feat: Added remote state storage in S3 bucket

infra/versions.tf

@@ -1,5 +1,5 @@
 terraform {
-  required_version = ">= 1.6.0"
+  required_version = ">= 1.7.0" # state encryption (below) requires >= 1.7.0
 
   required_providers {
     hcloud = {
@@ -7,6 +7,35 @@ terraform {
       version = "~> 1.54" # hcloud_zone / hcloud_zone_rrset (DNS) require >= 1.54.0
     }
   }
+
+  # State lives in the same Hetzner Object Storage bucket used for service
+  # backups (see readme.md > Persistent data), under its own key so it never
+  # collides with backup objects. Deliberately empty (partial configuration):
+  # backend blocks can't reference variables, so bucket/key/endpoint are
+  # supplied at `tofu init` time via -backend-config=backend.hcl (gitignored,
+  # see backend.hcl.example) and credentials via the standard
+  # AWS_ACCESS_KEY_ID/AWS_SECRET_ACCESS_KEY environment variables - control.sh
+  # exports both from the BACKUP_S3_* variables before invoking tofu.
+  backend "s3" {}
+
+  # State is encrypted client-side, independent of anything the bucket does -
+  # Hetzner Object Storage only supports SSE-C (a per-request customer key),
+  # not the SSE-S3 header the s3 backend's own `encrypt` option sends, so that
+  # option silently no-ops against Hetzner. `enforced` refuses to ever read or
+  # write unencrypted state, so a missing passphrase fails loudly instead of
+  # falling back to plaintext.
+  encryption {
+    key_provider "pbkdf2" "state" {
+      passphrase = var.state_encryption_passphrase
+    }
+    method "aes_gcm" "state" {
+      keys = key_provider.pbkdf2.state
+    }
+    state {
+      method   = method.aes_gcm.state
+      enforced = true
+    }
+  }
 }
 
 # Reads the token from the HCLOUD_TOKEN environment variable.