pez-infra/terraform

Terraform

Infrastructure-as-code for cloud and edge services. Uses OpenTofu (drop-in Terraform replacement).

What's managed

• Hetzner Cloud — Two servers (nuremberg-a, helsinki-a), firewalls, and DNS for pez.sh
• Grafana Cloud — Stack, dashboards, synthetic monitoring checks, alert rules, Fleet collectors and pipelines
• PagerDuty — Service, escalation policy, and Grafana integration

Secrets

Secrets are stored encrypted in secrets.enc.yaml via SOPS and decrypted at plan/apply time into secrets.yaml. The Makefile handles decryption automatically.

Required secret keys: hetzner_token, grafana_cloud_access_policy, grafana_synthetic_monitoring_access_token, grafana_fleet_management_auth, grafana_service_account_token, pagerduty_token, plex_token, backblaze_keyID, backblaze_applicationKey.

State

State is stored in a Backblaze B2 bucket (pez-infra-tfstate) using an S3-compatible backend. Credentials are read from AWS_ACCESS_KEY_ID / AWS_SECRET_ACCESS_KEY environment variables — the Makefile exports them from the backblaze_keyID / backblaze_applicationKey secrets automatically.

Usage

make init   # initialize providers and backend
make plan   # preview changes
make apply  # apply changes
make fmt    # format all .tf files

Provider versions

Provider	Source	Version
Hetzner Cloud	hetznercloud/hcloud	~> 1.45
Grafana	grafana/grafana	~> 4.35
PagerDuty	pagerduty/pagerduty	~> 3.32
OpenTofu	—	>= 1.6.0