feat: add immich.ca domain to cloudflare

[zackpollard]

No description provided.

[github-actions]

Terraform Plan

Shared

✅ 1password/account — No changes

✅ 1password/futo-account — No changes

⚠️ cloudflare/account — Plan: 6 to add, 0 to change, 0 to destroy.

OpenTofu used the selected providers to generate the following execution
plan. Resource actions are indicated with the following symbols:
  + create
  # cloudflare_record.immich_ca_aaaa_root will be created
  + resource "cloudflare_record" "immich_ca_aaaa_root" {
      + allow_overwrite = false
      + content         = "100::"
      + created_on      = (known after apply)
      + hostname        = (known after apply)
      + id              = (known after apply)
      + metadata        = (known after apply)
      + modified_on     = (known after apply)
      + name            = "immich.ca"
      + proxiable       = (known after apply)
      + proxied         = true
      + ttl             = 1
      + type            = "AAAA"
      + value           = (known after apply)
      + zone_id         = (known after apply)
    }
  # cloudflare_record.immich_ca_aaaa_www will be created
  + resource "cloudflare_record" "immich_ca_aaaa_www" {
      + allow_overwrite = false
      + content         = "100::"
      + created_on      = (known after apply)
      + hostname        = (known after apply)
      + id              = (known after apply)
      + metadata        = (known after apply)
      + modified_on     = (known after apply)
      + name            = "www"
      + proxiable       = (known after apply)
      + proxied         = true
      + ttl             = 1
      + type            = "AAAA"
      + value           = (known after apply)
      + zone_id         = (known after apply)
    }
  # cloudflare_ruleset.immich_ca_redirects will be created
  + resource "cloudflare_ruleset" "immich_ca_redirects" {
      + description = "Redirects immich.ca to immich.app"
      + id          = (known after apply)
      + kind        = "zone"
      + name        = "immich.ca to immich.app redirects"
      + phase       = "http_request_dynamic_redirect"
      + zone_id     = (known after apply)
      + rules {
          + action      = "redirect"
          + description = "Redirect visitors going to immich.ca links"
          + enabled     = true
          + expression  = "(http.host eq \"www.immich.ca\") or (http.host eq \"immich.ca\")"
          + id          = (known after apply)
          + ref         = (known after apply)
          + action_parameters {
              + from_value {
                  + preserve_query_string = true
                  + status_code           = 307
                  + target_url {
                      + value = "https://immich.app"
                    }
                }
            }
        }
    }
  # cloudflare_tiered_cache.immich_ca will be created
  + resource "cloudflare_tiered_cache" "immich_ca" {
      + cache_type = "smart"
      + id         = (known after apply)
      + zone_id    = (known after apply)
    }
  # cloudflare_zone.immich_ca will be created
  + resource "cloudflare_zone" "immich_ca" {
      + account_id          = "<concealed by 1Password>"
      + id                  = (known after apply)
      + meta                = (known after apply)
      + name_servers        = (known after apply)
      + paused              = false
      + plan                = (known after apply)
      + status              = (known after apply)
      + type                = "full"
      + vanity_name_servers = (known after apply)
      + verification_key    = (known after apply)
      + zone                = "immich.ca"
    }
  # cloudflare_zone_settings_override.immich_ca will be created
  + resource "cloudflare_zone_settings_override" "immich_ca" {
      + id                       = (known after apply)
      + initial_settings         = (known after apply)
      + initial_settings_read_at = (known after apply)
      + readonly_settings        = (known after apply)
      + zone_id                  = (known after apply)
      + zone_status              = (known after apply)
      + zone_type                = (known after apply)
      + settings {
          + always_online               = (known after apply)
          + always_use_https            = "on"
          + automatic_https_rewrites    = (known after apply)
          + binary_ast                  = (known after apply)
          + brotli                      = "on"
          + browser_cache_ttl           = (known after apply)
          + browser_check               = (known after apply)
          + cache_level                 = (known after apply)
          + challenge_ttl               = (known after apply)
          + ciphers                     = (known after apply)
          + cname_flattening            = (known after apply)
          + development_mode            = (known after apply)
          + early_hints                 = "on"
          + email_obfuscation           = (known after apply)
          + filter_logs_to_cloudflare   = (known after apply)
          + fonts                       = "on"
          + h2_prioritization           = (known after apply)
          + hotlink_protection          = (known after apply)
          + http2                       = (known after apply)
          + http3                       = "on"
          + image_resizing              = (known after apply)
          + ip_geolocation              = (known after apply)
          + ipv6                        = (known after apply)
          + log_to_cloudflare           = (known after apply)
          + max_upload                  = (known after apply)
          + min_tls_version             = (known after apply)
          + mirage                      = (known after apply)
          + opportunistic_encryption    = (known after apply)
          + opportunistic_onion         = (known after apply)
          + orange_to_orange            = (known after apply)
          + origin_error_page_pass_thru = (known after apply)
          + origin_max_http_version     = (known after apply)
          + polish                      = (known after apply)
          + prefetch_preload            = (known after apply)
          + privacy_pass                = (known after apply)
          + proxy_read_timeout          = (known after apply)
          + pseudo_ipv4                 = (known after apply)
          + replace_insecure_js         = (known after apply)
          + response_buffering          = (known after apply)
          + rocket_loader               = "on"
          + security_level              = (known after apply)
          + server_side_exclude         = (known after apply)
          + sort_query_string_for_cache = (known after apply)
          + speed_brain                 = "on"
          + ssl                         = "strict"
          + ssl_automatic_mode          = (known after apply)
          + tls_1_2_only                = (known after apply)
          + tls_1_3                     = "zrt"
          + tls_client_auth             = (known after apply)
          + true_client_ip_header       = (known after apply)
          + universal_ssl               = (known after apply)
          + visitor_ip                  = (known after apply)
          + waf                         = (known after apply)
          + webp                        = (known after apply)
          + websockets                  = (known after apply)
          + zero_rtt                    = "on"
          + aegis (known after apply)
          + minify (known after apply)
          + mobile_redirect (known after apply)
          + nel (known after apply)
          + security_header (known after apply)
        }
    }
Plan: 6 to add, 0 to change, 0 to destroy.
Changes to Outputs:
  + immich_ca_zone_id                          = (known after apply)
─────────────────────────────────────────────────────────────────────────────
Note: You didn't use the -out option to save this plan, so OpenTofu can't
guarantee to take exactly these actions if you run "tofu apply" now.

