viktor/infra
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 1
infra/state/stacks/iscsi-csi/terraform.tfstate.enc

38 lines
2.4 KiB
Text
Raw Normal View History

state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
{
state: update encrypted terraform state
2026-04-12 13:05:50 +01:00
"version": "ENC[AES256_GCM,data:og==,iv:8b8Res+Y+9wzpOsLRMxSPKDYrQcxzLnJ7GhZ2TaguQA=,tag:p96M2RNaXoW0Kiywn9Mz9A==,type:float]",
"terraform_version": "ENC[AES256_GCM,data:0SNKweE=,iv:uXx9LVYLeVo+pjLniBrthmdOx4tAEWJwpD25xRx+jbM=,tag:p8ynQNWib9tdHsjuv+qe5Q==,type:str]",
"serial": "ENC[AES256_GCM,data:cg==,iv:W0wFhf0DN8b3iUb3RoXPyoNDY/Q3zTyRQV4gVYb4G+A=,tag:6zhAT2OicfWX7Dahb+fmrg==,type:float]",
"lineage": "ENC[AES256_GCM,data:/iOm8tCuhyzkmjFjDTk8EjZ5ORxqYpW00izUjVg/lVBw3y/s,iv:6ai5KnyY2DEo9x0GMUdT/waJkpVSOggIkmOBT64TobA=,tag:zzVm0qWleTp6xzLigRhM3A==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"outputs": {},
state: update encrypted terraform state
2026-04-12 13:05:50 +01:00
"resources": [],
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"check_results": null,
"sops": {
"kms": null,
"gcp_kms": null,
"azure_kv": null,
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"hc_vault": [
{
"vault_address": "https://vault.viktorbarzin.me",
"engine_path": "transit",
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"key_name": "sops-state-iscsi-csi",
state: update encrypted terraform state
2026-04-12 13:05:50 +01:00
"created_at": "2026-04-12T12:05:49Z",
"enc": "vault:v1:Y3p2fIHZhqkFVY0K7BfSYGS329A/cldCbjyjo0OvCh60kD2JqBdTflrI8m5KqaaTSV3gqr7kmZEOaHfW"
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
}
],
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"age": [
{
"recipient": "age1z64h9t3acsm2rr74pz7j4846kwj5tutx9sk78jqv46y8fln4vs2sy920ce",
state: update encrypted terraform state
2026-04-12 13:05:50 +01:00
"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB5YjRPQWRjS2V0ZG9wRkNv\nNElmT0h5VXU4c3Y3d2FEdFVlRW9acE1LWURRCk5ZOGpaY1d1WXZqY1pDbUpwMHY1\nb1VnZE5XTStLMzVSRldJVTFUcTRib2sKLS0tIHFqZnkreFEwVk9iSE4rWndnWkZQ\nbDVOVFVsR2duSXFPbk5uc1o0b0FkenMKR5pqKF7Lce9KRsNCXkgyhG8Gvq4U7sUQ\nCQZastYCJA/GLtlrjjw+mB8pN2MqhssvU/UASJwMTCLdGOl44yElSQ==\n-----END AGE ENCRYPTED FILE-----\n"
state: add devvm as SOPS recipient Add devvm age public key to .sops.yaml and re-encrypt all 101 state files with both laptop and devvm keys.
2026-03-17 22:41:19 +00:00
},
{
"recipient": "age1rekkad48r2wzhwqgfetw5yugu3ln3qlht4xg3txmx55tee8cveess60r90",
state: update encrypted terraform state
2026-04-12 13:05:50 +01:00
"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB6VEJrZHFsR3Z1SnduTWVn\nVWxQWWc3NVI3U3ptbjE1ODJuWlpDOVdCSEdrCmo0MVhIWSs3dm1sOEZwSUc2a0RI\ncmo3a0dQNjBFS2ZkMnNkLy9PMjRYOHcKLS0tIDZWRnJ5cDdUWkZvVTdSUnFXQWhO\ncDlCbkdqQ0NMbE82MjJMVFBkUXBZUkkK9Z5CMkLhUxwUp0ZrGDwKmy6l3Wm4IiTS\nRcS+FjVXTlUPNKYhLlHEsO9PS7rnC6Bsk+XZqyPB3RwubpnWsHwlPg==\n-----END AGE ENCRYPTED FILE-----\n"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
],
state: update encrypted terraform state
2026-04-12 13:05:50 +01:00
"lastmodified": "2026-04-12T12:05:49Z",
"mac": "ENC[AES256_GCM,data:fJC5M2wTOsb3VoqEe0pNhfLDOsWkG9nxqT+uNSlBrqAJJNfy5WLoyWEV27NQAk2mhIcAbMr9WZt40dz5O3DNH54GoSrra5m3rgScWk9ac3ZN4/62xA5+trcVORgvYjwNEP/w7iZbxsSfIP0hLuJ5QceGVQWxmy5tLqvdlxoi9d0=,iv:NX6SnyWcJIpv1YzcuVkZ17OhH5s1MO95Vq7+PskDjvM=,tag:tsm/r9Tn9BXmx2Rgnh/WeQ==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"pgp": null,
"unencrypted_suffix": "_unencrypted",
"version": "3.9.4"
}
}
Reference in a new issue Copy permalink