# Copy to `.r2.env` (gitignored), fill in, then:  source .r2.env
# These are the ONLY secrets. They never enter git or tofu state.

# --- R2 S3 credentials (from Cloudflare R2 -> Manage API Tokens -> Object Read & Write) ---
export AWS_ACCESS_KEY_ID="<R2_ACCESS_KEY_ID>"
export AWS_SECRET_ACCESS_KEY="<R2_SECRET_ACCESS_KEY>"

# --- State-at-rest encryption (OpenTofu native, AES-GCM via PBKDF2 passphrase) ---
# CRITICAL: store this passphrase in your PASSWORD MANAGER. It is required to read the state on any
# machine and after any rebuild. It must be >= 16 characters (OpenTofu enforces a minimum).
export TF_ENCRYPTION='
key_provider "pbkdf2" "state" {
  passphrase = "<STRONG_PASSPHRASE_MIN_16_CHARS>"
}
method "aes_gcm" "state" {
  keys = key_provider.pbkdf2.state
}
state {
  method = method.aes_gcm.state
}
plan {
  method = method.aes_gcm.state
}
'