chore(terraform): OVH prod tfvars for the migration (services d2-4, web d2-2) #197

Merged

jfraeys merged 1 commit from jfraeys/chore/ovh-prod-tfvars-phase1 into main 2026-10-15 17:01:03 -04:00

Conversation 0 Commits 1 Files changed 1 +12 -3

jfraeys commented 2026-10-15 16:55:30 -04:00

Owner

Copy link

#187 phase 1 prep. terraform/environments/ovh/prod.tfvars: web keeps instance_type = d2-2 (smallest OVH flavor, 2 GB); ovh_node_flavors = { services = "d2-4" } (2 vCPU, 4 GB, 50 GB, from the real BHS5 flavor list). Also pins enable_desec_dns = false and ovh_backup_s3_username = "" for this workspace: the vault sets TF_VAR_enable_desec_dns=true and the OVH S3 IAM username, which would make the new ovh workspace's separate state try to create the deSEC zone and manage the S3 IAM policy that the linode workspace already owns (the 2026-09-23 incident in docs/incidents.md was this class of overlap). tofu fmt also realigned neighbouring lines.

No apply. Provisioning is a separate, explicit step:

1. tofu workspace new ovh (creates its own empty state), then ./setup --workspace ovh --confirm-prod --no-ansible --var-file terraform/environments/ovh/prod.tfvars; read the plan first: expect 2 instances (web d2-2, services d2-4), 0 DNS resources, 0 IAM.
2. Restore + deploy + validate per the runbook before any DNS change.

🤖 Generated with Claude Code

https://claude.ai/code/session_01Ge5tovcwdEUBtPwUktsZZZ

#187 phase 1 prep. `terraform/environments/ovh/prod.tfvars`: web keeps `instance_type = d2-2` (smallest OVH flavor, 2 GB); `ovh_node_flavors = { services = "d2-4" }` (2 vCPU, 4 GB, 50 GB, from the real BHS5 flavor list). Also pins `enable_desec_dns = false` and `ovh_backup_s3_username = ""` for this workspace: the vault sets TF_VAR_enable_desec_dns=true and the OVH S3 IAM username, which would make the new `ovh` workspace's separate state try to create the deSEC zone and manage the S3 IAM policy that the `linode` workspace already owns (the 2026-09-23 incident in docs/incidents.md was this class of overlap). `tofu fmt` also realigned neighbouring lines. **No apply.** Provisioning is a separate, explicit step: 1. `tofu workspace new ovh` (creates its own empty state), then `./setup --workspace ovh --confirm-prod --no-ansible --var-file terraform/environments/ovh/prod.tfvars`; read the plan first: expect 2 instances (web d2-2, services d2-4), 0 DNS resources, 0 IAM. 2. Restore + deploy + validate per the runbook before any DNS change. 🤖 Generated with [Claude Code](https://claude.com/claude-code) https://claude.ai/code/session_01Ge5tovcwdEUBtPwUktsZZZ

jfraeys added 1 commit 2026-10-15 16:55:31 -04:00

chore(terraform): OVH prod tfvars for the migration (services d2-4, web d2-2; no DNS/IAM from this workspace) ... ca6b9fca45

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Ge5tovcwdEUBtPwUktsZZZ

jfraeys merged commit c9cf3378c9 into main 2026-10-15 17:01:03 -04:00

jfraeys referenced this pull request from a commit 2026-10-15 17:01:04 -04:00

Merge pull request 'chore(terraform): OVH prod tfvars for the migration (services d2-4, web d2-2)' (#197) from jfraeys/chore/ovh-prod-tfvars-phase1 into main

Sign in to join this conversation.

Reviewers

No reviewers

Labels

Clear labels

No items

No labels

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

1 participant

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

jfraeys/infra!197

No description provided.