# MCP DNS Management

Infrastructure as Code for managing MCP Cloudflare DNS records using Pulumi.

DNS records are defined in [`src/config/records.ts`](src/config/records.ts), keyed by domain name.

## Deployment

### Production Deployment (Automated)

**Note:** Production deployment is automatically handled by GitHub Actions. All merges to the `main` branch trigger an automatic deployment via [the configured GitHub Actions workflow](.github/workflows/deploy.yml).

### Manual Deployment

Pre-requisites:

- [Pulumi CLI installed](https://www.pulumi.com/docs/iac/download-install/)
- [Google Cloud SDK installed](https://cloud.google.com/sdk/docs/install)
- Access to GCP project and GCS bucket
- Required credentials and secrets

1. Authenticate with GCP: `gcloud auth application-default login`
2. Get the passphrase file `passphrase.prod.txt` from the maintainers
3. Preview changes: `make preview`
4. Deploy changes: `make up`

## Initial Setup

If setting up this infrastructure for the first time:

### 1. Create GCS Bucket for Pulumi State

```bash
gcloud projects create mcp-dns-prod
gcloud config set project mcp-dns-prod
gcloud services enable storage.googleapis.com

# Create service account for CI/CD
gcloud iam service-accounts create pulumi-svc \
  --display-name="Pulumi Service Account"

gcloud projects add-iam-policy-binding mcp-dns-prod \
  --member="serviceAccount:pulumi-svc@mcp-dns-prod.iam.gserviceaccount.com" \
  --role="roles/storage.admin"

gcloud iam service-accounts keys create sa-key.json \
  --iam-account=pulumi-svc@mcp-dns-prod.iam.gserviceaccount.com

# Create bucket
gsutil mb gs://mcp-dns-prod-pulumi-state
```

### 2. Create Cloudflare API Token

1. Go to [Cloudflare API Tokens](https://dash.cloudflare.com/profile/api-tokens)
2. Create a token with **Zone:DNS:Edit** permission for the zones you want to manage
3. Note the token value

### 3. Initialize Pulumi Stack

```bash
# Login to Pulumi backend
pulumi login gs://mcp-dns-prod-pulumi-state

# Create production stack
export PULUMI_CONFIG_PASSPHRASE_FILE=passphrase.prod.txt
pulumi stack init prod

# Configure application secrets in Pulumi
pulumi config set --secret cloudflare:apiToken "your-api-token"
pulumi config set cloudflare:accountId "your-account-id"
```

You can find your Cloudflare Account ID in the Cloudflare dashboard URL or in the right sidebar of any zone's overview page.

### 4. Configure GitHub Actions Secrets

Add the CI/CD secrets to GitHub Actions (repository settings → Secrets and variables → Actions):

- `GCP_PROD_SERVICE_ACCOUNT_KEY`: Content of `sa-key.json`
- `PULUMI_PROD_PASSPHRASE`: The passphrase you set above