae8"
+}
+
+resource "cloudflare_dns_record" "mx_route3" {
+  zone_id  = local.zone_id
+  type     = "MX"
+  name     = local.domain
+  content  = "route3.mx.cloudflare.net"
+  priority = 65
+  proxied  = false
+  tags     = []
+  ttl      = 1
+  settings = {}
+}
+
+# ── Email authentication ───────────────────────────────────────────
+
+import {
+  to = cloudflare_dns_record.spf
+  id = "${local.zone_id}/5274d7018143bd6008bc5a02ab22498e"
+}
+
+resource "cloudflare_dns_record" "spf" {
+  zone_id  = local.zone_id
+  type     = "TXT"
+  name     = local.domain
+  content  = "\"v=spf1 include:_spf.mx.cloudflare.net ~all\""
+  proxied  = false
+  tags     = []
+  ttl      = 1
+  settings = {}
+}
+
+import {
+  to = cloudflare_dns_record.dmarc
+  id = "${local.zone_id}/d61861f4a14141533d1233be20d6de94"
+}
+
+resource "cloudflare_dns_record" "dmarc" {
+  zone_id  = local.zone_id
+  type     = "TXT"
+  name     = "_dmarc.${local.domain}"
+  content  = "\"v=DMARC1; p=none; rua=mailto:9532460379b24a828af6ac1ceb60bd15@dmarc-reports.cloudflare.net\""
+  proxied  = false
+  tags     = []
+  ttl      = 1
+  settings = {}
+}
+
+import {
+  to = cloudflare_dns_record.dkim_cf2024_1
+  id = "${local.zone_id}/729abab2c08608f8b2d143891c4941fb"
+}
+
+resource "cloudflare_dns_record" "dkim_cf2024_1" {
+  zone_id  = local.zone_id
+  type     = "TXT"
+  name     = "cf2024-1._domainkey.${local.domain}"
+  content  = "\"v=DKIM1; h=sha256; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAiweykoi+o48IOGuP7GR3X0MOExCUDY/BCRHoWBnh3rChl7WhdyCxW3jgq1daEjPPqoi7sJvdg5hEQVsgVRQP4DcnQDVjGMbASQtrY4WmB1VebF+RPJB2ECPsEDTpeiI5ZyUAwJaVX7r6bznU67g7LvFq35yIo4sdlmtZGV+i0H4cpYH9+3JJ78k\" \"m4KXwaf9xUJCWF6nxeD+qG6Fyruw1Qlbds2r85U9dkNDVAS3gioCvELryh1TxKGiVTkg4wqHTyHfWsp7KD3WQHYJn0RyfJJu6YEmL77zonn7p2SRMvTMP3ZEXibnC9gz3nnhR6wcYL8Q7zXypKTMD58bTixDSJwIDAQAB\""
+  proxied  = false
+  tags     = []
+  ttl      = 1
+  settings = {}
+}