✅ cloudflare/api-keys — No changes

✅ docker/org — No changes

⚠️ github/org — Plan: 0 to add, 4 to change, 0 to destroy.

OpenTofu used the selected providers to generate the following execution
plan. Resource actions are indicated with the following symbols:
  ~ update in-place (current -> planned)
  # github_repository_collaborators.repo_collaborators["immich"] will be updated in-place
  ~ resource "github_repository_collaborators" "repo_collaborators" {
        id             = "455229168"
      ~ invitation_ids = {
          - "koen-futo"  = "286515056"
          - "martabal"   = "284848949"
          - "martyfuhry" = "284848968"
          - "matthinc"   = "284848954"
          - "sudoicezen" = "284848972"
        } -> (known after apply)
        # (2 unchanged attributes hidden)
      - user {
          - permission = "admin" -> null
          - username   = "alextran1502" -> null
        }
      - user {
          - permission = "admin" -> null
          - username   = "bo0tzz" -> null
        }
      - user {
          - permission = "admin" -> null
          - username   = "jrasm91" -> null
        }
      - user {
          - permission = "admin" -> null
          - username   = "zackpollard" -> null
        }
      + user {
          + permission = "maintain"
          + username   = "alextran1502"
        }
      + user {
          + permission = "maintain"
          + username   = "bo0tzz"
        }
      + user {
          + permission = "maintain"
          + username   = "jrasm91"
        }
      + user {
          + permission = "maintain"
          + username   = "zackpollard"
        }
        # (59 unchanged blocks hidden)
    }
  # github_repository_collaborators.repo_collaborators["static-pages"] will be updated in-place
  ~ resource "github_repository_collaborators" "repo_collaborators" {
        id             = "822727374"
      ~ invitation_ids = {
          - "PixelJonas" = "284848947"
          - "fyfrey"     = "284848959"
          - "kennyfuto"  = "288622006"
          - "koen-futo"  = "286515046"
          - "martabal"   = "284848951"
          - "martyfuhry" = "284848969"
          - "matthinc"   = "284848955"
          - "orhan98"    = "315880176"
          - "sudoicezen" = "284848974"
        } -> (known after apply)
        # (2 unchanged attributes hidden)
      - user {
          - permission = "admin" -> null
          - username   = "alextran1502" -> null
        }
      - user {
          - permission = "admin" -> null
          - username   = "bo0tzz" -> null
        }
      - user {
          - permission = "admin" -> null
          - username   = "jrasm91" -> null
        }
      - user {
          - permission = "admin" -> null
          - username   = "zackpollard" -> null
        }
      + user {
          + permission = "maintain"
          + username   = "alextran1502"
        }
      + user {
          + permission = "maintain"
          + username   = "bo0tzz"
        }
      + user {
          + permission = "maintain"
          + username   = "jrasm91"
        }
      + user {
          + permission = "maintain"
          + username   = "zackpollard"
        }
        # (58 unchanged blocks hidden)
    }
  # github_repository_collaborators.repo_collaborators["test-assets"] will be updated in-place
  ~ resource "github_repository_collaborators" "repo_collaborators" {
        id             = "697157116"
      ~ invitation_ids = {
          - "PixelJonas" = "284848946"
          - "fyfrey"     = "284848960"
          - "kennyfuto"  = "288622000"
          - "koen-futo"  = "286515048"
          - "martabal"   = "284848952"
          - "martyfuhry" = "284848970"
          - "matthinc"   = "284848956"
          - "orhan98"    = "315880175"
          - "staticdog"  = "320859393"
          - "sudoicezen" = "284848973"
        } -> (known after apply)
        # (2 unchanged attributes hidden)
      - user {
          - permission = "admin" -> null
