backups: copy the encrypted OpenTofu state off the operator machine #470

Nytt ärende

Öppen

öppnade 2026-09-08 23:04:28 +00:00 av supernaut · 1 kommentar

supernaut kommenterad

2026-09-08 23:04:28 +00:00

Ägare

The OpenTofu state is local and encrypted, and terraform.tfvars is untracked. Both exist only on one machine. scripts/tofu-apply.sh snapshots them locally before every apply, which covers a bad apply but not a lost laptop.

Push each snapshot to the same off-site destinations the backup role uses (they are already ciphertext), or a dedicated bucket, and document the restore path. Depends on the operator machine having the rclone remote configured.

The OpenTofu state is local and encrypted, and `terraform.tfvars` is untracked. Both exist only on one machine. `scripts/tofu-apply.sh` snapshots them locally before every apply, which covers a bad apply but not a lost laptop. Push each snapshot to the same off-site destinations the backup role uses (they are already ciphertext), or a dedicated bucket, and document the restore path. Depends on the operator machine having the rclone remote configured.

supernaut lade till detta till projektet Bitborg Infrastructure

2026-09-08 23:05:07 +00:00

supernaut lade till etiketterna

2026-09-08 23:05:27 +00:00

supernaut refererade till detta ärende

2026-09-08 23:08:43 +00:00

feat(scripts): snapshot opentofu state before and after tofu apply #472

supernaut refererade till detta ärende från bitborg/bitborg-docs