Change Details

Currently, Terraform states are on-disk. They will soon contain credentials with D4206. Could we avoid to store those credentials on disk? - At software level. OpenTofu supports openbao as encryption backend, but Terraform doesn't - At provider level. With Vault provider 5.0+ can use a block json_data_wo to avoid to store in the Vault, but OVH doesn't have that. - At stanza level. Terraform suggests ephemeral blocks for that kind of use, but OVH provider doesn't support it - null_resource + local-exec. We could replace Terraform providers logic by a script to run locally to use OVH API and Vault CLI client. Works, but the Terraform point was to avoid that (if not, we would have done everything in Salt + salt-cloud). On FreeBSD, we got good results with PEFS on devserver role. So could we keep states on disk, but with encryption-at-rest?

Currently, Terraform states are on-disk. They will soon contain credentials with D4206. Could we avoid to store those credentials on disk? - At software level. OpenTofu supports openbao as encryption backend, but Terraform doesn't - At provider level. With Vault provider 5.0+ can use a block json_data_wo to avoid to store in the Vault, but OVH doesn't have that. - At stanza level. Terraform suggests ephemeral blocks for that kind of use, but OVH provider doesn't support it - null_resource + local-exec. We could replace Terraform providers logic by a script to run locally to use OVH API and Vault CLI client. Works, but the Terraform point was to avoid that (if not, we would have done everything in Salt + salt-cloud). On FreeBSD, we got good results with PEFS on devserver role. So could we keep states on disk, but with encryption-at-rest? ____ Relevant links: - https://agora.nasqueron.org/Operations_grimoire/Deploy_with_Terraform - https://www.dereckson.be/blog/2026/09/06/encrypt-terraform-state-with-pefs-on-freebsd/

Currently, Terraform states are on-disk. They will soon contain credentials with D4206. Could we avoid to store those credentials on disk? - At software level. OpenTofu supports openbao as encryption backend, but Terraform doesn't - At provider level. With Vault provider 5.0+ can use a block json_data_wo to avoid to store in the Vault, but OVH doesn't have that. - At stanza level. Terraform suggests ephemeral blocks for that kind of use, but OVH provider doesn't support it - null_resource + local-exec. We could replace Terraform providers logic by a script to run locally to use OVH API and Vault CLI client. Works, but the Terraform point was to avoid that (if not, we would have done everything in Salt + salt-cloud). On FreeBSD, we got good results with PEFS on devserver role. So could we keep states on disk, but with encryption-at-rest? ____ Relevant links: - https://agora.nasqueron.org/Operations_grimoire/Deploy_with_Terraform - https://www.dereckson.be/blog/2026/09/06/encrypt-terraform-state-with-pefs-on-freebsd/