Move OpenTofu state to sovereign Garage backend

founder commented

2026-07-26 02:58:15 +00:00

Owner

cloud-tofu could not apply since AWS 642524882698 closed (403 + Fil-C signing-helper crash). Backend now targets forge Garage: path-style + skip AWS probes, encrypt=false, use_lockfile retained (Garage supports S3 conditional writes — verified), creds from secrets/hetzner/object-storage.age. Verified on forge: init + locked plan succeed. 🤖 Generated with Claude Code

cloud-tofu could not apply since AWS 642524882698 closed (403 + Fil-C signing-helper crash). Backend now targets forge Garage: path-style + skip AWS probes, encrypt=false, use_lockfile retained (Garage supports S3 conditional writes — verified), creds from secrets/hetzner/object-storage.age. Verified on forge: init + locked plan succeed. 🤖 Generated with [Claude Code](https://claude.com/claude-code)

founder added 1 commit

2026-07-26 02:58:15 +00:00

tofu: move state to sovereign Garage backend off the closed AWS account

Release: If Needed / Check (Release Needed) (push) Successful in 6s

Details

Infra: Cloud OpenTofu / Infra (Cloud OpenTofu) (push) Successful in 57s

Details

Release: Signing Preflight / Release (Signing Preflight) (push) Successful in 1m11s

Details

Deploy: API / Deploy (API) (push) Has been cancelled

Details

Deploy: Web / Deploy (Web) (push) Has been cancelled

Details

c2a374078a

cloud-tofu has been unable to apply anything since AWS account 642524882698
was closed: the S3 state backend returned 403 (account isolated or terminated)
and the RolesAnywhere credential step crashed in the Fil-C signing helper
before OpenTofu started. That account is closed permanently (~2026-08-15), so
the old state is gone and no stack was reconcilable.

Point the backend at the forge Garage blob plane instead:
- materialize_backend now emits Garage-compatible S3 settings: path-style
  addressing plus skip_credentials_validation/region_validation/
  metadata_api_check/requesting_account_id, since Garage is S3-compatible but
  not AWS and the probes otherwise abort init. encrypt=false because Garage
  does not implement AWS SSE; the bucket is forge-local and mirrored.
- use_lockfile stays: verified Garage supports the S3 conditional writes it
  needs, so state locking works without DynamoDB.
- The credential step decrypts the Garage keys from
  secrets/hetzner/object-storage.age instead of minting dead-account AWS
  credentials.
- OPENTOFU_STATE_ENDPOINT defaults to the internal endpoint so state traffic
  from forge-local runners stays off the public network.

Verified on the forge: tofu init and a locked plan both succeed against
Garage. State is recreated per stack by import, since the old state was lost
with the account.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

founder requested reviews from agent, billing, ios, web, infra, release-runner, manager, security-agent, assistant, linux, forge, windows, android, devex, cmo, cdo, runner

2026-07-26 02:58:15 +00:00

founder merged commit c2a374078a into main

2026-07-26 02:58:18 +00:00

Rows
Columns

Move OpenTofu state to sovereign Garage backend #10