# Committed R2 backend config — NON-SECRET account-specific bits, passed to
# `tofu init -backend-config=` by tf.sh. The S3 keys and the state-encryption
# passphrase are NOT here — they come from secrets.sops.env via tf.sh.
#
# The endpoint contains the R2 account id (the 32-hex string). An account id is
# NOT a credential (it does nothing without the R2 API keys), so committing it is
# fine and keeps the "work from any machine" story to: clone repo + age key.
#
# The rest of the backend "s3" block (region, skip_* flags, encryption) lives in
# backend.tf; this file supplies only bucket/key/endpoints.

bucket = "homelab-tofu-state"
key    = "k3s-dev/terraform.tfstate"

endpoints = {
  s3 = "https://7ce452a1b3d6c86daf2c020edcb82d37.r2.cloudflarestorage.com"
}