mirror of
https://github.com/RWejlgaard/pez-infra.git
synced 2026-07-04 15:46:16 +00:00
Rasmus "Pez" Wejlgaard
65090ca9d6
* ci: serialize infra runs and enable terraform state locking Add concurrency guards to the terraform and deploy-on-merge workflows so two merges in quick succession can't run against the same state or the same hosts at once (queue, never cancel an in-flight run). Enable native S3 state locking (use_lockfile) on the Backblaze B2 backend, which needs OpenTofu 1.10+, so bump the CI tofu version 1.9.0 -> 1.10.10 and the required_version constraint to >= 1.10.0. * ci: bump tofu to 1.10.10 in the validate workflow too Missed this one in the last commit — the PR-time validate still pinned 1.9.0, which trips the new required_version >= 1.10.0 constraint. * ci: drop use_lockfile — Backblaze B2 can't do native state locking B2's S3 API returns 501 NotImplemented for the conditional PutObject that use_lockfile relies on, so tofu plan/apply fails to acquire the lock. Revert the lockfile and the 1.10 version bump it required; rely on the concurrency guard to serialize applies instead. Left a note in the backend block so this isn't re-attempted.
51 lines
1.7 KiB
HCL
51 lines
1.7 KiB
HCL
terraform {
|
|
required_version = ">= 1.6.0"
|
|
|
|
required_providers {
|
|
hcloud = {
|
|
source = "hetznercloud/hcloud"
|
|
version = "~> 1.45"
|
|
}
|
|
grafana = {
|
|
source = "grafana/grafana"
|
|
version = "~> 4.35"
|
|
}
|
|
pagerduty = {
|
|
source = "pagerduty/pagerduty"
|
|
version = "~> 2.2"
|
|
}
|
|
}
|
|
|
|
|
|
backend "s3" {
|
|
bucket = "pez-infra-tfstate"
|
|
key = "tfstate/terraform.tfstate"
|
|
endpoints = { s3 = "s3.eu-central-003.backblazeb2.com" }
|
|
region = "eu-central-003"
|
|
skip_credentials_validation = true
|
|
skip_region_validation = true
|
|
# NOTE: no state locking — Backblaze B2's S3 API doesn't implement the
|
|
# conditional PutObject that OpenTofu's use_lockfile needs (returns 501
|
|
# NotImplemented). Concurrent applies are instead prevented by the
|
|
# `concurrency` guard in .github/workflows/terraform.yml.
|
|
# Credentials read from AWS_ACCESS_KEY_ID / AWS_SECRET_ACCESS_KEY env vars
|
|
}
|
|
}
|
|
|
|
provider "hcloud" {
|
|
token = local.secrets["hetzner_token"]
|
|
}
|
|
|
|
provider "grafana" {
|
|
cloud_access_policy_token = local.secrets["grafana_cloud_access_policy"]
|
|
sm_url = "https://synthetic-monitoring-api-gb-south-1.grafana.net"
|
|
sm_access_token = local.secrets["grafana_synthetic_monitoring_access_token"]
|
|
fleet_management_url = "https://fleet-management-prod-023.grafana.net"
|
|
fleet_management_auth = local.secrets["grafana_fleet_management_auth"]
|
|
url = "https://pez.grafana.net"
|
|
auth = local.secrets["grafana_service_account_token"]
|
|
}
|
|
|
|
provider "pagerduty" {
|
|
token = local.secrets["pagerduty_token"]
|
|
}
|