docs(terraform): point comments and outputs at the vault, not .env #46

Merged

jfraeys merged 3 commits from jfraeys/chore/terraform-env-references into main 2026-10-10 12:16:58 -04:00

Conversation 0 Commits 3 Files changed 8 +19 -13

jfraeys commented 2026-10-10 11:17:15 -04:00

Owner

Copy link

.env is retired, but terraform/ comments, a variable description and the desec_nameservers_reminder output still said to look in it. Updated to the vault. No resource changes (one output string changes).

Also the vehicle for the remaining P5 check: a PR touching terraform/ triggers terraform-plan, which should now get past tofu init with the OBJECT_STORAGE_* backend secrets and the CI_FORGEJO_ADMIN_TOKEN rename. I will read that run before un-pausing drift-check.

🤖 Generated with Claude Code

.env is retired, but terraform/ comments, a variable description and the `desec_nameservers_reminder` output still said to look in it. Updated to the vault. No resource changes (one output string changes). Also the vehicle for the remaining P5 check: a PR touching terraform/ triggers `terraform-plan`, which should now get past `tofu init` with the OBJECT_STORAGE_* backend secrets and the CI_FORGEJO_ADMIN_TOKEN rename. I will read that run before un-pausing drift-check. 🤖 Generated with [Claude Code](https://claude.com/claude-code)

jfraeys added 1 commit 2026-10-10 11:17:16 -04:00

docs(terraform): point comments and the deSEC output at the vault, not .env ... dd814b78ab

.env is retired (all keys live in the SOPS vault). Updates the stale references
in comments, a variable description and the desec_nameservers_reminder output.
Touching terraform/ also exercises terraform-plan's tofu init with the new
backend secrets.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

jfraeys added 1 commit 2026-10-10 11:22:23 -04:00

fix(ci): give terraform-plan its required variables and a diagnosable comment step ... b9391c6eac

Run 268 got past tofu init (backend configured) but then failed on two required
variables with no default (root_pass, user_password) that drift-check already
supplies as placeholders; both only feed ignore_changes attributes and this job
never applies. The PR-comment step now tolerates a missing plan file and prints
the HTTP status (never the token) instead of failing with a bare curl exit 22.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

jfraeys added 1 commit 2026-10-10 12:16:47 -04:00

fix(ci): do not give terraform-plan placeholder passwords yet ... 20ae1bb8c9

With placeholders the plan of the production workspace runs on with Terraform's
defaults instead of prod's real inputs and prints a false "7 to destroy" (live
Cloudflare records and rulesets) into PR comments. Until CI has prod's inputs,
the job should stop at the missing required variables with a clear error. The
comment-step diagnostics (HTTP status, missing plan file) stay.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

jfraeys merged commit e00ba137ae into main 2026-10-10 12:16:58 -04:00

jfraeys referenced this pull request from a commit 2026-10-10 12:17:01 -04:00

Merge pull request 'docs(terraform): point comments and outputs at the vault, not .env' (#46) from jfraeys/chore/terraform-env-references into main

Sign in to join this conversation.

Reviewers

No reviewers

Labels

Clear labels

No items

No labels

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

1 participant

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

jfraeys/infra!46

No description provided.