From fb82f5d7af7a29c46e0f8bdf7dff1628c6ae7ca8 Mon Sep 17 00:00:00 2001 From: Konstantin Renner Date: Wed, 29 Apr 2026 15:01:55 +0200 Subject: [PATCH] feat(opentofu): cut tfstate backend over to Garage MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Phase 4 of the migration off RustFS. State file was copied + sha256 verified by pipeline 793. Switch: - providers.tf backend "s3": endpoint http://s3.renner.uno:9000 → https://s3.nas-1.renner.uno, region main → garage. - deploy-infrastructure.yml (validate-secrets / plan / apply) and rebuild-k8s.yml (recreate-vms): tf_rfs_access/tf_rfs_secret → tf_garage_access/tf_garage_secret. The aws provider block in providers.tf still points at RustFS — that manages aws_s3_bucket.caddy_certificates which lives on RustFS, and migrating that bucket is a separate concern. This push will auto-trigger deploy-infrastructure plan against Garage; expected to produce the same plan output as pipeline 787 (cleanup-only baseline) plus the still-unfixed 8-resource provider misread, since the actual rm+import payload couldn't persist last time and needs to be re-run with a writable backend. --- .woodpecker/deploy-infrastructure.yml | 12 ++++++------ .woodpecker/rebuild-k8s.yml | 4 ++-- opentofu/providers.tf | 4 ++-- 3 files changed, 10 insertions(+), 10 deletions(-) diff --git a/.woodpecker/deploy-infrastructure.yml b/.woodpecker/deploy-infrastructure.yml index 71afeae5..71aa8760 100644 --- a/.woodpecker/deploy-infrastructure.yml +++ b/.woodpecker/deploy-infrastructure.yml @@ -13,11 +13,11 @@ steps: TF_VAR_proxmox_api_url: from_secret: proxmox_api_url AWS_ACCESS_KEY_ID: - from_secret: tf_rfs_access + from_secret: tf_garage_access commands: - | if [ -z "$TF_VAR_proxmox_api_url" ]; then echo "Missing proxmox_api_url secret"; exit 1; fi - if [ -z "$AWS_ACCESS_KEY_ID" ]; then echo "Missing tf_rfs_access secret"; exit 1; fi + if [ -z "$AWS_ACCESS_KEY_ID" ]; then echo "Missing tf_garage_access secret"; exit 1; fi echo "Secrets validated" - name: plan @@ -34,9 +34,9 @@ steps: TF_VAR_proxmox_token_secret: from_secret: proxmox_token_secret AWS_ACCESS_KEY_ID: - from_secret: tf_rfs_access + from_secret: tf_garage_access AWS_SECRET_ACCESS_KEY: - from_secret: tf_rfs_secret + from_secret: tf_garage_secret AWS_REGION: "us-east-1" TF_VAR_unifi_api_key: from_secret: unifi_api_key @@ -86,9 +86,9 @@ steps: TF_VAR_proxmox_token_secret: from_secret: proxmox_token_secret AWS_ACCESS_KEY_ID: - from_secret: tf_rfs_access + from_secret: tf_garage_access AWS_SECRET_ACCESS_KEY: - from_secret: tf_rfs_secret + from_secret: tf_garage_secret AWS_REGION: "us-east-1" TF_VAR_unifi_api_key: from_secret: unifi_api_key diff --git a/.woodpecker/rebuild-k8s.yml b/.woodpecker/rebuild-k8s.yml index 0a1f20c4..572415f1 100644 --- a/.woodpecker/rebuild-k8s.yml +++ b/.woodpecker/rebuild-k8s.yml @@ -17,9 +17,9 @@ steps: TF_VAR_proxmox_token_secret: from_secret: proxmox_token_secret AWS_ACCESS_KEY_ID: - from_secret: tf_rfs_access + from_secret: tf_garage_access AWS_SECRET_ACCESS_KEY: - from_secret: tf_rfs_secret + from_secret: tf_garage_secret AWS_REGION: "us-east-1" TF_VAR_unifi_api_key: from_secret: unifi_api_key diff --git a/opentofu/providers.tf b/opentofu/providers.tf index 494f8959..c470eed0 100644 --- a/opentofu/providers.tf +++ b/opentofu/providers.tf @@ -2,8 +2,8 @@ terraform { backend "s3" { bucket = "tfstate" key = "terraform.tfstate" - region = "main" - endpoint = "http://s3.renner.uno:9000" + region = "garage" + endpoint = "https://s3.nas-1.renner.uno" skip_credentials_validation = true skip_requesting_account_id = true skip_metadata_api_check = true