terraform {
  required_version = ">= 1.7.0" # state encryption (below) requires >= 1.7.0

  required_providers {
    hcloud = {
      source  = "hetznercloud/hcloud"
      version = "~> 1.54" # hcloud_zone / hcloud_zone_rrset (DNS) require >= 1.54.0
    }
  }

  # State lives in the same Hetzner Object Storage bucket used for service
  # backups (see readme.md > Persistent data), under its own key so it never
  # collides with backup objects. Deliberately empty (partial configuration):
  # backend blocks can't reference variables, so bucket/key/endpoint are
  # supplied at `tofu init` time via -backend-config=backend.hcl (gitignored,
  # see backend.hcl.example) and credentials via the standard
  # AWS_ACCESS_KEY_ID/AWS_SECRET_ACCESS_KEY environment variables - control.sh
  # exports both from the BACKUP_S3_* variables before invoking tofu.
  backend "s3" {}

  # State is encrypted client-side, independent of anything the bucket does -
  # Hetzner Object Storage only supports SSE-C (a per-request customer key),
  # not the SSE-S3 header the s3 backend's own `encrypt` option sends, so that
  # option silently no-ops against Hetzner. `enforced` refuses to ever read or
  # write unencrypted state, so a missing passphrase fails loudly instead of
  # falling back to plaintext.
  encryption {
    key_provider "pbkdf2" "state" {
      passphrase = var.state_encryption_passphrase
    }
    method "aes_gcm" "state" {
      keys = key_provider.pbkdf2.state
    }
    state {
      method   = method.aes_gcm.state
      enforced = true
    }
  }
}

# Reads the token from the HCLOUD_TOKEN environment variable.
provider "hcloud" {}