RWejlgaard/pez-infra
1
0
Fork 0
mirror of https://github.com/RWejlgaard/pez-infra.git synced 2026-07-04 15:46:16 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions
pez-infra/terraform
History
Rasmus "Pez" Wejlgaard 65090ca9d6
Some checks failed
Deploy (on merge) / Discover hosts (push) Waiting to run
Details
Deploy (on merge) / deploy (push) Blocked by required conditions
Details
Terraform / Plan (push) Has been cancelled
Details
Terraform / Apply (push) Has been cancelled
Details
ci: serialize terraform and deploy runs with concurrency guards (#114) 
* ci: serialize infra runs and enable terraform state locking

Add concurrency guards to the terraform and deploy-on-merge workflows so
two merges in quick succession can't run against the same state or the
same hosts at once (queue, never cancel an in-flight run).

Enable native S3 state locking (use_lockfile) on the Backblaze B2 backend,
which needs OpenTofu 1.10+, so bump the CI tofu version 1.9.0 -> 1.10.10
and the required_version constraint to >= 1.10.0.

* ci: bump tofu to 1.10.10 in the validate workflow too

Missed this one in the last commit — the PR-time validate still pinned
1.9.0, which trips the new required_version >= 1.10.0 constraint.

* ci: drop use_lockfile — Backblaze B2 can't do native state locking

B2's S3 API returns 501 NotImplemented for the conditional PutObject that
use_lockfile relies on, so tofu plan/apply fails to acquire the lock.
Revert the lockfile and the 1.10 version bump it required; rely on the
concurrency guard to serialize applies instead. Left a note in the
backend block so this isn't re-attempted.
2026-06-02 19:39:13 +01:00
..
grafana fix: tracing on caddy services (#104) 2026-05-10 10:18:53 +01:00
hetzner fix: slight tweaks (#103) 2026-05-09 20:49:46 +01:00
pagerduty fix: slight tweaks (#103) 2026-05-09 20:49:46 +01:00
.gitignore initial commit 2026-03-28 12:39:41 +00:00
main.tf adding pagerduty stack (#95) 2026-05-04 20:50:31 +01:00
Makefile initial commit 2026-03-28 12:39:41 +00:00
providers.tf ci: serialize terraform and deploy runs with concurrency guards (#114) 2026-06-02 19:39:13 +01:00
README.md fix: slight tweaks (#103) 2026-05-09 20:49:46 +01:00
secrets.enc.yaml adding pagerduty stack (#95) 2026-05-04 20:50:31 +01:00
vars.tf initial commit 2026-03-28 12:39:41 +00:00

README.md

Terraform

Infrastructure-as-code for cloud and edge services. Uses OpenTofu (drop-in Terraform replacement).

What's managed

  • Hetzner Cloud — Two servers (nuremberg-a, helsinki-a), firewalls, and DNS for pez.sh
  • Grafana Cloud — Stack, dashboards, synthetic monitoring checks, alert rules, Fleet collectors and pipelines
  • PagerDuty — Service, escalation policy, and Grafana integration

Secrets

Secrets are stored encrypted in secrets.enc.yaml via SOPS and decrypted at plan/apply time into secrets.yaml. The Makefile handles decryption automatically.

Required secret keys: hetzner_token, grafana_cloud_access_policy, grafana_synthetic_monitoring_access_token, grafana_fleet_management_auth, grafana_service_account_token, pagerduty_token, plex_token, backblaze_key_id.

State

State is stored in a Backblaze B2 bucket (pez-infra-tfstate) using an S3-compatible backend. Credentials are read from AWS_ACCESS_KEY_ID / AWS_SECRET_ACCESS_KEY environment variables.

Usage

make init   # initialize providers and backend
make plan   # preview changes
make apply  # apply changes
make fmt    # format all .tf files

Provider versions

Provider Source Version
Hetzner Cloud hetznercloud/hcloud ~> 1.45
Grafana grafana/grafana ~> 4.35
PagerDuty pagerduty/pagerduty ~> 2.2
OpenTofu — >= 1.6.0