jakman85andClaude Opus 4.8
216bea2a16
Replace the gitignored plaintext infra/tofu/.r2.env and backend.hcl with a single committed, SOPS/age-encrypted dotenv (secrets.sops.env) plus a thin wrapper (tf.sh), so tofu runs with no manual secret entry and secrets live encrypted in git like the repo's other secrets. - .sops.yaml: creation rule encrypting infra/tofu/secrets.sops.env (all values) to the existing age recipient. - secrets.sops.env: encrypted, PLACEHOLDER values only. Holds R2 S3 keys, the state-encryption passphrase (TF_STATE_PASSPHRASE scalar), and the Proxmox API token/endpoint. Operator fills real values via `sops`. - tf.sh: sops exec-env decrypts the dotenv, exports PROXMOX_VE_*/AWS_*, builds the multi-line TF_ENCRYPTION HCL from TF_STATE_PASSPHRASE, and runs tofu (injecting -backend-config=backend.r2.hcl on init). Proxmox token stays env-only, never a tofu variable/state. - backend.r2.hcl: committed non-secret R2 bucket/key/endpoint (account id is not a credential), passed to `tofu init`. - Retire .r2.env/backend.hcl(.example): drop the committed templates; keep the gitignore lines as a safety net for leftover local plaintext. - Update backend.tf/README/REMOTE-STATE for the new day-2 flow and DR story (repo + age key is sufficient). Verified: placeholder file round-trips sops -e/-d with the repo age key; tf.sh exports the expected VAR NAMES and builds valid TF_ENCRYPTION HCL (stub tofu, no real plan/secrets). Co-Authored-By: Claude Opus 4.8 <[email protected]>
18 lines
773 B
HCL
18 lines
773 B
HCL
# Committed R2 backend config — NON-SECRET account-specific bits, passed to
|
|
# `tofu init -backend-config=` by tf.sh. The S3 keys and the state-encryption
|
|
# passphrase are NOT here — they come from secrets.sops.env via tf.sh.
|
|
#
|
|
# The endpoint contains the R2 account id (the 32-hex string). An account id is
|
|
# NOT a credential (it does nothing without the R2 API keys), so committing it is
|
|
# fine and keeps the "work from any machine" story to: clone repo + age key.
|
|
#
|
|
# The rest of the backend "s3" block (region, skip_* flags, encryption) lives in
|
|
# backend.tf; this file supplies only bucket/key/endpoints.
|
|
|
|
bucket = "homelab-tofu-state"
|
|
key = "k3s-dev/terraform.tfstate"
|
|
|
|
endpoints = {
|
|
s3 = "https://7ce452a1b3d6c86daf2c020edcb82d37.r2.cloudflarestorage.com"
|
|
}
|