refactor(edge,iam): apply best practices to relay and Zitadel config

- edge: extract VPC/subnet/bandwidth/disk/DNS/Caddy settings into variables
- edge: add Caddyfile template with SSE-safe flush_interval -1 and security headers
- edge: add WireGuard NAT masquerade so homelab peer accepts forwarded client IPs
- edge: mark user_data sensitive and add prevent_destroy to the relay instance
- edge: validate relay_admin_cidr and Cloudflare hostnames
- edge: parameterise Cloudflare TTL/proxied and enforce proxied tunnel CNAMEs
- iam: fix PDB key to chart-supported pdb and remove unsupported extraVolumes
- iam: keep login hardened; drop unsupported login PDB

terraform/edge/tencent.tf

@@ -13,14 +13,14 @@
 
 resource "tencentcloud_vpc" "edge" {
   name       = "${replace(var.china_domain, ".", "_")}_edge"
-  cidr_block = "10.66.0.0/16"
+  cidr_block = var.edge_vpc_cidr
 }
 
 resource "tencentcloud_subnet" "edge" {
   name              = "${replace(var.china_domain, ".", "_")}_edge"
   vpc_id            = tencentcloud_vpc.edge.id
   availability_zone = var.tencent_availability_zone
-  cidr_block        = "10.66.1.0/24"
+  cidr_block        = var.edge_subnet_cidr
 }
 
 resource "tencentcloud_key_pair" "edge" {
@@ -62,10 +62,27 @@ resource "tencentcloud_security_group_rule" "wireguard" {
 
 # cloud-init: WireGuard listener, forwarding sysctls, and Caddy for TLS.
 # The relay never holds application credentials; it forwards bytes.
+#
+# NOTE ON THE PRIVATE KEY: user_data is visible in the instance metadata and in
+# Terraform state. That is a known limitation of bootstrapping WireGuard this
+# way. The argument is wrapped in sensitive() to keep it out of plan/apply
+# output, but anyone with console or state access can read it. Rotate the key
+# if the state or the instance metadata is ever exposed.
 locals {
+  china_fqdns = [for host in var.china_hostnames : "${host}.${var.china_domain}"]
+
+  caddyfile = templatefile("${path.module}/templates/Caddyfile.tpl", {
+    acme_email       = var.acme_email
+    hosts            = join(", ", local.china_fqdns)
+    ingress_upstream = var.ingress_upstream
+  })
+
   relay_user_data = <<-EOT
     #cloud-config
     package_update: true
+    package_upgrade: false
+    manage_etc_hosts: true
+    timezone: Asia/Shanghai
     packages: [wireguard, wireguard-tools, caddy]
     write_files:
       - path: /etc/wireguard/wg0.conf
@@ -75,17 +92,27 @@ locals {
           Address = ${var.wireguard_relay_address}
           ListenPort = ${var.wireguard_port}
           PrivateKey = ${var.wireguard_relay_private_key}
+          # Masquerade forwarded traffic so the homelab peer only has to accept
+          # packets sourced from the relay's tunnel address. Without this the
+          # homelab peer's AllowedIPs would drop the original client source IP.
+          PostUp = iptables -t nat -A POSTROUTING -o wg0 -j MASQUERADE
+          PostDown = iptables -t nat -D POSTROUTING -o wg0 -j MASQUERADE
           [Peer]
           PublicKey = ${var.wireguard_homelab_public_key}
-          AllowedIPs = ${var.wireguard_homelab_address}
+          AllowedIPs = ${var.wireguard_homelab_allowed_ips}
           PersistentKeepalive = 25
       - path: /etc/sysctl.d/99-wireguard.conf
         content: |
           net.ipv4.ip_forward = 1
+      - path: /etc/caddy/Caddyfile
+        permissions: "0644"
+        content: ${jsonencode(local.caddyfile)}
     runcmd:
       - sysctl --system
       - systemctl enable --now wg-quick@wg0
+      - caddy validate --config /etc/caddy/Caddyfile
       - systemctl enable --now caddy
+      - systemctl restart caddy
   EOT
 }
 
@@ -102,16 +129,24 @@ resource "tencentcloud_instance" "relay" {
   allocate_public_ip = true
 
   # Outbound only needs a few Mbps; inbound TLS is the same order.
-  internet_max_bandwidth_out = 20
-  system_disk_type           = "CLOUD_PREMIUM"
-  system_disk_size           = 50
+  internet_max_bandwidth_out = var.relay_internet_max_bandwidth_out
+  system_disk_type           = var.relay_system_disk_type
+  system_disk_size           = var.relay_system_disk_size
 
-  user_data = local.relay_user_data
+  # The private key is embedded in this bootstrap script. sensitive() keeps it
+  # out of CLI output; it does not remove it from state or instance metadata.
+  user_data = sensitive(local.relay_user_data)
 
   tags = {
     role   = "china-edge"
     domain = var.china_domain
   }
+
+  # Accidental `terraform destroy` would take the only China-facing edge down.
+  # Remove this block deliberately when a replacement path exists.
+  lifecycle {
+    prevent_destroy = true
+  }
 }
 
 # DNS for the .cn domain lives at DNSPod (Tencent). Each subdomain resolves to
@@ -123,8 +158,8 @@ resource "tencentcloud_dnspod_record" "china" {
   domain      = var.china_domain
   sub_domain  = each.value
   record_type = "A"
-  record_line = "默认"
+  record_line = var.china_dns_record_line
   value       = tencentcloud_instance.relay.public_ip
-  ttl         = 600
+  ttl         = var.china_dns_ttl
   remark      = "China edge relay; origin is the homelab ingress over WireGuard"
 }