# DNS-01 ACME challenge delegation.
# Let's Encrypt follows the CNAME, so the TXT records are published in the
# isti.cnr.it zone instead of the one managed here.

locals {
  acme_challenge_recordset_name = "_acme-challenge.${local.dns_zone.name}"
  acme_challenge_delegation     = "_acme-challenge.isti.cnr.it."
}

resource "openstack_dns_recordset_v2" "acme_challenge_recordset" {
  zone_id     = local.dns_zone_id
  name        = local.acme_challenge_recordset_name
  description = "Delegation of the DNS-01 Let's Encrypt challenge to the isti.cnr.it zone"
  ttl         = 8600
  type        = "CNAME"
  records     = [local.acme_challenge_delegation]
}