Cloudflare + Vercel Terraform Guide (Stable Architecture)

This document defines a production-safe setup for managing DNS with Terraform and Cloudflare while deploying a frontend on Vercel.

---

System Overview

Architecture flow:

Terraform
  ↓
Cloudflare DNS
  ↓
Vercel Hosting
  ↓
Next.js App

---

Goals

• Single source of truth (Terraform)
• No manual DNS changes in Cloudflare UI
• Stable routing to Vercel
• Zero state drift
• Predictable deployments

---

Cloudflare DNS Rules

Only use these record types:

Root domain (@)

resource "cloudflare_record" "root" {
  zone_id = var.zone_id
  name    = "@"
  type    = "CNAME"
  content = "cname.vercel-dns.com"
  proxied = true
}

WWW domain

resource "cloudflare_record" "www" {
  zone_id = var.zone_id
  name    = "www"
  type    = "CNAME"
  content = "cname.vercel-dns.com"
  proxied = true
}

Blog subdomain

resource "cloudflare_record" "blog_a_1" {
  zone_id = var.zone_id
  name    = "blog"
  type    = "A"
  content = "162.159.153.4"
  proxied = false
}

resource "cloudflare_record" "blog_a_2" {
  zone_id = var.zone_id
  name    = "blog"
  type    = "A"
  content = "162.159.152.4"
  proxied = false
}

---

Do NOT use

• A records for root or www
• Wildcard (*) records (unless explicitly needed)
• Manual UI edits in Cloudflare
• Mixed A + CNAME setups

---

🧠 Terraform State Rules

Use remote state (recommended)

• S3 backend OR Terraform Cloud
• Prevents local state loss or drift

Workflow

terraform plan
terraform apply

NEVER skip plan in production.

---

Provider configuration

terraform {
  required_providers {
    cloudflare = {
      source  = "cloudflare/cloudflare"
      version = "~> 4.0"
    }
  }
}

---

Vercel Configuration

Required setup:

• Set www as primary domain
• Ensure root redirects to www
• Enable automatic SSL

Expected behavior:

• https://jabercrombia.com → redirects to www