Merge pull request #27 from pkgw/google-mail

Set up for Google-based mail handling

prod/.terraform.lock.hcl

@@ -2,21 +2,21 @@
 # Manual edits may be lost in future updates.
 
 provider "registry.terraform.io/hashicorp/azurerm" {
-  version     = "3.24.0"
-  constraints = ">= 2.41.0"
+  version     = "3.66.0"
+  constraints = "3.66.0"
   hashes = [
-    "h1:DfQtILx+kjaSiNt6JzOyUpJ0PlQOw85GG0CxKBUtsgQ=",
-    "zh:178d9118d6b97f353836da25beb1d0a084375ba21af1107b01c0447083480bbf",
-    "zh:2ada465ad8c44dbcb665137b8985ea576a306a60b9fb1754e282b861f9839351",
-    "zh:5732804bb44262cb953938954b3fd46ebc8710d257aa2f9e47c42f6f49df5a54",
-    "zh:5e9c38ae392697cc4cf2f5cb1663baf7af249caa8ca17ff0119516e877b72e71",
-    "zh:ae01687bb6c695fa3322b8441fdd4d9b27b98d6abe7cac33b5279b7f23c25bd8",
-    "zh:bbf75fe9490b8676746e4f856ed830362bb8135cbd274dc0d1c037c573aef16c",
-    "zh:d9052f567267152bd3705e4e1d01b5956d2f24ac9c59c1345cd74db1e14bc2a9",
-    "zh:df0d49bb84f5244465c6b56582a4b8a5653b6f5e77bd899e84e61e1a8fb40347",
-    "zh:f521b0f936b8ac7530bb299d66b0f5e41d402076f1993e9e343366215d341600",
+    "h1:2pgTU9lsnoKPnB3sJqFTYQhHFJJMTgreKtqM3ORHI6Q=",
+    "zh:02f1b55836f3ca38d1203c0fb748c2f9de3436c429814b1d901143e32ca2e9fc",
+    "zh:32410ab954c3812c15419c2a5d54562bcd0aaaff72127e6077ed2db91c3329ea",
+    "zh:342c5e097f05d284933a64b5fb8e2c1ad44a33b3be045fcc66653014d2d43900",
+    "zh:498f4c3526a4564cb8c8d19fbecb82362691719c163bf5051c433abf34da20e6",
+    "zh:5f16dceafd3478ec53f426074585ff917a574995696ab6ca8562e584abc6b19d",
+    "zh:78574e96d88fe00a74d00fd4b3ee2f50ba9669ad2535e5133593ca6d63646e9c",
+    "zh:902a465eb925eb691ecdb91cde2ac0838146baa76b741d282ac222c1853c7cdd",
+    "zh:c6d48c1ad9c719e52ea036ed83ef1b6ed95d1601aa57b3f8531bdca44ff40eb4",
+    "zh:e5746a1eb89b659a407cb35375cfd1bde153d24b63ea3ebd10973b60dd345cbd",
+    "zh:e6dbf4ad979e1f95d942a50a6f49d38ade502a200c2bdc849e50503d6219a223",
     "zh:f569b65999264a9416862bca5cd2a6177d94ccb0424f3a4ef424428912b9cb3c",
-    "zh:f69dd2daa5a76b0554caaa78ee266292843e53330c349e34cbfd2fed257eadbb",
-    "zh:f88c183c266d07de9f8866676b5e10f338b79995dad55977e72928ecb6c07c3b",
+    "zh:f5d4af4e0011e9fa9be055e6efee1cc8be10f0fc1092bab921de7ebbb26ed4c4",
   ]
 }

prod/dns.tf

@@ -3,8 +3,6 @@
 # Not (yet) described here:
 # - @ SOA record
 # - @ NS record
-# - @ MX record
-# - @ TXT record
 # - `mail` A record
 # - `mail` MX record
 
@@ -25,6 +23,61 @@ resource "azurerm_dns_a_record" "root_a" {
   records             = [azurerm_public_ip.frontend.ip_address]
 }
 
+resource "azurerm_dns_txt_record" "root_txt" {
+  name                = "@"
+  zone_name           = azurerm_dns_zone.flagship.name
+  resource_group_name = azurerm_dns_zone.flagship.resource_group_name
+  ttl                 = 3600
+
+  record {
+    value = "v=spf1 a mx include:sendgrid.net ~all"
+  }
+
+  record {
+    value = "MS=ms25610440"
+  }
+
+  record {
+    value = "google-site-verification=${var.googleSiteVerificationTag1}"
+  }
+
+  record {
+    value = "google-site-verification=${var.googleSiteVerificationTag2}"
+  }
+}
+
+resource "azurerm_dns_mx_record" "root_mx" {
+  name                = "@"
+  zone_name           = azurerm_dns_zone.flagship.name
+  resource_group_name = azurerm_dns_zone.flagship.resource_group_name
+  ttl                 = 3600
+
+  record {
+    preference = 1
+    exchange   = "aspmx.l.google.com."
+  }
+
+  record {
+    preference = 5
+    exchange   = "alt1.aspmx.l.google.com."
+  }
+
+  record {
+    preference = 5
+    exchange   = "alt2.aspmx.l.google.com."
+  }
+
+  record {
+    preference = 10
+    exchange   = "alt3.aspmx.l.google.com."
+  }
+
+  record {
+    preference = 10
+    exchange   = "alt4.aspmx.l.google.com."
+  }
+}
+
 resource "azurerm_dns_cname_record" "www" {
   name                = "www"
   zone_name           = azurerm_dns_zone.flagship.name

prod/main.tf

@@ -21,7 +21,7 @@ terraform {
   required_providers {
     azurerm = {
       source  = "hashicorp/azurerm"
-      version = ">= 2.41.0"
+      version = "=3.66"
     }
   }
 

prod/variables.tf

@@ -80,3 +80,11 @@ variable "wwttoursDbPassword" {
 variable "appLogSasUrl" {
   description = "Azure Blob Storage SAS URL for Windows web app diagnostic logs"
 }
+
+variable "googleSiteVerificationTag1" {
+  description = "A Google site verification tag (1)"
+}
+
+variable "googleSiteVerificationTag2" {
+  description = "A Google site verification tag (2)"
+}