chore: adding dane tls

environments/prod/data.tf

@@ -0,0 +1,5 @@
+data "aws_acm_certificate" "website_cert_kiraum" {
+  provider = aws.us_east_1
+  domain   = "kiraum.it"
+  statuses = ["ISSUED"]
+}

environments/prod/locals.tf

@@ -0,0 +1,3 @@
+locals {
+  tlsa_hash_kiraum = base64encode(sha256(data.aws_acm_certificate.website_cert_kiraum.certificate))
+}

environments/prod/main.tf

@@ -63,7 +63,7 @@ module "billing_report" {
 module "route53" {
   source = "../../modules/route53"
 
-  hosted_zones = {
+  domains = {
     "kiraum_it" = {
       domain_name = "kiraum.it"
       comment     = "kiraum.it hosted zone"
@@ -95,6 +95,12 @@ module "route53" {
           ttl     = 300
           records = ["dpop20p5u4112.cloudfront.net"]
         },
+        {
+          name    = "_443._tcp"
+          type    = "TXT"
+          ttl     = 300
+          records = ["3 1 1 ${local.tlsa_hash_kiraum}"]
+        },
         # MX records for email routing
         {
           name    = ""

modules/route53/main.tf

@@ -9,35 +9,36 @@ terraform {
 }
 
 resource "aws_route53_zone" "zones" {
-  for_each = var.hosted_zones
-
-  name    = each.value.domain_name
-  comment = each.value.comment
+  for_each = var.domains
+  name     = each.value.domain_name
+  comment  = each.value.comment
 }
 
 resource "aws_route53_record" "records" {
   for_each = { for record in flatten([
-    for zone_key, zone in var.hosted_zones : [
+    for domain, zone in var.domains : [
       for record in zone.records : {
-        zone_key = zone_key
-        record   = record
+        key = "${domain}-${record.name}-${record.type}"
+        value = merge(record, {
+          zone_id = aws_route53_zone.zones[domain].zone_id
+        })
       }
     ]
-  ]) : "${record.zone_key}-${record.record.name}-${record.record.type}" => record }
+  ]) : record.key => record.value }
 
-  zone_id = aws_route53_zone.zones[each.value.zone_key].zone_id
-  name    = each.value.record.name
-  type    = each.value.record.type
+  zone_id = each.value.zone_id
+  name    = each.value.name
+  type    = each.value.type
 
   dynamic "alias" {
-    for_each = each.value.record.alias != null ? [each.value.record.alias] : []
+    for_each = each.value.alias != null ? [each.value.alias] : []
     content {
       name                   = alias.value.name
       zone_id                = alias.value.zone_id
       evaluate_target_health = alias.value.evaluate_target_health
     }
   }
 
-  ttl     = each.value.record.alias == null ? each.value.record.ttl : null
-  records = each.value.record.alias == null ? each.value.record.records : null
+  ttl     = each.value.alias == null ? each.value.ttl : null
+  records = each.value.alias == null ? each.value.records : null
 }

modules/route53/variables.tf

@@ -1,4 +1,4 @@
-variable "hosted_zones" {
+variable "domains" {
   type = map(object({
     domain_name = string
     comment     = string