# Copy to backend.hcl and fill in - backend.hcl itself is gitignored, never
# commit real values there. Used as `tofu init -backend-config=backend.hcl`
# (control.sh's OpenTofu > init does this for you).
#
# This is the *same* S3-compatible bucket already used for service backups
# (BACKUP_S3_BUCKET/BACKUP_S3_ENDPOINT in control.sh > Set variables) - just a
# different object key so state never collides with backup archives.
# Credentials are NOT set here: the s3 backend picks up the standard
# AWS_ACCESS_KEY_ID/AWS_SECRET_ACCESS_KEY environment variables, which
# control.sh exports from BACKUP_S3_ACCESS_KEY_ID/BACKUP_S3_SECRET_ACCESS_KEY
# for you.

bucket = "your-hetzner-bucket-name" # same bucket as BACKUP_S3_BUCKET
key    = "tofu/terraform.tfstate"   # path *within* the bucket - keep this distinct from the backup/ prefix

# Hetzner Object Storage doesn't have "AWS regions" - this just has to be a
# syntactically valid region string, it isn't used to route the request (the
# endpoint below does that). Match it to your bucket's actual location.
region = "eu-central"

endpoints = {
  # e.g. https://nbg1.your-objectstorage.com - same value as BACKUP_S3_ENDPOINT
  s3 = "https://your-location.your-objectstorage.com"
}

# Hetzner Object Storage isn't AWS: skip the AWS-specific validation/lookup
# calls the backend would otherwise make, and address the bucket path-style
# (https://endpoint/bucket) rather than AWS's virtual-hosted style.
use_path_style               = true
skip_credentials_validation  = true
skip_region_validation       = true
skip_requesting_account_id   = true
skip_s3_checksum             = true
skip_metadata_api_check      = true