| 1 | # For the bits that are not nixops-able |
| 2 | |
| 3 | This terraform root module manages: |
| 4 | |
| 5 | - the resource in the AWS main account (S3 buckets) |
| 6 | - Fastly |
| 7 | - Netlify DNS |
| 8 | |
| 9 | ## Setup |
| 10 | |
| 11 | In order to use this, make sure to install direnv and Nix with flakes enabled. |
| 12 | |
| 13 | Then copy the `.envrc.local.template` to `.envrc.local`, and fill in the related |
| 14 | keys. |
| 15 | |
| 16 | > FIXME: Unset the AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY env vars if they |
| 17 | > are already set. Those have been replaced by AWS SSO. |
| 18 | |
| 19 | Then run `direnv allow` to load the environment with the runtime dependencies. |
| 20 | |
| 21 | Run `aws sso login` to acquire a temporary token. |
| 22 | |
| 23 | ## Usage |
| 24 | |
| 25 | We use opentofu, which is a fork of https://www.terraform.io/ maintained by the |
| 26 | Linux foundation. |
| 27 | |
| 28 | Then run the following command to diff the changes and then apply if approved: |
| 29 | |
| 30 | ```sh |
| 31 | ./tf.sh apply |
| 32 | ``` |
| 33 | |
| 34 | ## Terraform workflow |
| 35 | |
| 36 | Write the Tofu code and test the changes using `./tf.sh validate`. |
| 37 | |
| 38 | Before committing run `nix fmt`. |
| 39 | |
| 40 | Once the code is ready to be deployed, create a new PR with the attached output |
| 41 | of `./tf.sh plan`. |
| 42 | |
| 43 | Once the PR is merged, run `./tf.sh apply` to apply the changes. |
| 44 | |
| 45 | ## Upgrade from terraform to opentofu |
| 46 | |
| 47 | If you have used terraform, you may have to delete .terraform in this directory |
| 48 | once to fixup provider registry addresses. |