MCP DNS Management

Infrastructure as Code for managing MCP Cloudflare DNS records using Pulumi.

DNS records are defined in src/config/records.ts, keyed by domain name.

Deployment

Production Deployment (Automated)

Note: Production deployment is automatically handled by GitHub Actions. All merges to the main branch trigger an automatic deployment via the configured GitHub Actions workflow.

Manual Deployment

Pre-requisites:

• Pulumi CLI installed
• Google Cloud SDK installed
• Access to GCP project and GCS bucket
• Required credentials and secrets

1. Authenticate with GCP: gcloud auth application-default login
2. Get the passphrase file passphrase.prod.txt from the maintainers
3. Preview changes: make preview
4. Deploy changes: make up

Initial Setup

If setting up this infrastructure for the first time:

1. Create GCS Bucket for Pulumi State

gcloud projects create mcp-dns-prod
gcloud config set project mcp-dns-prod
gcloud services enable storage.googleapis.com

# Create service account for CI/CD
gcloud iam service-accounts create pulumi-svc \
  --display-name="Pulumi Service Account"

gcloud projects add-iam-policy-binding mcp-dns-prod \
  --member="serviceAccount:pulumi-svc@mcp-dns-prod.iam.gserviceaccount.com" \
  --role="roles/storage.admin"

gcloud iam service-accounts keys create sa-key.json \
  --iam-account=pulumi-svc@mcp-dns-prod.iam.gserviceaccount.com

# Create bucket
gsutil mb gs://mcp-dns-prod-pulumi-state

2. Create Cloudflare API Token

1. Go to Cloudflare API Tokens
2. Create a token with Zone:DNS:Edit permission for the zones you want to manage
3. Note the token value

3. Initialize Pulumi Stack

# Login to Pulumi backend
pulumi login gs://mcp-dns-prod-pulumi-state

# Create production stack
export PULUMI_CONFIG_PASSPHRASE_FILE=passphrase.prod.txt
pulumi stack init prod

# Configure application secrets in Pulumi
pulumi config set --secret cloudflare:apiToken "your-api-token"
pulumi config set cloudflare:accountId "your-account-id"

You can find your Cloudflare Account ID in the Cloudflare dashboard URL or in the right sidebar of any zone's overview page.

4. Configure GitHub Actions Secrets

Add the CI/CD secrets to GitHub Actions (repository settings → Secrets and variables → Actions):

• GCP_PROD_SERVICE_ACCOUNT_KEY: Content of sa-key.json
• PULUMI_PROD_PASSPHRASE: The passphrase you set above