9109712b59
SOPS State Management: - Implemented Git + SOPS + age encryption for Terraform state files - Added .gitignore files to prevent committing unencrypted secrets - Created .sops.yaml.example template for age encryption configuration - Created helper scripts for automated encryption/decryption workflow: - scripts/tf: Wrapper script with auto-encrypt/decrypt - scripts/tf-encrypt: Manual encryption of state files - scripts/tf-decrypt: Manual decryption of state files - Added comprehensive STATE_MANAGEMENT.md documentation covering: - Installation of age and SOPS - Initial setup and key generation - Daily workflow examples - Security best practices - Troubleshooting common issues - Multi-user key management - Backup strategies Terraform Deployment Fixes: - Added snippets_storage variable for cloud-init snippet storage - Fixed datastore error: "local" does not support snippets - Updated README with solutions for datastore and SSH issues - Added troubleshooting for: - Enabling snippets on existing storage (pvesm set) - Creating dedicated directory storage for snippets - SSH authentication setup with ssh-agent - Manual cloud-init snippet creation workaround Files modified: - terraform/proxmox-examples/docker-host/main.tf - terraform/proxmox-examples/docker-host/variables.tf - terraform/proxmox-examples/docker-host/terraform.tfvars.example - terraform/proxmox-examples/docker-host/README.md Files added: - .gitignore (root level) - terraform/proxmox-examples/docker-host/.gitignore - terraform/proxmox-examples/docker-host/.sops.yaml.example - terraform/proxmox-examples/docker-host/STATE_MANAGEMENT.md - terraform/proxmox-examples/docker-host/scripts/tf - terraform/proxmox-examples/docker-host/scripts/tf-encrypt - terraform/proxmox-examples/docker-host/scripts/tf-decrypt
76 lines
1.6 KiB
Bash
Executable file
76 lines
1.6 KiB
Bash
Executable file
#!/usr/bin/env bash
|
||
#
|
||
# tf - Wrapper for OpenTofu/Terraform with automatic SOPS encryption/decryption
|
||
#
|
||
# Usage:
|
||
# ./scripts/tf init
|
||
# ./scripts/tf plan
|
||
# ./scripts/tf apply
|
||
# ./scripts/tf destroy
|
||
#
|
||
# This script automatically:
|
||
# 1. Decrypts state before running tofu commands
|
||
# 2. Runs your tofu command
|
||
# 3. Encrypts state after running tofu commands
|
||
#
|
||
|
||
set -euo pipefail
|
||
|
||
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
|
||
TF_DIR="$(dirname "$SCRIPT_DIR")"
|
||
|
||
cd "$TF_DIR"
|
||
|
||
# Colors for output
|
||
RED='\033[0;31m'
|
||
GREEN='\033[0;32m'
|
||
YELLOW='\033[1;33m'
|
||
BLUE='\033[0;34m'
|
||
NC='\033[0m' # No Color
|
||
|
||
error() {
|
||
echo -e "${RED}ERROR: $1${NC}" >&2
|
||
exit 1
|
||
}
|
||
|
||
success() {
|
||
echo -e "${GREEN}✓ $1${NC}"
|
||
}
|
||
|
||
info() {
|
||
echo -e "${BLUE}ℹ $1${NC}"
|
||
}
|
||
|
||
# Check if tofu or terraform is installed
|
||
if command -v tofu &> /dev/null; then
|
||
TF_CMD="tofu"
|
||
elif command -v terraform &> /dev/null; then
|
||
TF_CMD="terraform"
|
||
else
|
||
error "Neither tofu nor terraform is installed"
|
||
fi
|
||
|
||
# Decrypt state if encrypted files exist
|
||
if [[ -f terraform.tfstate.enc || -f terraform.tfvars.enc ]]; then
|
||
info "Decrypting state files..."
|
||
"$SCRIPT_DIR/tf-decrypt"
|
||
echo
|
||
fi
|
||
|
||
# Run the terraform/tofu command
|
||
echo -e "${BLUE}Running: $TF_CMD $*${NC}"
|
||
echo
|
||
$TF_CMD "$@"
|
||
TF_EXIT_CODE=$?
|
||
|
||
# If the command succeeded and modified state, encrypt it
|
||
if [[ $TF_EXIT_CODE -eq 0 ]]; then
|
||
# Commands that modify state
|
||
if [[ "$1" =~ ^(apply|destroy|import|refresh|state)$ ]]; then
|
||
echo
|
||
info "Encrypting state files..."
|
||
"$SCRIPT_DIR/tf-encrypt"
|
||
fi
|
||
fi
|
||
|
||
exit $TF_EXIT_CODE
|