Fix: Fixed remote state storage in S3 Bucket

infra/versions.tf

@@ -10,13 +10,35 @@ terraform {
 
   # State lives in the same Hetzner Object Storage bucket used for service
   # backups (see readme.md > Persistent data), under its own key so it never
-  # collides with backup objects. Deliberately empty (partial configuration):
-  # backend blocks can't reference variables, so bucket/key/endpoint are
-  # supplied at `tofu init` time via -backend-config=backend.hcl (gitignored,
-  # see backend.hcl.example) and credentials via the standard
-  # AWS_ACCESS_KEY_ID/AWS_SECRET_ACCESS_KEY environment variables - control.sh
-  # exports both from the BACKUP_S3_* variables before invoking tofu.
-  backend "s3" {}
+  # collides with backup objects. Backend blocks can't reference variables, so
+  # this is all non-secret - credentials come from the standard
+  # AWS_ACCESS_KEY_ID/AWS_SECRET_ACCESS_KEY environment variables, which
+  # control.sh exports from BACKUP_S3_ACCESS_KEY_ID/BACKUP_S3_SECRET_ACCESS_KEY
+  # before invoking tofu (same bucket, same credentials).
+  backend "s3" {
+    bucket = "luke-else"
+    key    = "tofu/terraform.tfstate"
+
+    # Hetzner Object Storage doesn't have "AWS regions" - this just has to be
+    # a syntactically valid region string, it isn't used to route the request
+    # (the endpoint below does that). Match it to the bucket's actual location.
+    region = "eu-central"
+
+    endpoints = {
+      s3 = "https://nbg1.your-objectstorage.com"
+    }
+
+    # Hetzner Object Storage isn't AWS: skip the AWS-specific validation/lookup
+    # calls the backend would otherwise make, and address the bucket
+    # path-style (https://endpoint/bucket) rather than AWS's virtual-hosted
+    # style.
+    use_path_style              = true
+    skip_credentials_validation = true
+    skip_region_validation      = true
+    skip_requesting_account_id  = true
+    skip_s3_checksum            = true
+    skip_metadata_api_check     = true
+  }
 
   # State is encrypted client-side, independent of anything the bucket does -
   # Hetzner Object Storage only supports SSE-C (a per-request customer key),