.woodpecker/deploy-infrastructure.yml

@@ -13,11 +13,11 @@ steps:
       TF_VAR_proxmox_api_url:
         from_secret: proxmox_api_url
       AWS_ACCESS_KEY_ID:
-        from_secret: tf_garage_access
+        from_secret: hetzner_s3_access_key
     commands:
       - |
         if [ -z "$TF_VAR_proxmox_api_url" ]; then echo "Missing proxmox_api_url secret"; exit 1; fi
-        if [ -z "$AWS_ACCESS_KEY_ID" ]; then echo "Missing tf_garage_access secret"; exit 1; fi
+        if [ -z "$AWS_ACCESS_KEY_ID" ]; then echo "Missing hetzner_s3_access_key secret"; exit 1; fi
         echo "Secrets validated"
 
   - name: plan
@@ -34,10 +34,10 @@ steps:
       TF_VAR_proxmox_token_secret:
         from_secret: proxmox_token_secret
       AWS_ACCESS_KEY_ID:
-        from_secret: tf_garage_access
+        from_secret: hetzner_s3_access_key
       AWS_SECRET_ACCESS_KEY:
-        from_secret: tf_garage_secret
-      AWS_REGION: "us-east-1"
+        from_secret: hetzner_s3_secret_key
+      AWS_REGION: "fsn1"
       TF_VAR_unifi_api_key:
         from_secret: unifi_api_key
       TF_VAR_unifi_api_url:
@@ -92,10 +92,10 @@ steps:
       TF_VAR_proxmox_token_secret:
         from_secret: proxmox_token_secret
       AWS_ACCESS_KEY_ID:
-        from_secret: tf_garage_access
+        from_secret: hetzner_s3_access_key
       AWS_SECRET_ACCESS_KEY:
-        from_secret: tf_garage_secret
-      AWS_REGION: "us-east-1"
+        from_secret: hetzner_s3_secret_key
+      AWS_REGION: "fsn1"
       TF_VAR_unifi_api_key:
         from_secret: unifi_api_key
       TF_VAR_unifi_api_url:

opentofu/providers.tf

@@ -1,14 +1,16 @@
 terraform {
   backend "s3" {
-    bucket                      = "tfstate"
+    # Migrated off the nas-1 Garage S3 to Hetzner Object Storage (offsite,
+    # nas-1-independent). State copied via the migrate-tfstate pipeline.
+    bucket                      = "renner-uno-tfstate"
     key                         = "terraform.tfstate"
-    region                      = "garage"
-    endpoint                    = "https://s3.nas-1.renner.uno"
+    region                      = "fsn1"
+    endpoint                    = "https://fsn1.your-objectstorage.com"
     skip_credentials_validation = true
     skip_requesting_account_id  = true
     skip_metadata_api_check     = true
     skip_region_validation      = true
-    use_path_style              = true
+    use_path_style              = false
   }
   required_providers {
     proxmox = {