aly.codes
[READ-ONLY] Mirror of https://github.com/alyraffauf/infra. Hybrid cloud cluster monorepo with Ansible, K8s, NixOS, and Terraform.
cute.haus
ansible
k8s
nix
nix-flake
nixos
terraform
1terraform {
2 required_version = ">= 1.10"
3
4 required_providers {
5 b2 = {
6 source = "Backblaze/b2"
7 version = "~> 0.13"
8 }
9 cloudflare = {
10 source = "cloudflare/cloudflare"
11 version = "~> 5.0"
12 }
13 tailscale = {
14 source = "tailscale/tailscale"
15 version = "~> 0.29"
16 }
17 }
18
19 # State in B2 alongside CNPG + Longhorn backups. Auth via AWS_ACCESS_KEY_ID /
20 # AWS_SECRET_ACCESS_KEY (B2 application key in secrets/b2.yaml). Bucket has
21 # versioning enabled, so state history is recoverable from B2 if a bad apply
22 # corrupts it.
23 #
24 # No state locking: B2's S3 API at us-east-005 doesn't honor the
25 # If-None-Match conditional-PUT header that terraform's use_lockfile uses
26 # (501 NotImplemented). DynamoDB-based locking is overkill for single-user
27 # operation; the discipline is "don't run terraform from two places at once."
28 backend "s3" {
29 bucket = "aly-backups"
30 key = "cute.haus/terraform/terraform.tfstate"
31 region = "us-east-005"
32
33 endpoints = {
34 s3 = "https://s3.us-east-005.backblazeb2.com"
35 }
36
37 skip_credentials_validation = true
38 skip_metadata_api_check = true
39 skip_region_validation = true
40 skip_requesting_account_id = true
41 use_path_style = true
42 skip_s3_checksum = true
43 }
44}
45
46provider "cloudflare" {
47 # Reads CLOUDFLARE_API_TOKEN from the environment.
48}
49
50provider "b2" {
51 # Reads B2_APPLICATION_KEY_ID and B2_APPLICATION_KEY from the environment.
52}
53
54provider "tailscale" {
55 # Reads TAILSCALE_API_KEY from the environment (API key in
56 # secrets/tailscale-api.yaml, decrypted by direnv).
57}