RWejlgaard/pez-infra
1
0
Fork 0
mirror of https://github.com/RWejlgaard/pez-infra.git synced 2026-07-04 15:46:16 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions
pez-infra/terraform
History
Rasmus Wejlgaard 063c733be0 ci: drop use_lockfile — Backblaze B2 can't do native state locking 
B2's S3 API returns 501 NotImplemented for the conditional PutObject that
use_lockfile relies on, so tofu plan/apply fails to acquire the lock.
Revert the lockfile and the 1.10 version bump it required; rely on the
concurrency guard to serialize applies instead. Left a note in the
backend block so this isn't re-attempted.
2026-06-02 19:37:21 +01:00
..
grafana fix: tracing on caddy services (#104) 2026-05-10 10:18:53 +01:00
hetzner fix: slight tweaks (#103) 2026-05-09 20:49:46 +01:00
pagerduty fix: slight tweaks (#103) 2026-05-09 20:49:46 +01:00
.gitignore initial commit 2026-03-28 12:39:41 +00:00
main.tf adding pagerduty stack (#95) 2026-05-04 20:50:31 +01:00
Makefile initial commit 2026-03-28 12:39:41 +00:00
providers.tf ci: drop use_lockfile — Backblaze B2 can't do native state locking 2026-06-02 19:37:21 +01:00
README.md fix: slight tweaks (#103) 2026-05-09 20:49:46 +01:00
secrets.enc.yaml adding pagerduty stack (#95) 2026-05-04 20:50:31 +01:00
vars.tf initial commit 2026-03-28 12:39:41 +00:00

README.md

Terraform

Infrastructure-as-code for cloud and edge services. Uses OpenTofu (drop-in Terraform replacement).

What's managed

  • Hetzner Cloud — Two servers (nuremberg-a, helsinki-a), firewalls, and DNS for pez.sh
  • Grafana Cloud — Stack, dashboards, synthetic monitoring checks, alert rules, Fleet collectors and pipelines
  • PagerDuty — Service, escalation policy, and Grafana integration

Secrets

Secrets are stored encrypted in secrets.enc.yaml via SOPS and decrypted at plan/apply time into secrets.yaml. The Makefile handles decryption automatically.

Required secret keys: hetzner_token, grafana_cloud_access_policy, grafana_synthetic_monitoring_access_token, grafana_fleet_management_auth, grafana_service_account_token, pagerduty_token, plex_token, backblaze_key_id.

State

State is stored in a Backblaze B2 bucket (pez-infra-tfstate) using an S3-compatible backend. Credentials are read from AWS_ACCESS_KEY_ID / AWS_SECRET_ACCESS_KEY environment variables.

Usage

make init   # initialize providers and backend
make plan   # preview changes
make apply  # apply changes
make fmt    # format all .tf files

Provider versions

Provider Source Version
Hetzner Cloud hetznercloud/hcloud ~> 1.45
Grafana grafana/grafana ~> 4.35
PagerDuty pagerduty/pagerduty ~> 2.2
OpenTofu — >= 1.6.0