terraform

Contains Terraform code used to manage our infrastructure, Nix'ified for Terranix.

Prerequisites

Nix with Flakes enabled
Credentials (see configuring), if not using the shared secrets:
- tf_cloud_token: Terraform Cloud token to use shared state
- hcloud_api_token: Hetzner Cloud API token

Before issuing any other commands, enter the development environment (if not using direnv):
```
nix develop -c $SHELL
```
Applying changes:
```
nix run
```
Validating logic:
```
nix run .#check
```
Showing the generated plan:
```
nix run .#plan
```
Applying changes, approving automatically:
```
nix run .#cd
```
Removing local state and derived credentials:
```
nix run .#destroy
```
Updating dependencies:
```
nix flake update
```

Simulating a CI test (substituting <SOPS_AGE_KEY>):

woodpecker-cli exec --env "SOPS_AGE_KEY=<SOPS_AGE_KEY>"

if you want to reset secrets:
- generate an age key pair, using rage installed as part of the nix shell:
```
rage-keygen -o keys.txt
```
- list it in sops config file .sops.yaml
key setup: set environment variable SOPS_AGE_KEY_FILE or SOPS_AGE_KEY so sops can locate the secret key to an age key pair that has its public key listed in .sops.yaml

encoding secrets:

sops -e secrets.yaml > secrets.enc.yaml

decoding secrets:

sops -d secrets.enc.yaml > secrets.yaml

Create a file terraform.tfvars containing override for any Terraform variables, e.g.:

hcloud_location = "nbg1"