          - username   = "alextran1502" -> null
        }
      - user {
          - permission = "admin" -> null
          - username   = "bo0tzz" -> null
        }
      - user {
          - permission = "admin" -> null
          - username   = "jrasm91" -> null
        }
      - user {
          - permission = "admin" -> null
          - username   = "zackpollard" -> null
        }
      + user {
          + permission = "maintain"
          + username   = "alextran1502"
        }
      + user {
          + permission = "maintain"
          + username   = "bo0tzz"
        }
      + user {
          + permission = "maintain"
          + username   = "jrasm91"
        }
      + user {
          + permission = "maintain"
          + username   = "zackpollard"
        }
        # (58 unchanged blocks hidden)
    }
  # github_repository_collaborators.repo_collaborators["walkrs"] will be updated in-place
  ~ resource "github_repository_collaborators" "repo_collaborators" {
        id             = "1156754889"
      ~ invitation_ids = {
          - "C-Otto"          = "307331486"
          - "PixelJonas"      = "307331438"
          - "adamantike"      = "307331464"
          - "dahool"          = "307331471"
          - "ddshd"           = "307331444"
          - "fyfrey"          = "307331463"
          - "github-cli"      = "307331445"
          - "jbaez"           = "307331428"
          - "kennyfuto"       = "307331447"
          - "koen-futo"       = "307331458"
          - "martabal"        = "307331390"
          - "martyfuhry"      = "307331483"
          - "matthinc"        = "307331420"
          - "michelheusschen" = "307331480"
          - "midzelis"        = "309034718"
          - "orhan98"         = "315880173"
          - "samholton"       = "307331386"
          - "schuhbacca"      = "307331432"
          - "skatsubo"        = "307331414"
          - "staticdog"       = "320859390"
        } -> (known after apply)
        # (2 unchanged attributes hidden)
      - user {
          - permission = "admin" -> null
          - username   = "alextran1502" -> null
        }
      - user {
          - permission = "admin" -> null
          - username   = "bo0tzz" -> null
        }
      - user {
          - permission = "admin" -> null
          - username   = "jrasm91" -> null
        }
      - user {
          - permission = "admin" -> null
          - username   = "zackpollard" -> null
        }
      + user {
          + permission = "maintain"
          + username   = "alextran1502"
        }
      + user {
          + permission = "maintain"
          + username   = "bo0tzz"
        }
      + user {
          + permission = "maintain"
          + username   = "jrasm91"
        }
      + user {
          + permission = "maintain"
          + username   = "zackpollard"
        }
        # (58 unchanged blocks hidden)
    }
Plan: 0 to add, 4 to change, 0 to destroy.
╷
│ Warning: Argument is deprecated
│ 
│   with github_repository.repositories[".github"],
│   on repositories.tf line 173, in resource "github_repository" "repositories":
│  173:   vulnerability_alerts      = !each.value.archived
│ 
│ Use the github_repository_vulnerability_alerts resource instead. This field
│ will be removed in a future version.
│ 
│ (and 24 more similar warnings elsewhere)
╵
─────────────────────────────────────────────────────────────────────────────
Note: You didn't use the -out option to save this plan, so OpenTofu can't
guarantee to take exactly these actions if you run "tofu apply" now.

✅ github/secrets — No changes

✅ github/webhooks — No changes

✅ zitadel/cloud — No changes

✅ zitadel/self-hosted — No changes

Scoped (dev)

✅ discord/community — No changes

✅ monitoring/grafana — No changes

✅ zitadel/customer — No changes

Scoped (prod)

✅ discord/community — No changes

✅ discord/futo — No changes

✅ monitoring/grafana — No changes

✅ zitadel/customer — No changes