luke-else/server
1
0
Fork 0
Code Issues 5 Pull Requests Projects Releases Wiki Activity

Fix: Fixed remote state storage in S3 Bucket

Browse Source
This commit is contained in:
luke-else
2026-07-27 21:36:23 +01:00
parent a528867ef5
commit 7a61260a07
6 changed files with 65 additions and 127 deletions
Download Patch File Download Diff File Expand all files Collapse all files
control.sh
+29 -75
View File
@@ -96,8 +96,8 @@ check_prereqs() {
title "Environment variables"
[ -n "${HCLOUD_TOKEN:-}" ] && ok "HCLOUD_TOKEN set" || bad "HCLOUD_TOKEN not set (needed by both tofu and the ansible inventory)"
[ -n "${BACKUP_S3_BUCKET:-}" ] && ok "BACKUP_S3_BUCKET set" || warn "BACKUP_S3_BUCKET not set (needed for deploy/spinup - S3 backup .env)"
[ -n "${BACKUP_S3_ACCESS_KEY_ID:-}" ] && ok "BACKUP_S3_ACCESS_KEY_ID set" || warn "BACKUP_S3_ACCESS_KEY_ID not set"
[ -n "${BACKUP_S3_SECRET_ACCESS_KEY:-}" ] && ok "BACKUP_S3_SECRET_ACCESS_KEY set" || warn "BACKUP_S3_SECRET_ACCESS_KEY not set"
[ -n "${BACKUP_S3_ACCESS_KEY_ID:-}" ] && ok "BACKUP_S3_ACCESS_KEY_ID set" || bad "BACKUP_S3_ACCESS_KEY_ID not set (needed for backups and to read/write tofu state)"
[ -n "${BACKUP_S3_SECRET_ACCESS_KEY:-}" ] && ok "BACKUP_S3_SECRET_ACCESS_KEY set" || bad "BACKUP_S3_SECRET_ACCESS_KEY not set (needed for backups and to read/write tofu state)"
[ -n "${BACKUP_S3_ENDPOINT:-}" ] && ok "BACKUP_S3_ENDPOINT set" || warn "BACKUP_S3_ENDPOINT not set (omit only for real AWS S3)"
[ -n "${TF_VAR_state_encryption_passphrase:-}" ] && ok "TF_VAR_state_encryption_passphrase set" \
|| bad "TF_VAR_state_encryption_passphrase not set (needed to read/write tofu state - see Configuration > Set variables)"
@@ -111,8 +111,6 @@ check_prereqs() {
title "Files"
[ -f "$INFRA_DIR/terraform.tfvars" ] && ok "infra/terraform.tfvars exists" \
|| bad "infra/terraform.tfvars missing (Configuration > Copy terraform.tfvars.example)"
[ -f "$INFRA_DIR/backend.hcl" ] && ok "infra/backend.hcl exists" \
|| bad "infra/backend.hcl missing (Configuration > Copy backend.hcl.example)"
[ -d "$INFRA_DIR/.terraform" ] && ok "infra/.terraform exists (tofu init has run)" \
|| warn "infra/.terraform missing - run OpenTofu > init"
if ansible-galaxy collection list hetzner.hcloud >/dev/null 2>&1; then ok "hetzner.hcloud collection installed"
@@ -176,42 +174,6 @@ copy_tfvars() {
fi
}
# backend.hcl holds the S3 backend's bucket/key/endpoint (see
# infra/backend.hcl.example) - it's the *same* bucket as BACKUP_S3_BUCKET,
# just a different object key, so state never collides with backup archives.
# Credentials aren't stored in it - see export_s3_backend_creds.
copy_backend_hcl() {
local example="$INFRA_DIR/backend.hcl.example"
local target="$INFRA_DIR/backend.hcl"
if [ -f "$target" ]; then
warn "infra/backend.hcl already exists."
confirm "Overwrite it with a fresh copy of the example?" || return 0
fi
cp "$example" "$target"
ok "Copied backend.hcl.example -> backend.hcl"
if [ -n "${BACKUP_S3_BUCKET:-}" ]; then
sed -i "s|^bucket = .*|bucket = \"${BACKUP_S3_BUCKET}\"|" "$target"
ok "Set bucket = \"${BACKUP_S3_BUCKET}\" (from BACKUP_S3_BUCKET)"
else
warn "BACKUP_S3_BUCKET not set - bucket still has the example's placeholder value."
fi
if [ -n "${BACKUP_S3_ENDPOINT:-}" ]; then
sed -i "s|^ s3 = .*| s3 = \"${BACKUP_S3_ENDPOINT}\"|" "$target"
ok "Set endpoints.s3 = \"${BACKUP_S3_ENDPOINT}\" (from BACKUP_S3_ENDPOINT)"
else
warn "BACKUP_S3_ENDPOINT not set - endpoints.s3 still has the example's placeholder value."
fi
local key
read -rp "Object key/path for the state file within the bucket [tofu/terraform.tfstate]: " key
key="${key:-tofu/terraform.tfstate}"
sed -i "s|^key = .*|key = \"${key}\"|" "$target"
ok "Set key = \"${key}\""
warn "Check infra/backend.hcl's region still matches your bucket's actual location before running tofu init."
