9109712b59
SOPS State Management: - Implemented Git + SOPS + age encryption for Terraform state files - Added .gitignore files to prevent committing unencrypted secrets - Created .sops.yaml.example template for age encryption configuration - Created helper scripts for automated encryption/decryption workflow: - scripts/tf: Wrapper script with auto-encrypt/decrypt - scripts/tf-encrypt: Manual encryption of state files - scripts/tf-decrypt: Manual decryption of state files - Added comprehensive STATE_MANAGEMENT.md documentation covering: - Installation of age and SOPS - Initial setup and key generation - Daily workflow examples - Security best practices - Troubleshooting common issues - Multi-user key management - Backup strategies Terraform Deployment Fixes: - Added snippets_storage variable for cloud-init snippet storage - Fixed datastore error: "local" does not support snippets - Updated README with solutions for datastore and SSH issues - Added troubleshooting for: - Enabling snippets on existing storage (pvesm set) - Creating dedicated directory storage for snippets - SSH authentication setup with ssh-agent - Manual cloud-init snippet creation workaround Files modified: - terraform/proxmox-examples/docker-host/main.tf - terraform/proxmox-examples/docker-host/variables.tf - terraform/proxmox-examples/docker-host/terraform.tfvars.example - terraform/proxmox-examples/docker-host/README.md Files added: - .gitignore (root level) - terraform/proxmox-examples/docker-host/.gitignore - terraform/proxmox-examples/docker-host/.sops.yaml.example - terraform/proxmox-examples/docker-host/STATE_MANAGEMENT.md - terraform/proxmox-examples/docker-host/scripts/tf - terraform/proxmox-examples/docker-host/scripts/tf-encrypt - terraform/proxmox-examples/docker-host/scripts/tf-decrypt
34 lines
517 B
Text
34 lines
517 B
Text
# Terraform state files (unencrypted)
|
|
*.tfstate
|
|
*.tfstate.backup
|
|
*.tfstate.*.backup
|
|
|
|
# Keep encrypted state files
|
|
!*.tfstate.enc
|
|
|
|
# Terraform directory
|
|
.terraform/
|
|
.terraform.lock.hcl
|
|
|
|
# SOPS configuration with your private key
|
|
.sops.yaml
|
|
|
|
# Actual terraform.tfvars (may contain secrets)
|
|
terraform.tfvars
|
|
|
|
# Keep encrypted version
|
|
!terraform.tfvars.enc
|
|
|
|
# Crash logs
|
|
crash.log
|
|
crash.*.log
|
|
|
|
# Override files
|
|
override.tf
|
|
override.tf.json
|
|
*_override.tf
|
|
*_override.tf.json
|
|
|
|
# Terraform RC files
|
|
.terraformrc
|
|
terraform.rc
|