Home-Network/home-network-k3s-impl
2
0 Fork 0
Code Issues 3 Pull Requests 3 Actions Packages Projects Releases Wiki Activity

infra(tofu): scaffold off-cluster R2 remote state (encrypted)

Browse Source 
Local-only tfstate meant losing the workstation would strand a rebuild (apply
would try to recreate the 3 live nodes). Move state to Cloudflare R2, which sits
OUTSIDE the Proxmox->VM->cluster->Gitea chain, so a full cluster rebuild can still
read it; encrypted at rest via OpenTofu native AES-GCM.

Adds a partial s3 backend (R2 skip-flags), gitignored backend.hcl/.r2.env for the
account-specific + secret bits, their .example templates, and a migration+DR runbook.
Locking (use_lockfile) deferred to an OpenTofu >=1.10 bump (1.9.0 lacks it).
Migration (tofu init -migrate-state) runs once the operator provisions the R2 bucket.

Co-Authored-By: Claude Opus 4.8 <[email protected]>
This commit is contained in:
jakman85andClaude Opus 4.8 committed 2026-08-27 15:57:12 -05:00
1 parent 91c82d2756
commit 485b9e3888
5 files changed
+139
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

.gitignore
+5
View File
@@ -29,3 +29,8 @@ plan.log
/reports/
*.junit.xml
coverage/
# Tofu remote-state secrets (R2 creds + encryption passphrase + account-specific backend cfg).
# The *.example templates ARE committed; the real files are not.
infra/tofu/backend.hcl
infra/tofu/.r2.env