RWejlgaard/pez-infra
1
0
Fork 0
mirror of https://github.com/RWejlgaard/pez-infra.git synced 2026-07-04 15:46:16 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions
pez-infra/terraform
History
Rasmus Wejlgaard 361133ec7e docs: catch up with the Cloudflare to Hetzner DNS move, fix secrets/terraform drift 
The docs still described Cloudflare as DNS + CDN in front of helsinki-a,
but that was dropped in #90 - pez.sh lives on Hetzner DNS via Terraform
now and records point straight at the origin. Updated README,
architecture, networking, getting-started and the nuremberg-a host doc
to match, and noted that pez.solutions still resolves via Cloudflare
outside Terraform.

Also fixed while I was in there:
- terraform/README: PagerDuty provider is ~> 3.32 (table said ~> 2.2),
  and the B2 secret keys are backblaze_keyID/backblaze_applicationKey
- secrets docs: group_vars secrets file is .enc.yaml, dropped the
  FreeBSD install steps, the long-gone .sops.yaml placeholder note and
  the ANSIBLE_VAULT_PASS migration note, swapped the cloudflare_record
  example for hcloud
- getting-started referenced ansible/scripts/sops-setup.sh which
  doesn't exist
- added naveen.pez.sh to the subdomain tables and a note about the
  DNS-only records (mail, minecraft, wow, public)
2026-06-10 19:35:53 +01:00
..
grafana fix: tracing on caddy services (#104) 2026-05-10 10:18:53 +01:00
hetzner fix: slight tweaks (#103) 2026-05-09 20:49:46 +01:00
pagerduty chore(deps): bump the terraform group across 2 directories with 1 update (#116) 2026-06-05 21:12:59 +01:00
.gitignore initial commit 2026-03-28 12:39:41 +00:00
.terraform.lock.hcl chore: commit terraform lock file for reproducible provider versions (#121) 2026-06-06 13:19:08 +01:00
main.tf adding pagerduty stack (#95) 2026-05-04 20:50:31 +01:00
Makefile initial commit 2026-03-28 12:39:41 +00:00
providers.tf chore(deps): bump the terraform group across 2 directories with 1 update (#116) 2026-06-05 21:12:59 +01:00
README.md docs: catch up with the Cloudflare to Hetzner DNS move, fix secrets/terraform drift 2026-06-10 19:35:53 +01:00
secrets.enc.yaml adding pagerduty stack (#95) 2026-05-04 20:50:31 +01:00
vars.tf initial commit 2026-03-28 12:39:41 +00:00

README.md

Terraform

Infrastructure-as-code for cloud and edge services. Uses OpenTofu (drop-in Terraform replacement).

What's managed

  • Hetzner Cloud — Two servers (nuremberg-a, helsinki-a), firewalls, and DNS for pez.sh
  • Grafana Cloud — Stack, dashboards, synthetic monitoring checks, alert rules, Fleet collectors and pipelines
  • PagerDuty — Service, escalation policy, and Grafana integration

Secrets

Secrets are stored encrypted in secrets.enc.yaml via SOPS and decrypted at plan/apply time into secrets.yaml. The Makefile handles decryption automatically.

Required secret keys: hetzner_token, grafana_cloud_access_policy, grafana_synthetic_monitoring_access_token, grafana_fleet_management_auth, grafana_service_account_token, pagerduty_token, plex_token, backblaze_keyID, backblaze_applicationKey.

State

State is stored in a Backblaze B2 bucket (pez-infra-tfstate) using an S3-compatible backend. Credentials are read from AWS_ACCESS_KEY_ID / AWS_SECRET_ACCESS_KEY environment variables — the Makefile exports them from the backblaze_keyID / backblaze_applicationKey secrets automatically.

Usage

make init   # initialize providers and backend
make plan   # preview changes
make apply  # apply changes
make fmt    # format all .tf files

Provider versions

Provider Source Version
Hetzner Cloud hetznercloud/hcloud ~> 1.45
Grafana grafana/grafana ~> 4.35
PagerDuty pagerduty/pagerduty ~> 3.32
OpenTofu — >= 1.6.0