@zaip-ai/cli 6.3.0 → 7.5.0

package/templates/infra/terraform/infisical.tf

@@ -0,0 +1,57 @@
+# Optional DNS only. Infisical containers, TLS and bootstrap use a separately
+# authorized host configuration; no credentials enter Terraform or user_data.
+variable "infisical" {
+  description = "Opt-in vault hostname on VPS 1 ingress; dedicated vault stack runs on private VPS 2. Null creates nothing."
+  type = object({
+    hostname = string
+  })
+  default  = null
+  nullable = true
+  validation {
+    condition     = var.infisical == null ? true : can(regex("^[a-z0-9-]+(?:\\.[a-z0-9-]+)+$", var.infisical.hostname))
+    error_message = "Infisical requires a lowercase fully qualified hostname."
+  }
+}
+
+resource "cloudflare_dns_record" "infisical" {
+  count   = var.infisical == null ? 0 : 1
+  zone_id = var.cloudflare_zone_id
+  name    = var.infisical.hostname
+  type    = "A"
+  content = local.edge_ipv4
+  proxied = true
+  ttl     = 1
+  comment = "Managed by Zaip Terraform; destination=edge; optional Infisical ingress"
+
+  lifecycle {
+    prevent_destroy = true
+    precondition {
+      condition     = local.edge_ipv4 != null
+      error_message = "Infisical DNS requires the approved edge IPv4."
+    }
+    precondition {
+      condition     = endswith(var.infisical.hostname, ".${var.cloudflare_zone_name}")
+      error_message = "Infisical hostname must be inside the approved zone."
+    }
+    precondition {
+      condition = alltrue([
+        for record in values(var.cloudflare_dns_records) : !contains([
+          var.infisical.hostname,
+          trimsuffix(var.infisical.hostname, ".${var.cloudflare_zone_name}")
+        ], record.name)
+      ])
+      error_message = "Infisical DNS must have one Terraform owner; remove duplicate generic records."
+    }
+  }
+}
+
+output "infisical_preparation" {
+  description = "Non-secret preparation metadata only; not deployment or readiness evidence."
+  value = var.infisical == null ? null : {
+    site_url         = "https://${var.infisical.hostname}"
+    ingress_host     = "edge"
+    application_host = "application"
+    installed        = false
+    bootstrap        = "separate-explicit-contract"
+  }
+}

package/templates/infra/terraform/terraform.tfvars.example

@@ -7,6 +7,11 @@ manage_vps           = false
 edge_vps_ipv4        = "replace-with-approved-edge-ip"
 application_vps_ipv4 = "replace-with-approved-private-vps-ip"
 
+# Optional vault DNS only; no containers, bootstrap or additional VPS by default.
+# Enabling requires a unique hostname in the approved zone and matching runner/plan inventory.
+infisical = null
+# infisical = { hostname = "secrets.example.com" }
+
 # Only Cloudflare records are managed here. Pages CNAME targets are supplied explicitly.
 cloudflare_dns_records = {
   app = {

package/templates/infra/terraform/variables.tf

@@ -26,7 +26,7 @@ variable "cloudflare_zone_name" {
 }
 
 variable "manage_vps" {
-  description = "Create Hostinger VPS resources. False adopts explicitly approved existing VPS IPs."
+  description = "Create Hostinger VPS resources. False uses approved external IPs for DNS; it does not import or adopt VPS into state."
   type        = bool
   default     = false
 }

package/templates/scripts/validate-cloud-hostinger-contract.mjs

@@ -41,7 +41,10 @@ const checks = [
     "architecture must define BullMQ queue safety",
   ],
   [
-    source.rule.includes("credenciais") && source.rule.includes("nunca autorizam alvo"),
+    source.rule.includes("credencial nomeada") &&
+      source.rule.includes("nunca autorizam alvo") &&
+      source.rule.includes("projeto, host, usuário, porta") &&
+      source.rule.includes("pin confiável"),
     "rule must bind credentials to targets",
   ],
   [