Add technitium_enabled toggle and turn DNS management off

module.technitium was gated only on the API token being present in
Infisical, so the single way to stop Terraform reconciling DNS was to pull
the token -- which also disables anything else that needs it. This adds an
explicit switch that ANDs with the existing token check, so the token can
stay put.

Set to false for now: DNS is being moved by hand during the domain
migration, and an apply in the middle of that would fight it.

Co-Authored-By: Claude Opus 5 <[email protected]>

main.tf

@@ -15,7 +15,7 @@ locals {
     )
   ])
 
-  technitium_enabled = try(data.external.infisical.result["technitium_api_token"], "") != ""
+  technitium_enabled = var.technitium_enabled && try(data.external.infisical.result["technitium_api_token"], "") != ""
   ipam_enabled       = try(data.external.infisical.result["ipam_username"], "") != ""
   caddy_enabled      = var.caddy_host != ""
 

terraform.tfvars

@@ -29,6 +29,10 @@ technitium_host = "http://192.168.7.2:5380"
 # Every declared node automatically gets an A record in the search_domain zone
 # (lan.oswaldtheotter.net). Define extra zones and manual records below.
 
+# Set to false to stop Terraform from managing Technitium DNS zones/records
+# (the LXC itself is unaffected; only module.technitium is skipped).
+technitium_enabled = false
+
 # Additional zones beyond the auto-managed search_domain zone.
 dns_zones = {
   # "internal.oswaldtheotter.net" = { type = "Primary" }

vars.tf

@@ -40,6 +40,12 @@ variable "technitium_host" {
   default     = ""
 }
 
+variable "technitium_enabled" {
+  description = "Set to false to stop Terraform from managing Technitium DNS zones/records, without changing anything else. Still requires technitium_api_token in Infisical to actually turn on."
+  type        = bool
+  default     = true
+}
+
 variable "dns_zones" {
   description = "Additional Technitium DNS zones to create, beyond the auto-managed search_domain zone. Keyed by zone name."
   type = map(object({