cibello(terraform): replace SES with Mailu DNS records

- Remove aws_ses_configuration_set, aws_ses_domain_identity, aws_ses_domain_dkim

- Remove SES verification and DKIM Route53 records

- Remove SES outputs

- Add MX, SPF, DKIM, DMARC records for cibello.app -> mail.aamos.systems

- DKIM key split into two 255-char strings per Route53 limit

No apply; plan saved as cibello.plan

infrastructure/terraform/dns_web.tf

@@ -5,35 +5,6 @@ resource "aws_route53_zone" "main" {
   }
 }
 
-resource "aws_ses_configuration_set" "main" {
-  name = "cibello-prod"
-}
-
-resource "aws_ses_domain_identity" "main" {
-  domain = "mail.cibello.app"
-}
-
-resource "aws_ses_domain_dkim" "main" {
-  domain = aws_ses_domain_identity.main.domain
-}
-
-resource "aws_route53_record" "ses_verification" {
-  zone_id = aws_route53_zone.main.zone_id
-  name    = "_amazonses.${aws_ses_domain_identity.main.domain}"
-  type    = "TXT"
-  ttl     = 300
-  records = [aws_ses_domain_identity.main.verification_token]
-}
-
-resource "aws_route53_record" "ses_dkim" {
-  count   = 3
-  zone_id = aws_route53_zone.main.zone_id
-  name    = "${aws_ses_domain_dkim.main.dkim_tokens[count.index]}._domainkey.${aws_ses_domain_identity.main.domain}"
-  type    = "CNAME"
-  ttl     = 300
-  records = ["${aws_ses_domain_dkim.main.dkim_tokens[count.index]}.dkim.amazonses.com"]
-}
-
 resource "aws_acm_certificate" "main" {
   provider                  = aws.us_east_1
   domain_name               = "cibello.app"
@@ -182,3 +153,38 @@ resource "aws_route53_record" "admin" {
   ttl     = 300
   records = [aws_eip.app.public_ip]
 }
+
+resource "aws_route53_record" "mx" {
+  zone_id = aws_route53_zone.main.zone_id
+  name    = "cibello.app"
+  type    = "MX"
+  ttl     = 300
+  records = ["10 mail.aamos.systems"]
+}
+
+resource "aws_route53_record" "spf" {
+  zone_id = aws_route53_zone.main.zone_id
+  name    = "cibello.app"
+  type    = "TXT"
+  ttl     = 300
+  records = ["v=spf1 mx a:mail.aamos.systems ~all"]
+}
+
+resource "aws_route53_record" "dkim" {
+  zone_id = aws_route53_zone.main.zone_id
+  name    = "mail._domainkey.cibello.app"
+  type    = "TXT"
+  ttl     = 300
+  records = [
+    "v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEApUGQRa54rZOOaUWHTnCVXZfXkcXGHxZaYhI2AklP5j5y3jrA/4kiNaxzlxOFthJ2ujomnTZdPs4/V/uQ/xlAQxf7T9X5Vg9Kf7NQtmFii//4q3K2OgGg070aHLeKuDF6YjRjEADBVQBtGVwf9btjvEfhtLsPiWgp2KuxKYGRSWNuXjAZiwf3ON1ehRWm",
+    "wlxSfe8yil93LYi0u+BOAzYhQsI6v8bpmCkR/+GCdbWNZQsbbDDSvUt6z2xBmlzKZQ6TpE6yCbMs6ddsSVLq4OXuL5rVk9+ETbZqsbmy/IB//18Ta/7Hi4QL4WqZbD97To2UlD1TtUwpLDHx/cR+bEgNCQIDAQAB"
+  ]
+}
+
+resource "aws_route53_record" "dmarc" {
+  zone_id = aws_route53_zone.main.zone_id
+  name    = "_dmarc.cibello.app"
+  type    = "TXT"
+  ttl     = 300
+  records = ["v=DMARC1; p=none; rua=mailto:dmarc@cibello.app"]
+}

infrastructure/terraform/outputs.tf

@@ -28,20 +28,3 @@ output "name_servers" {
   value       = aws_route53_zone.main.name_servers
 }
 
-output "ses_dkim_records" {
-  description = "SES DKIM CNAME records"
-  value = [
-    for i in range(3) : {
-      name  = aws_route53_record.ses_dkim[i].name
-      value = tolist(aws_route53_record.ses_dkim[i].records)[0]
-    }
-  ]
-}
-
-output "ses_verification_record" {
-  description = "SES domain verification TXT record"
-  value = {
-    name  = aws_route53_record.ses_verification.name
-    value = tolist(aws_route53_record.ses_verification.records)[0]
-  }
-}