Terraform states in PEFS and tf wrapper
No One
Actions

Authored By

	dereckson
	Sat, Sep 19, 08:18

Size

7 KB

Referenced Files

None

Subscribers

None

Terraform states in PEFS and tf wrapper
View Options

	┌─────────────────────────────────────────────────────────────────────────────┐
	│ DEVELOPER TERMINAL ON COMPLECTOR │
	│ │
	│ $ cd /opt/salt/nasqueron-operations/terraform/<project> │
	│ $ tf plan │
	│ $ tf apply │
	└──────────────────────────────────┬──────────────────────────────────────────┘
	│
	▼
	┌─────────────────────────────────────────────────────────────────────────────┐
	│ WRAPPER /usr/local/bin/tf │
	│ │
	│ 1. Validate current directory is a top-level project under │
	│ /opt/salt/nasqueron-operations/terraform/ │
	│ │
	│ 2. Determine runtime: │
	│ • openbao, ovh-ops-backups → terraform │
	│ • everything else → tofu │
	│ │
	│ 3. Mount PEFS if not already mounted: │
	│ pefs mount /opt/terraform.enc /opt/terraform/encrypted │
	│ │
	│ 4. Load encryption key if not already in kernel: │
	│ vault kv get -field=password ops/infra/complector/terraform/pefs │
	│ \| │
	│ └──► pefs addkey -c /opt/terraform -j - │
	│ │
	│ 5. Prepare directories and environment: │
	│ mkdir -p /opt/terraform/encrypted/tf-state/<project> │
	│ export TF_DATA_DIR=/opt/terraform/tf-data/<project> │
	│ │
	│ 6. Execute Terraform/OpenTofu: │
	│ terraform <args> -or- tofu <args> │
	│ │
	│ 7. On exit (trap EXIT): │
	│ pefs umount /opt/terraform │
	└──────────────────────────────────┬──────────────────────────────────────────┘
	│
	┌──────────────┴──────────────────┐
	│ │
	▼ ▼
	┌───────────────────────────────────────┐ ┌─────────────────────────────────┐
	│ ENCRYPTED VOLUME (PEFS) │ │ PUBLIC REPOSITORY │
	│ /opt/terraform.enc/ │ │ /opt/salt/nasqueron-operations/ │
	│ │ │ │
	│ Mounted at /opt/terraform/encrypted │ │ terraform/ │
	│ while tf is running. Sensitive. │ │ ├── ovh-ops-backups/ │
	│ │ │ │ ├── main.tf │
	│ /o/t/encrypted/tf-state/<project>/ │ │ │ ├── backend.tf │
	│ └── terraform.tfstate │ │ │ └── modules/ │
	│ └── terraform.tfstate.bak │ │ │ │
	│───────────────────────────────────────│ │ ├── openbao/ │
	│ WORKING DIRECTORY │ │ │ ├── main.tf │
	│ /opt/terraform/ │ │ │ └── ... │
	│ │ │ │ │
	│ /o/t/tf-data/<project>/ unencrypted │ │ └── <other-projects>/ │
	│ └── .teraform/ │ │ │
	│ └── providers/ │ │ Contains only public code. │
	│ └── modules/ │ │ │
	│ │ │ │
	└───────────────────────────────────────┘ └─────────────────────────────────┘
	│
	│ (encrypted at rest by PEFS AES-256-XTS)
	│
	▼
	┌─────────────────────────────────────────────────────────────────────────────┐
	│ BACKUP PIPELINE (Restic) │
	│ │
	│ Restic /opt/terraform.enc │
	│ │ │
	│ ▼ │
	│ OVH Object Storage (S3-compatible) │
	│ • Bucket: nasqueron-backups-amaris │
	│ • Region: EU-WEST-PAR │
	│ • Versioning: enabled │
	│ • Object Lock: governance mode, 90-day retention │
	│ • Per-client prefix isolation via IAM policies │
	└─────────────────────────────────────────────────────────────────────────────┘

File Metadata

Mime Type: text/plain; charset=utf-8
Storage Engine: blob
Storage Format: Raw Data
Storage Handle: 4105059
Default Alt Text: Terraform states in PEFS and tf wrapper (7 KB)

Terraform states in PEFS and tf wrapperNo OneActions

Terraform states in PEFS and tf wrapperView Options

File Metadata

Event Timeline

Terraform states in PEFS and tf wrapper
No One
Actions

Terraform states in PEFS and tf wrapper
View Options