From 55e7f591dd8d45ed39c83baa349f8d51b3cb33f9 Mon Sep 17 00:00:00 2001 From: Konstantin Renner Date: Fri, 26 Jun 2026 23:24:55 +0200 Subject: [PATCH] opentofu: cut the state backend over to Hetzner Object Storage State already migrated (migrate-tfstate pipeline; 45 resources verified on Hetzner). Repoint providers.tf backend (bucket/region/endpoint/path-style) and the deploy-infrastructure backend creds from the nas-1 Garage S3 to Hetzner. nas-1 is now fully decommissionable. Co-Authored-By: Claude Opus 4.8 (1M context) --- .woodpecker/deploy-infrastructure.yml | 16 ++++++++-------- opentofu/providers.tf | 10 ++++++---- 2 files changed, 14 insertions(+), 12 deletions(-) diff --git a/.woodpecker/deploy-infrastructure.yml b/.woodpecker/deploy-infrastructure.yml index aee2e973..ffdc342e 100644 --- a/.woodpecker/deploy-infrastructure.yml +++ b/.woodpecker/deploy-infrastructure.yml @@ -13,11 +13,11 @@ steps: TF_VAR_proxmox_api_url: from_secret: proxmox_api_url AWS_ACCESS_KEY_ID: - from_secret: tf_garage_access + from_secret: hetzner_s3_access_key commands: - | if [ -z "$TF_VAR_proxmox_api_url" ]; then echo "Missing proxmox_api_url secret"; exit 1; fi - if [ -z "$AWS_ACCESS_KEY_ID" ]; then echo "Missing tf_garage_access secret"; exit 1; fi + if [ -z "$AWS_ACCESS_KEY_ID" ]; then echo "Missing hetzner_s3_access_key secret"; exit 1; fi echo "Secrets validated" - name: plan @@ -34,10 +34,10 @@ steps: TF_VAR_proxmox_token_secret: from_secret: proxmox_token_secret AWS_ACCESS_KEY_ID: - from_secret: tf_garage_access + from_secret: hetzner_s3_access_key AWS_SECRET_ACCESS_KEY: - from_secret: tf_garage_secret - AWS_REGION: "us-east-1" + from_secret: hetzner_s3_secret_key + AWS_REGION: "fsn1" TF_VAR_unifi_api_key: from_secret: unifi_api_key TF_VAR_unifi_api_url: @@ -92,10 +92,10 @@ steps: TF_VAR_proxmox_token_secret: from_secret: proxmox_token_secret AWS_ACCESS_KEY_ID: - from_secret: tf_garage_access + from_secret: hetzner_s3_access_key AWS_SECRET_ACCESS_KEY: - from_secret: tf_garage_secret - AWS_REGION: "us-east-1" + from_secret: hetzner_s3_secret_key + AWS_REGION: "fsn1" TF_VAR_unifi_api_key: from_secret: unifi_api_key TF_VAR_unifi_api_url: diff --git a/opentofu/providers.tf b/opentofu/providers.tf index 102085b0..ef00bf74 100644 --- a/opentofu/providers.tf +++ b/opentofu/providers.tf @@ -1,14 +1,16 @@ terraform { backend "s3" { - bucket = "tfstate" + # Migrated off the nas-1 Garage S3 to Hetzner Object Storage (offsite, + # nas-1-independent). State copied via the migrate-tfstate pipeline. + bucket = "renner-uno-tfstate" key = "terraform.tfstate" - region = "garage" - endpoint = "https://s3.nas-1.renner.uno" + region = "fsn1" + endpoint = "https://fsn1.your-objectstorage.com" skip_credentials_validation = true skip_requesting_account_id = true skip_metadata_api_check = true skip_region_validation = true - use_path_style = true + use_path_style = false } required_providers { proxmox = { -- 2.54.0