43 lines
1.6 KiB
Terraform
43 lines
1.6 KiB
Terraform
terraform {
|
|
required_version = ">= 1.7.0" # state encryption (below) requires >= 1.7.0
|
|
|
|
required_providers {
|
|
hcloud = {
|
|
source = "hetznercloud/hcloud"
|
|
version = "~> 1.54" # hcloud_zone / hcloud_zone_rrset (DNS) require >= 1.54.0
|
|
}
|
|
}
|
|
|
|
# State lives in the same Hetzner Object Storage bucket used for service
|
|
# backups (see readme.md > Persistent data), under its own key so it never
|
|
# collides with backup objects. Deliberately empty (partial configuration):
|
|
# backend blocks can't reference variables, so bucket/key/endpoint are
|
|
# supplied at `tofu init` time via -backend-config=backend.hcl (gitignored,
|
|
# see backend.hcl.example) and credentials via the standard
|
|
# AWS_ACCESS_KEY_ID/AWS_SECRET_ACCESS_KEY environment variables - control.sh
|
|
# exports both from the BACKUP_S3_* variables before invoking tofu.
|
|
backend "s3" {}
|
|
|
|
# State is encrypted client-side, independent of anything the bucket does -
|
|
# Hetzner Object Storage only supports SSE-C (a per-request customer key),
|
|
# not the SSE-S3 header the s3 backend's own `encrypt` option sends, so that
|
|
# option silently no-ops against Hetzner. `enforced` refuses to ever read or
|
|
# write unencrypted state, so a missing passphrase fails loudly instead of
|
|
# falling back to plaintext.
|
|
encryption {
|
|
key_provider "pbkdf2" "state" {
|
|
passphrase = var.state_encryption_passphrase
|
|
}
|
|
method "aes_gcm" "state" {
|
|
keys = key_provider.pbkdf2.state
|
|
}
|
|
state {
|
|
method = method.aes_gcm.state
|
|
enforced = true
|
|
}
|
|
}
|
|
}
|
|
|
|
# Reads the token from the HCLOUD_TOKEN environment variable.
|
|
provider "hcloud" {}
|