Page MenuHomeDevCentral
Files F49060543

D4207.id11031.diff
No OneTemporary
Actions

D4207.id11031.diff
View Options

diff --git a/roles/salt-primary/opentofu/files/tf.sh b/roles/salt-primary/opentofu/files/tf.sh
new file mode 100644
--- /dev/null
+++ b/roles/salt-primary/opentofu/files/tf.sh
@@ -0,0 +1,120 @@
+#!/bin/sh
+
+# -------------------------------------------------------------
+# Wrapper to securely manage Terraform state on PEFS
+# - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
+# Project: Nasqueron
+# Usage: tf <init|plan|apply|state|...> ...
+# License: BSD-2-Clause
+# -------------------------------------------------------------
+
+set -e
+
+REPO_TF_BASE="/opt/salt/nasqueron-operations/terraform"
+
+PEFS_ENC="/opt/terraform.enc"
+PEFS_MOUNT="/opt/terraform"
+
+VAULT_PATH="ops/infra/complector/terraform/pefs"
+
+# -------------------------------------------------------------
+# Get working directory
+# - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
+
+CURRENT_DIR="$(pwd)"
+
+case "$CURRENT_DIR" in
+ "${REPO_TF_BASE}"/*)
+ # Remove REPO_TF_BASE/ prefix to get the subdirectory name
+ TF_CONFIG="${CURRENT_DIR#"$REPO_TF_BASE/"}"
+
+ # Ensure it's a single top-level directory (no nested slashes like foo/bar)
+ case "$TF_CONFIG" in
+ */*)
+ echo "Error: You must be in a top-level Terraform subdirectory of $REPO_TF_BASE" >&2
+ echo "Current directory: $CURRENT_DIR" >&2
+ exit 1
+ ;;
+ esac
+ ;;
+ *)
+ echo "Error: Must be run from a subdirectory of $REPO_TF_BASE" >&2
+ echo "Current directory: $CURRENT_DIR" >&2
+ exit 1
+ ;;
+esac
+
+# -------------------------------------------------------------
+# Terraform or OpenTofu?
+# - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
+
+STILL_REQUIRE_TERRAFORM="openbao ovh-ops-backups"
+
+is_terraform_config() {
+ for terraform_subdir in $STILL_REQUIRE_TERRAFORM; do
+ [ "$1" = "$terraform_subdir" ] && return 0
+ done
+ return 1
+}
+
+if is_terraform_config "$TF_CONFIG"; then
+ TF=terraform
+else
+ TF=tofu
+fi
+
+# -------------------------------------------------------------
+# Ensure unmount PEFS on exit
+# - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
+
+MOUNTED_BY_US=0
+
+unmount_pefs() {
+ if [ "$MOUNTED_BY_US" -eq 1 ]; then
+ # Attempt to unmount, suppress errors if already unmounted or busy
+ pefs umount "$PEFS_MOUNT" 2>/dev/null || true
+ fi
+}
+
+# Trap EXIT covers normal completion, script errors (exit 1), and signals (SIGINT/SIGTERM)
+trap unmount_pefs EXIT
+
+# -------------------------------------------------------------
+# Mount and decrypt PEFS
+# - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
+
+if ! mount | grep -q "pefs on ${PEFS_MOUNT} ("; then
+ echo "Mounting PEFS..." >&2
+ if ! pefs mount "$PEFS_ENC" "$PEFS_MOUNT"; then
+ echo "Error: Failed to mount PEFS" >&2
+ exit 2
+ fi
+ MOUNTED_BY_US=1
+fi
+
+if [ -z "$(pefs showkeys "$PEFS_MOUNT" 2>/dev/null)" ]; then
+ echo "Fetching PEFS key from Vault..."
+ if ! vault kv get -field=password "$VAULT_PATH" | pefs addkey -c "$PEFS_MOUNT" -j - 2>/dev/null; then
+ echo "Error: Failed to add PEFS key using password from Vault at $VAULT_PATH"
+ exit 1
+ fi
+fi
+
+# -------------------------------------------------------------
+# Ensure Terraform directories exist
+# - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
+
+TF_STATES_DIR="${PEFS_MOUNT}/tf-state/${TF_CONFIG}"
+export TF_DATA_DIR="${PEFS_MOUNT}/tf-data/${TF_CONFIG}"
+
+mkdir -p "$TF_STATES_DIR" "$TF_DATA_DIR"
+
+# -------------------------------------------------------------
+# Call Terraform/OpenTofu
+#
+# Pass all arguments directly to terraform.
+# The script will exit with Terraform's exact exit code,
+# and the trap will unmount PEFS.
+# - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
+
+$TF "$@"

File Metadata

Mime Type
text/plain
Expires
Fri, Sep 11, 04:57 (21 h, 59 m)
Storage Engine
blob
Storage Format
Raw Data
Storage Handle
4077409
Default Alt Text
D4207.id11031.diff (3 KB)

Event Timeline

Nasqueron DevCentral · If it had been much bigger the moon would have had a core of ice. · Powered by Phabricator