From 0b8d406adccbecc2825b7d84d8c055fa31175d5a Mon Sep 17 00:00:00 2001 From: Konstantin Renner Date: Sat, 27 Jun 2026 08:21:10 +0200 Subject: [PATCH] cleanup: drop the one-off migrate-tfstate pipeline + unused proxy dirs MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit - Remove .woodpecker/migrate-tfstate.yml — the Garage(nas-1)->Hetzner state migration it performed is complete and verified; it was a manual one-off. - netbird-proxy no longer needs the /opt/netbird-proxy/certs and /state bind-mount dirs (those are Docker named volumes now); only the compose dir is required. Co-Authored-By: Claude Opus 4.8 (1M context) --- .woodpecker/migrate-tfstate.yml | 67 --------------------------------- 1 file changed, 67 deletions(-) delete mode 100644 .woodpecker/migrate-tfstate.yml diff --git a/.woodpecker/migrate-tfstate.yml b/.woodpecker/migrate-tfstate.yml deleted file mode 100644 index 1c240214..00000000 --- a/.woodpecker/migrate-tfstate.yml +++ /dev/null @@ -1,67 +0,0 @@ -# One-off, manual-only: migrate the OpenTofu remote state from the nas-1 -# Garage S3 to Hetzner Object Storage. Garage is only READ (state pull) and -# never written/deleted, so the source stays intact and the move is fully -# reversible (just revert providers.tf to Garage). Trigger: -# woodpecker pipeline create ... --var PIPELINE=migrate-tfstate -when: - - event: manual - evaluate: 'PIPELINE == "migrate-tfstate"' - -steps: - - name: migrate-tfstate - image: gitea.renner.uno/gitea_admin/ci-tofu:2026-04-29 - directory: opentofu - environment: - TF_IN_AUTOMATION: "true" - TF_VAR_proxmox_api_url: - from_secret: proxmox_api_url - TF_VAR_proxmox_user: - from_secret: proxmox_user - TF_VAR_proxmox_token_id: - from_secret: proxmox_token_id - TF_VAR_proxmox_token_secret: - from_secret: proxmox_token_secret - TF_VAR_unifi_api_key: - from_secret: unifi_api_key - TF_VAR_unifi_api_url: - from_secret: unifi_api_url - TF_VAR_hetzner_s3_access_key: - from_secret: hetzner_s3_access_key - TF_VAR_hetzner_s3_secret_key: - from_secret: hetzner_s3_secret_key - GARAGE_ACCESS: - from_secret: tf_garage_access - GARAGE_SECRET: - from_secret: tf_garage_secret - HETZNER_ACCESS: - from_secret: hetzner_s3_access_key - HETZNER_SECRET: - from_secret: hetzner_s3_secret_key - commands: - - | - set -eu - echo "### 1/4 init Garage source and pull the live state" - tofu init -upgrade -backend-config="access_key=$GARAGE_ACCESS" -backend-config="secret_key=$GARAGE_SECRET" - tofu state pull > /tmp/state.json - BYTES=$(wc -c < /tmp/state.json) - echo "pulled state bytes $BYTES" - test "$BYTES" -gt 2000 - RES=$(grep -o '"mode"' /tmp/state.json | wc -l) - echo "resource occurrences $RES" - test "$RES" -gt 10 - - echo "### 2/4 repoint the backend block to Hetzner (checkout only)" - sed -i 's#https://s3.nas-1.renner.uno#https://fsn1.your-objectstorage.com#' providers.tf - sed -i 's#bucket *= *"tfstate"#bucket = "renner-uno-tfstate"#' providers.tf - sed -i 's#region *= *"garage"#region = "fsn1"#' providers.tf - sed -i 's#use_path_style *= *true#use_path_style = false#' providers.tf - grep -E 'bucket|key|endpoint|region|use_path_style' providers.tf - - echo "### 3/4 reconfigure to Hetzner target and push" - tofu init -reconfigure -backend-config="access_key=$HETZNER_ACCESS" -backend-config="secret_key=$HETZNER_SECRET" - tofu state push /tmp/state.json - - echo "### 4/4 verify state now lives on Hetzner" - tofu state list | tee /tmp/list.txt - echo "migrated resource count $(wc -l < /tmp/list.txt)" - test "$(wc -l < /tmp/list.txt)" -gt 10 -- 2.54.0