# Proxied DNS records. proxied = true keeps the origin IP hidden behind the CDN
# (doc/05 §2 源站 IP 隐藏). The origin must NEVER have had an unproxied A record
# (historic DNS is the most common leak path).
resource "cloudflare_record" "api" {
  for_each = toset(var.api_hostnames)

  zone_id = var.zone_id
  name    = each.value
  type    = "A"
  content = var.origin_ip
  proxied = true
  ttl     = 1 # 1 = automatic (required when proxied)

  comment = "pangolin api/distribution endpoint (managed by terraform)"
}