jakman85andClaude Opus 4.8
216bea2a16
Replace the gitignored plaintext infra/tofu/.r2.env and backend.hcl with a single committed, SOPS/age-encrypted dotenv (secrets.sops.env) plus a thin wrapper (tf.sh), so tofu runs with no manual secret entry and secrets live encrypted in git like the repo's other secrets. - .sops.yaml: creation rule encrypting infra/tofu/secrets.sops.env (all values) to the existing age recipient. - secrets.sops.env: encrypted, PLACEHOLDER values only. Holds R2 S3 keys, the state-encryption passphrase (TF_STATE_PASSPHRASE scalar), and the Proxmox API token/endpoint. Operator fills real values via `sops`. - tf.sh: sops exec-env decrypts the dotenv, exports PROXMOX_VE_*/AWS_*, builds the multi-line TF_ENCRYPTION HCL from TF_STATE_PASSPHRASE, and runs tofu (injecting -backend-config=backend.r2.hcl on init). Proxmox token stays env-only, never a tofu variable/state. - backend.r2.hcl: committed non-secret R2 bucket/key/endpoint (account id is not a credential), passed to `tofu init`. - Retire .r2.env/backend.hcl(.example): drop the committed templates; keep the gitignore lines as a safety net for leftover local plaintext. - Update backend.tf/README/REMOTE-STATE for the new day-2 flow and DR story (repo + age key is sufficient). Verified: placeholder file round-trips sops -e/-d with the repo age key; tf.sh exports the expected VAR NAMES and builds valid TF_ENCRYPTION HCL (stub tofu, no real plan/secrets). Co-Authored-By: Claude Opus 4.8 <[email protected]>
44 lines
1.1 KiB
Plaintext
44 lines
1.1 KiB
Plaintext
# OS / editor
|
|
.DS_Store
|
|
*.swp
|
|
*~
|
|
.idea/
|
|
.vscode/
|
|
|
|
# Secrets — SOPS-encrypted only; never commit plaintext (spec docs/07)
|
|
*.dec.yaml
|
|
*.decrypted.*
|
|
*.key
|
|
age.key
|
|
*.kubeconfig
|
|
kubeconfig
|
|
|
|
# IaC state / local runtime
|
|
.terraform/
|
|
*.tfstate
|
|
*.tfstate.*
|
|
.terraform.lock.hcl
|
|
*.tfvars
|
|
!*.example.tfvars
|
|
# tofu apply/plan run logs (tee'd locally; never commit)
|
|
apply.log
|
|
plan.log
|
|
|
|
# Test / build artifacts
|
|
/results/
|
|
/reports/
|
|
*.junit.xml
|
|
coverage/
|
|
|
|
# RETIRED plaintext Tofu secret files. Superseded by the COMMITTED, SOPS/age-encrypted
|
|
# infra/tofu/secrets.sops.env + the wrapper infra/tofu/tf.sh (see REMOTE-STATE.md). These
|
|
# lines are KEPT as a safety net so any leftover plaintext copy on an operator's machine can
|
|
# NEVER be committed; delete the local files once you've migrated to the encrypted flow.
|
|
infra/tofu/backend.hcl
|
|
infra/tofu/.r2.env
|
|
|
|
# Claude Code local scratch: agent worktrees + session state. Nothing here is tracked;
|
|
# ignoring it keeps `git add -A` from staging embedded worktree repos and keeps the lint
|
|
# stage (which scans untracked files) from tripping on .claude/worktrees/.
|
|
.claude/
|