tf-cloudflare-dns

Example repository for managing Cloudflare domain DNS zone records with Terraform. Repository contains ready-to-use Terraform module with examples, as well as a GitHub workflow template for deploying the configuration.

Resources are configured using cloudflare/cloudflare Terraform provider. Additional provider information available in the official documentation.

Cloudflare also offers a tool for generating templates and importing existing resources to Terraform state.

Prerequisites

• Some general knowledge about Terraform
• Cloudflare API token with permission (Zone.DNS) to manage the DNS zones. Instructions in Cloudflare docs.
• Terraform remote backend configuration to store the state file
  • In this repository, azurerm provider & Azure Storage Account is used for the remote state
  • Azure remote backend connection is set up with OIDC following the GitHub instructions
• Migration decision:
  • Option 1: Do not migrate existing, use Terraform only for new zones/records
  • Option 2: Import existing records to Terraform state
  • Option 3 (Recommended approach for easy migration):
    • Create "duplicate/copy" records with Terraform for every zone and validate the results. The Terraform module contains an variable name_prefix which can be passed to the module, that can be used to easily add a prefix (e.g test-) to every record created
    • After confirming the records are created correctly, delete all records from the zone (e.g. from the CF dashboard), just remove the name_prefix from the module call and it will default to "" empty string and hence remove the prefix
    • Deploy once more to finish up the migration, with no need for any state file importing

How to use

General high-level instructions for usage. Basic knowledge of Terraform & GitHub & Cloudflare is assumpted. Examples of syntax/usage are available in the repository.

1. Set GitHub repository secrets:
   • Cloudflare API token as CLOUDFLARE_API_TOKEN
   • If using Azure remote backend, also set AZURE_CLIENT_ID, AZURE_TENANT_ID and AZURE_SUBSCRIPTION_ID secrets
2. In terraform/records.tf, define your dns zone objects and records in records local
3. Deploy using the included GitHub workflow
   • Workflow is set to automatically trigger from devand main branches. dev branch trigger will only run the Terraform plan job and hence can be used to inspect the changes. main branch will trigger will run plan and apply jobs.