jakman85andClaude Opus 4.8
485b9e3888
Local-only tfstate meant losing the workstation would strand a rebuild (apply would try to recreate the 3 live nodes). Move state to Cloudflare R2, which sits OUTSIDE the Proxmox->VM->cluster->Gitea chain, so a full cluster rebuild can still read it; encrypted at rest via OpenTofu native AES-GCM. Adds a partial s3 backend (R2 skip-flags), gitignored backend.hcl/.r2.env for the account-specific + secret bits, their .example templates, and a migration+DR runbook. Locking (use_lockfile) deferred to an OpenTofu >=1.10 bump (1.9.0 lacks it). Migration (tofu init -migrate-state) runs once the operator provisions the R2 bucket. Co-Authored-By: Claude Opus 4.8 <[email protected]>
37 lines
643 B
Plaintext
37 lines
643 B
Plaintext
# OS / editor
|
|
.DS_Store
|
|
*.swp
|
|
*~
|
|
.idea/
|
|
.vscode/
|
|
|
|
# Secrets — SOPS-encrypted only; never commit plaintext (spec docs/07)
|
|
*.dec.yaml
|
|
*.decrypted.*
|
|
*.key
|
|
age.key
|
|
*.kubeconfig
|
|
kubeconfig
|
|
|
|
# IaC state / local runtime
|
|
.terraform/
|
|
*.tfstate
|
|
*.tfstate.*
|
|
.terraform.lock.hcl
|
|
*.tfvars
|
|
!*.example.tfvars
|
|
# tofu apply/plan run logs (tee'd locally; never commit)
|
|
apply.log
|
|
plan.log
|
|
|
|
# Test / build artifacts
|
|
/results/
|
|
/reports/
|
|
*.junit.xml
|
|
coverage/
|
|
|
|
# Tofu remote-state secrets (R2 creds + encryption passphrase + account-specific backend cfg).
|
|
# The *.example templates ARE committed; the real files are not.
|
|
infra/tofu/backend.hcl
|
|
infra/tofu/.r2.env
|