From 6a2aacc4e612244303559649b4c9769587e0fc7c Mon Sep 17 00:00:00 2001
From: Story Crater Bot <19826264+Riotpiaole@users.noreply.github.com>
Date: Tue, 21 Jul 2026 08:02:24 -0700
Subject: [PATCH] =?UTF-8?q?feat(terraform):=20add=20per-node=20Cloudflare?=
 =?UTF-8?q?=20Tunnel=20cert=20SANs=20to=20controlplane=20certSANs=20?=
 =?UTF-8?q?=E2=80=94=20remote=20talosctl/kubectl=20over=20tunnel=20pass=20?=
 =?UTF-8?q?TLS=20verification?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Adds optional cloudflare_talos_sans (machine.certSANs, talos API :50000) and
cloudflare_apiserver_sans (cluster.apiServer.certSANs, kube-apiserver :6443) per
control-plane node. cp-1 gets cp1.homelab + cp1-talos.homelab; cp-2/cp-3 get
their cpN-talos.homelab. Values set in gitignored tfvars.
---
 terraform/main.tf                      | 4 ++++
 terraform/templates/controlplane.tftpl | 6 ++++++
 terraform/variables.tf                 | 4 ++++
 3 files changed, 14 insertions(+)

diff --git a/terraform/main.tf b/terraform/main.tf
index 3670b89..8d9b1b4 100644
--- a/terraform/main.tf
+++ b/terraform/main.tf
@@ -51,6 +51,10 @@ resource "local_file" "controlplane_configs" {
     zone                = each.value.zone
     allow_scheduling    = each.value.allow_scheduling
 
+    # Cloudflare Tunnel cert SANs (talos :50000 and kube-apiserver :6443)
+    cloudflare_talos_sans     = each.value.cloudflare_talos_sans
+    cloudflare_apiserver_sans = each.value.cloudflare_apiserver_sans
+
     # Cluster config
     cluster_id      = var.cluster_id
     cluster_secret  = var.cluster_secret
diff --git a/terraform/templates/controlplane.tftpl b/terraform/templates/controlplane.tftpl
index 5dbcdaf..170cd4b 100644
--- a/terraform/templates/controlplane.tftpl
+++ b/terraform/templates/controlplane.tftpl
@@ -13,6 +13,9 @@ machine:
 %{ if wg0_ip != null ~}
     - ${wg0_ip}
 %{ endif ~}
+%{ for san in cloudflare_talos_sans ~}
+    - ${san}
+%{ endfor ~}
   network:
     hostname: ${hostname}
     interfaces:
@@ -145,6 +148,9 @@ cluster:
       - ${wg0_ip}
 %{ endif ~}
       - ${lan_ip}
+%{ for san in cloudflare_apiserver_sans ~}
+      - ${san}
+%{ endfor ~}
     image: ${kube_apiserver_img}
     admissionControl:
       - name: PodSecurity
diff --git a/terraform/variables.tf b/terraform/variables.tf
index 1e18da5..68dee00 100644
--- a/terraform/variables.tf
+++ b/terraform/variables.tf
@@ -130,6 +130,10 @@ variable "controlplane_configs" {
     }))
     zone             = string
     allow_scheduling = bool
+    # Extra cert SANs for this node — e.g. Cloudflare Tunnel public hostnames so
+    # remote talosctl/kubectl over the tunnel pass TLS verification.
+    cloudflare_talos_sans     = optional(list(string), [])
+    cloudflare_apiserver_sans = optional(list(string), [])
   }))
   description = "Control plane machine configurations, keyed by node"
 }