}
# --- OpenTofu actions -----------------------------------------------------
# The s3 backend authenticates like the AWS CLI: standard AWS_ACCESS_KEY_ID /
# AWS_SECRET_ACCESS_KEY env vars, not backend-block attributes. Re-use the
@@ -226,15 +188,12 @@ require_tofu() {
if [ ! -f "$INFRA_DIR/terraform.tfvars" ]; then
bad "infra/terraform.tfvars is missing - copy terraform.tfvars.example first."; return 1
fi
if [ ! -f "$INFRA_DIR/backend.hcl" ]; then
bad "infra/backend.hcl is missing - copy backend.hcl.example first."; return 1
fi
if [ -z "${TF_VAR_state_encryption_passphrase:-}" ]; then
bad "TF_VAR_state_encryption_passphrase is not set - Configuration > Set variables."; return 1
fi
export_s3_backend_creds
}
tofu_init() { require_tofu && run_in "$INFRA_DIR" "$TOFU" init -backend-config="$INFRA_DIR/backend.hcl"; }
tofu_init() { require_tofu && run_in "$INFRA_DIR" "$TOFU" init; }
tofu_plan() { require_tofu && run_in "$INFRA_DIR" "$TOFU" plan; }
tofu_apply() { require_tofu && run_in "$INFRA_DIR" "$TOFU" apply; }
tofu_output() { require_tofu && run_in "$INFRA_DIR" "$TOFU" output; }
@@ -276,7 +235,7 @@ accept SSH from the vpn server's public IP, so vpn must exist and you must be
connected to it (WireGuard, via wg-easy) before dev/prod are reachable.
Steps, in order:
0. Configuration: variables + terraform.tfvars + backend.hcl (skip if already done)
0. Configuration: variables + terraform.tfvars (skip if already done)
1. OpenTofu: init -> plan -> apply (creates servers, network, firewalls, DNS)
2. Ansible: bootstrap + deploy + spinup for role_vpn
3. YOU: visit https://vpn.luke-else.co.uk, complete wg-easy's setup,
@@ -292,9 +251,6 @@ EOF
if [ ! -f "$INFRA_DIR/terraform.tfvars" ] && confirm "infra/terraform.tfvars is missing - create it from the example now?"; then
copy_tfvars
fi
if [ ! -f "$INFRA_DIR/backend.hcl" ] && confirm "infra/backend.hcl is missing - create it from the example now?"; then
copy_backend_hcl
fi
echo; title "1/4 OpenTofu"
if confirm "Run $TOFU init/plan/apply now?"; then
@@ -333,18 +289,17 @@ menu() {
title "Configuration"
echo " 3) Set variables (HCLOUD_TOKEN, DEPLOY_USER, BACKUP_S3_*, state passphrase, SSH key path)"
echo " 4) Copy terraform.tfvars.example -> terraform.tfvars"
echo " 5) Copy backend.hcl.example -> backend.hcl"
title "OpenTofu (infra/)"
echo " 6) init 7) plan 8) apply"
echo " 9) output 10) refresh 11) destroy"
echo " 5) init 6) plan 7) apply"
echo " 8) output 9) refresh 10) destroy"
title "Ansible (ansible/)"
echo " 12) Install collections 13) Show inventory"
echo " 14) Bootstrap vpn 15) Deploy vpn 16) Spinup vpn"
echo " 17) Bootstrap dev 18) Deploy dev 19) Spinup dev"
echo " 20) Bootstrap prod 21) Deploy prod 22) Spinup prod"
echo " 23) Spindown (choose target)"
echo " 11) Install collections 12) Show inventory"
echo " 13) Bootstrap vpn 14) Deploy vpn 15) Spinup vpn"
echo " 16) Bootstrap dev 17) Deploy dev 18) Spinup dev"
echo " 19) Bootstrap prod 20) Deploy prod 21) Spinup prod"
echo " 22) Spindown (choose target)"
echo
echo " 0) Quit"
@@ -359,25 +314,24 @@ while true; do
2) guided; pause ;;
3) set_variables; pause ;;
4) copy_tfvars; pause ;;
5) copy_backend_hcl; pause ;;
6) tofu_init; pause ;;
7) tofu_plan; pause ;;
8) tofu_apply; pause ;;
9) tofu_output; pause ;;
10) tofu_refresh; pause ;;
11) tofu_destroy; pause ;;
12) ansible_collections; pause ;;
13) ansible_inventory; pause ;;
14) ansible_bootstrap_vpn; pause ;;
15) ansible_deploy_vpn; pause ;;
16) ansible_spinup_vpn; pause ;;
17) ansible_bootstrap_dev; pause ;;
18) ansible_deploy_dev; pause ;;
19) ansible_spinup_dev; pause ;;
20) ansible_bootstrap_prod; pause ;;
21) ansible_deploy_prod; pause ;;
22) ansible_spinup_prod; pause ;;
23) ansible_spindown; pause ;;
5) tofu_init; pause ;;
6) tofu_plan; pause ;;
7) tofu_apply; pause ;;
8) tofu_output; pause ;;
9) tofu_refresh; pause ;;
10) tofu_destroy; pause ;;
11) ansible_collections; pause ;;
12) ansible_inventory; pause ;;
13) ansible_bootstrap_vpn; pause ;;
14) ansible_deploy_vpn; pause ;;
15) ansible_spinup_vpn; pause ;;
16) ansible_bootstrap_dev; pause ;;
17) ansible_deploy_dev; pause ;;
18) ansible_spinup_dev; pause ;;
19) ansible_bootstrap_prod; pause ;;
20) ansible_deploy_prod; pause ;;
21) ansible_spinup_prod; pause ;;
22) ansible_spindown; pause ;;
0) echo "Bye."; exit 0 ;;
"") ;;
*) warn "Unknown option: $choice"; pause ;;