jfraeys/infra
Watch
1
0
Fork
You've already forked infra
 0
Code Issues 21 Pull requests 4 Projects Releases Packages Wiki Activity Actions

feat(ci): bucket-scoped Linode key for the Terraform state backend #34

Merged
jfraeys merged 1 commit from jfraeys/chore/ci-state-backend-key into main 2026-10-09 20:55:51 -04:00
Conversation 0 Commits 1 Files changed 4 +206 -48
jfraeys commented 2026-10-09 20:54:37 -04:00
Owner
Copy link

Creates the CI-only Terraform state key and wires it up (follow-up to #33).

  • Linode limited-access key infra-ci-tf-state (id 6758153), read_write on blizzard.jfraeys.com only.
  • Stored in secrets/vault.sops.yml (CI_STATE_BACKEND_*) before the Forgejo repo secrets OBJECT_STORAGE_ACCESS_KEY_ID/_SECRET_ACCESS_KEY were set, so the one-time secret is recoverable. Vault diff verified: 36 -> 38 keys, nothing changed or removed, 2 recipients.
  • scripts/provision-ci-state-key.py (nothing secret printed; revokes the key if the vault write fails), manifest entries, inventory note.

Caveat: state and restic share the one bucket, so this key is bucket-scoped, not state-scoped (see docs/secrets-inventory.md).

Together with #33 this should let terraform-plan/apply, staging-validate and drift-check run tofu init.

🤖 Generated with Claude Code

Creates the CI-only Terraform state key and wires it up (follow-up to #33). - Linode limited-access key infra-ci-tf-state (id 6758153), read_write on blizzard.jfraeys.com only. - Stored in secrets/vault.sops.yml (CI_STATE_BACKEND_*) before the Forgejo repo secrets OBJECT_STORAGE_ACCESS_KEY_ID/_SECRET_ACCESS_KEY were set, so the one-time secret is recoverable. Vault diff verified: 36 -> 38 keys, nothing changed or removed, 2 recipients. - scripts/provision-ci-state-key.py (nothing secret printed; revokes the key if the vault write fails), manifest entries, inventory note. Caveat: state and restic share the one bucket, so this key is bucket-scoped, not state-scoped (see docs/secrets-inventory.md). Together with #33 this should let terraform-plan/apply, staging-validate and drift-check run tofu init. 🤖 Generated with [Claude Code](https://claude.com/claude-code)
feat(ci): bucket-scoped Linode key for the Terraform state backend
All checks were successful
Lint / lint (pull_request) Successful in 1m40s
Details
a66ab5296d
 
Add scripts/provision-ci-state-key.py (creates the limited key, stores it in
the SOPS vault first, then sets the Forgejo OBJECT_STORAGE_* repo secrets;
nothing secret is printed), the two vault keys it wrote, their manifest
entries, and the finding that state and restic share one bucket.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
jfraeys/infra!34
No description provided.