# Remote state — Cloudflare R2 (S3-compatible), stored OFF the k3s cluster.
#
# WHY OFF-CLUSTER (the load-bearing decision): tofu state must live at or below the layer it
# manages. Its dependency chain is  Proxmox host -> k3s VMs -> k3s cluster -> Gitea/apps, so state
# in Gitea (top of the chain) would be UNREADABLE in exactly the disaster it exists for — cluster
# gone, `tofu apply` to rebuild. R2 sits entirely outside that chain: a full cluster rebuild can
# still read state. It also survives total-site loss (off-site) and gives multi-machine access.
#
# SECRETS: the account-specific bucket/endpoint come from a gitignored backend.hcl; the S3 keys
# come from the environment (.r2.env: AWS_ACCESS_KEY_ID / AWS_SECRET_ACCESS_KEY). State bytes are
# encrypted at rest via the TF_ENCRYPTION env blob (see REMOTE-STATE.md) — the passphrase lives ONLY
# in your password manager and the gitignored .r2.env, never in git or in the state itself.
#
# INIT (partial config — non-secret bits here, secret bits from the gitignored file):
#   cd infra/tofu && source .r2.env && tofu init -backend-config=backend.hcl -migrate-state
#
# NOTE: this `terraform {}` block is MERGED with the one in versions.tf (required_version +
# required_providers). OpenTofu allows multiple terraform blocks across files; `backend` appears once.
terraform {
  backend "s3" {
    region = "auto" # R2 ignores region, but the S3 backend requires a value.

    # R2 is S3-compatible but not AWS: disable the AWS-only preflight/validation paths.
    skip_credentials_validation = true
    skip_region_validation      = true
    skip_requesting_account_id  = true
    skip_metadata_api_check     = true
    skip_s3_checksum            = true # R2 rejects AWS trailing (streaming) checksums.

    # bucket, key, endpoints{ s3 } -> backend.hcl (gitignored; keeps the R2 account id out of git).
    #
    # use_lockfile = true  -> ENABLE after bumping OpenTofu to >= 1.10. Native S3 conditional-write
    # locking (no DynamoDB); works on R2 via If-None-Match. 1.9.0 has no lockfile support, so state
    # locking is OFF for now (single-operator workflow — see REMOTE-STATE.md follow-up).
  }
}