add terraform-backend host to hosting-provider #882

Merged

kiara merged 2 commits from kiara/fediversity:dev-terraform-backend into main 2026-05-05 21:31:42 +02:00

Conversation 0 Commits 2 Files changed 9 +140 -9

kiara commented 2026-05-01 19:54:36 +02:00

Owner

Copy link

Adds a long-running shared terraform-backend (nimbolus) deployed via the dev-CD path so production TF deployments can point at it as their state HTTP backend, as used in the tests.

part of #515.

note that this still hard-codes various values, raising bootstrapping questions if infra like this was intended to hold such state (along with openbao, see #493).

bootstrap layering: seed → openbao-via-dev → SPIRE → workloads

Track the dependency chain that lets us remove deployment-specific data (e.g. KMS_KEY_FILE, agenix recipients) from the codebase.

Layering

1. Seed state via examples/hosting-env-config.nix (gitignorable). Schema gains a bootstrap/seed sub-attrset, explicitly marked bootstrap-only so we can audit which entries are still load-bearing as we climb the ladder. Prefer derived sources (TPM-sealed, generated-on-first-boot) where possible so seed entries stay minimal.
2. openbao: Its unseal key is the one irreducible seed entry until TPM-sealed auto-unseal is wired.
3. SPIRE issues workload identity to services on dev/operator hosts.
4. Workloads (terraform-backend KMS, panel secrets, forgejo-runner tokens, …) source secrets from openbao via SPIRE-attested identity. Self-heal on first run: migrate any seed-supplied secret into openbao, after which the seed entry becomes vestigial and removable.

Concrete follow-ups blocked on this

• #882 terraform-backend: drop KMS_KEY_FILE once openbao KMS is reachable (related: #515, #493).
• agenix usage in repo: replace with SPIRE+openbao retrieval so external teams can deploy without owning Fediversity-team recipients.

Out of scope here

Implementation of any single layer — this issue only captures the chain so each piece has a documented predecessor.

Adds a long-running shared `terraform-backend` (nimbolus) deployed via the dev-CD path so production TF deployments can point at it as their state HTTP backend, as used in the tests. part of #515. note that this still hard-codes various values, raising bootstrapping questions if infra like this was intended to hold such state (along with openbao, see #493). <details> <summary> bootstrap layering: seed → openbao-via-dev → SPIRE → workloads </summary> Track the dependency chain that lets us remove deployment-specific data (e.g. `KMS_KEY_FILE`, agenix recipients) from the codebase. ## Layering 1. **Seed state** via `examples/hosting-env-config.nix` (gitignorable). Schema gains a `bootstrap`/`seed` sub-attrset, explicitly marked bootstrap-only so we can audit which entries are still load-bearing as we climb the ladder. Prefer derived sources (TPM-sealed, generated-on-first-boot) where possible so seed entries stay minimal. 2. **openbao**: Its unseal key is the one irreducible seed entry until TPM-sealed auto-unseal is wired. 3. **SPIRE** issues workload identity to services on dev/operator hosts. 4. **Workloads** (terraform-backend KMS, panel secrets, forgejo-runner tokens, …) source secrets from openbao via SPIRE-attested identity. Self-heal on first run: migrate any seed-supplied secret into openbao, after which the seed entry becomes vestigial and removable. ## Concrete follow-ups blocked on this - #882 terraform-backend: drop `KMS_KEY_FILE` once openbao KMS is reachable (related: #515, #493). - agenix usage in repo: replace with SPIRE+openbao retrieval so external teams can deploy without owning Fediversity-team recipients. ## Out of scope here Implementation of any single layer — this issue only captures the chain so each piece has a documented predecessor. </details>

kiara force-pushed dev-terraform-backend from 56158c1fca to 14385b8b6f 2026-05-01 21:50:37 +02:00 Compare

kiara force-pushed dev-terraform-backend from 14385b8b6f to 371b99f14c 2026-05-05 19:51:28 +02:00 Compare

kiara added 1 commit 2026-05-05 20:16:39 +02:00

decouple cd-paths from dev to extend to hosting-provider ... 0aee824e8b

Signed-off-by: Kiara Grouwstra <kiara@procolix.eu>

kiara changed title from WIP: add terraform-backend dev host to add terraform-backend dev host 2026-05-05 21:30:58 +02:00

kiara requested review from developers 2026-05-05 21:30:58 +02:00

kiara changed title from add terraform-backend dev host to add terraform-backend host to hosting-provider 2026-05-05 21:31:33 +02:00

kiara merged commit 805b8e7d44 into main 2026-05-05 21:31:42 +02:00

kiara referenced this pull request from a commit 2026-05-05 21:31:42 +02:00

add `terraform-backend` host to `hosting-provider` (#882)

kiara referenced this pull request 2026-05-06 13:57:50 +02:00

reproducible project infrastructure #336

kiara referenced this pull request 2026-07-01 23:22:07 +02:00

Graceful fresh-provider bootstrap ladder (#336, #882) #1172

kiara referenced this pull request from a commit 2026-07-05 09:31:18 +02:00

Graceful fresh-provider bootstrap ladder (#336, #882) (#1172)

Sign in to join this conversation.

Reviewers

No reviewers

fediversity/developers

Labels

Clear labels   

ambition

application-offering

  

ambition

configure-applications

  

ambition

front-end

  

ambition/install-applications

  

ambition

security

  

ambition

switch-host

  

ambition

update-applications

  

ambition

user-management

  

blocked

  

component

api-service

features related to the API service

  

component

fediversity-panel

  

component

nixops4

  

documentation

  

points

0

fibonacci complexity: 0 points

  

points

0.5

fibonacci complexity: 0.5 points

  

points

1

fibonacci complexity: 1 point

  

points

13

fibonacci complexity: 13 points

  

points

2

fibonacci complexity: 2 points

  

points

21

fibonacci complexity: 21 points

  

points

3

fibonacci complexity: 3 points

  

points

34

fibonacci complexity: 34 points

  

points

5

fibonacci complexity: 5 points

  

points

55

fibonacci complexity: 55 points

  

points

8

fibonacci complexity: 8 points

  

points

infinite

fibonacci complexity: infinite points

  

productisation

features out-scoped with the decoupling of the productisation effort

  

project-management

Project management related tasks

  

question

  

role

application-developer

  

role

application-operator

  

role

hosting-provider

  

role

maintainer

  

security

  

technical debt

  

testing

  

type

bug

Anything that doesn't work as advertised

  

type

deliverable

  

type

key-result

  

type

objective

  

type

task

  

type

unclear

  

type

user-story

  

user experience

No labels

ambition

application-offering

ambition

configure-applications

ambition

front-end

ambition/install-applications

ambition

security

ambition

switch-host

ambition

update-applications

ambition

user-management

blocked

component

api-service

component

fediversity-panel

component

nixops4

documentation

points

0

points

0.5

points

1

points

13

points

2

points

21

points

3

points

34

points

5

points

55

points

8

points

infinite

productisation

project-management

question

role

application-developer

role

application-operator

role

hosting-provider

role

maintainer

security

technical debt

testing

type

bug

type

deliverable

type

key-result

type

objective

type

task

type

unclear

type

user-story

user experience

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

1 participant

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

fediversity/fediversity!882

No description provided.