jakman85andClaude Opus 4.8
df947b33d0
backend.tf began with a stray YAML `---` doc separator (invalid HCL) that broke `tofu` parsing. Remove it. Also document the one-time `unencrypted` fallback method needed to adopt encryption on pre-existing plaintext state (add for the migrate, remove after), so the record is complete. State migration to R2 verified: 4/4 resources read back through the encrypt-only method (proves ciphertext at rest). Co-Authored-By: Claude Opus 4.8 <[email protected]>
37 lines
2.1 KiB
Terraform
37 lines
2.1 KiB
Terraform
# Remote state — Cloudflare R2 (S3-compatible), stored OFF the k3s cluster.
|
|
#
|
|
# WHY OFF-CLUSTER (the load-bearing decision): tofu state must live at or below the layer it
|
|
# manages. Its dependency chain is Proxmox host -> k3s VMs -> k3s cluster -> Gitea/apps, so state
|
|
# in Gitea (top of the chain) would be UNREADABLE in exactly the disaster it exists for — cluster
|
|
# gone, `tofu apply` to rebuild. R2 sits entirely outside that chain: a full cluster rebuild can
|
|
# still read state. It also survives total-site loss (off-site) and gives multi-machine access.
|
|
#
|
|
# SECRETS: the account-specific bucket/endpoint come from a gitignored backend.hcl; the S3 keys
|
|
# come from the environment (.r2.env: AWS_ACCESS_KEY_ID / AWS_SECRET_ACCESS_KEY). State bytes are
|
|
# encrypted at rest via the TF_ENCRYPTION env blob (see REMOTE-STATE.md) — the passphrase lives ONLY
|
|
# in your password manager and the gitignored .r2.env, never in git or in the state itself.
|
|
#
|
|
# INIT (partial config — non-secret bits here, secret bits from the gitignored file):
|
|
# cd infra/tofu && source .r2.env && tofu init -backend-config=backend.hcl -migrate-state
|
|
#
|
|
# NOTE: this `terraform {}` block is MERGED with the one in versions.tf (required_version +
|
|
# required_providers). OpenTofu allows multiple terraform blocks across files; `backend` appears once.
|
|
terraform {
|
|
backend "s3" {
|
|
region = "auto" # R2 ignores region, but the S3 backend requires a value.
|
|
|
|
# R2 is S3-compatible but not AWS: disable the AWS-only preflight/validation paths.
|
|
skip_credentials_validation = true
|
|
skip_region_validation = true
|
|
skip_requesting_account_id = true
|
|
skip_metadata_api_check = true
|
|
skip_s3_checksum = true # R2 rejects AWS trailing (streaming) checksums.
|
|
|
|
# bucket, key, endpoints{ s3 } -> backend.hcl (gitignored; keeps the R2 account id out of git).
|
|
#
|
|
# use_lockfile = true -> ENABLE after bumping OpenTofu to >= 1.10. Native S3 conditional-write
|
|
# locking (no DynamoDB); works on R2 via If-None-Match. 1.9.0 has no lockfile support, so state
|
|
# locking is OFF for now (single-operator workflow — see REMOTE-STATE.md follow-up).
|
|
}
|
|
}
|