mirror of
https://github.com/RWejlgaard/pez-infra.git
synced 2026-07-04 15:46:16 +00:00
37 lines
1.5 KiB
Markdown
37 lines
1.5 KiB
Markdown
# Terraform
|
|
|
|
Infrastructure-as-code for cloud and edge services. Uses [OpenTofu](https://opentofu.org/) (drop-in Terraform replacement).
|
|
|
|
## What's managed
|
|
|
|
- **Hetzner Cloud** — Two servers (`nuremberg-a`, `helsinki-a`), firewalls, and DNS for `pez.sh`
|
|
- **Grafana Cloud** — Stack, dashboards, synthetic monitoring checks, alert rules, Fleet collectors and pipelines
|
|
- **PagerDuty** — Service, escalation policy, and Grafana integration
|
|
|
|
## Secrets
|
|
|
|
Secrets are stored encrypted in `secrets.enc.yaml` via [SOPS](https://github.com/getsops/sops) and decrypted at plan/apply time into `secrets.yaml`. The Makefile handles decryption automatically.
|
|
|
|
Required secret keys: `hetzner_token`, `grafana_cloud_access_policy`, `grafana_synthetic_monitoring_access_token`, `grafana_fleet_management_auth`, `grafana_service_account_token`, `pagerduty_token`, `plex_token`, `backblaze_key_id`.
|
|
|
|
## State
|
|
|
|
State is stored in a Backblaze B2 bucket (`pez-infra-tfstate`) using an S3-compatible backend. Credentials are read from `AWS_ACCESS_KEY_ID` / `AWS_SECRET_ACCESS_KEY` environment variables.
|
|
|
|
## Usage
|
|
|
|
```sh
|
|
make init # initialize providers and backend
|
|
make plan # preview changes
|
|
make apply # apply changes
|
|
make fmt # format all .tf files
|
|
```
|
|
|
|
## Provider versions
|
|
|
|
| Provider | Source | Version |
|
|
|----------|--------|---------|
|
|
| Hetzner Cloud | `hetznercloud/hcloud` | `~> 1.45` |
|
|
| Grafana | `grafana/grafana` | `~> 4.35` |
|
|
| PagerDuty | `pagerduty/pagerduty` | `~> 2.2` |
|
|
| OpenTofu | — | `>= 1.6.0` |
|