deployment/check/common/data-model-options.nix

@@ -21,9 +21,5 @@ in
       default = [ ];
       example = "ConnectTimeout=60";
     };
-    httpBackend = mkOption {
-      description = "environment variables to configure the TF HTTP back-end, see <https://developer.hashicorp.com/terraform/language/backend/http#configuration-variables>";
-      type = types.attrsOf (types.either types.str types.int);
-    };
   };
 }

deployment/check/common/data-model.nix

@@ -23,7 +23,6 @@ let
     pathToRoot
     targetSystem
     sshOpts
-    httpBackend
     ;
   inherit (lib) mkOption types;
   eval =
@@ -202,7 +201,7 @@ let
                       inherit sshOpts;
                     };
                     module = self;
-                    inherit args deployment-name httpBackend;
+                    inherit args deployment-name;
                     root-path = pathToRoot;
                   };
                 };

deployment/check/data-model-tf/nixosTest.nix

@@ -8,18 +8,10 @@ let
   inherit (pkgs) system;
   inherit (import ./constants.nix) pathToRoot;
   nodeName = "target";
-  backendPort = builtins.toString 8080;
   deployment-config = {
     inherit nodeName pathToRoot;
     targetSystem = system;
     sshOpts = [ ];
-    httpBackend = rec {
-      TF_HTTP_USERNAME = "basic";
-      TF_HTTP_PASSWORD = "fake-secret";
-      TF_HTTP_ADDRESS = "http://localhost:${backendPort}/state/project1/example";
-      TF_HTTP_LOCK_ADDRESS = TF_HTTP_ADDRESS;
-      TF_HTTP_UNLOCK_ADDRESS = TF_HTTP_ADDRESS;
-    };
   };
   deploy =
     (import ../common/data-model.nix {
@@ -62,8 +54,8 @@ in
       services.terraform-backend = {
         enable = true;
         settings = {
+          LISTEN_ADDR = ":8080";
           KMS_KEY = "l99yC7MhbuuraACQ8bjaU1rMrT6L4PXEYupX6BzhJvY=";
-          LISTEN_ADDR = ":${backendPort}";
         };
       };
     };

deployment/data-model.nix

@@ -222,10 +222,6 @@ let
             description = "The path to the root of the repository.";
             type = types.path;
           };
-          httpBackend = mkOption {
-            description = "environment variables to configure the TF HTTP back-end, see <https://developer.hashicorp.com/terraform/language/backend/http#configuration-variables>";
-            type = types.attrsOf (types.either types.str types.int);
-          };
           run = mkOption {
             type = types.package;
             # error: The option `tf-deployment.tf-host.run' is read-only, but it's set multiple times.
@@ -239,7 +235,6 @@ let
                   args
                   deployment-name
                   root-path
-                  httpBackend
                   ;
                 inherit (ssh)
                   host
@@ -265,7 +260,7 @@ let
                     deployment-type = "tf-host";
                   };
                 };
-                tf-env = pkgs.callPackage ./run/tf-single-host/tf-env.nix { inherit httpBackend; };
+                tf-env = pkgs.callPackage ./run/tf-single-host/tf-env.nix { };
               in
               pkgs.writers.writeBashBin "deploy-tf.sh"
                 (withPackages [
@@ -274,7 +269,6 @@ let
                 ])
                 ''
                   env ${toString (lib.mapAttrsToList (k: v: "TF_VAR_${k}=\"${toBash v}\"") environment)} \
-                  ${toString (lib.mapAttrsToList (k: v: "${k}=\"${toBash v}\"") httpBackend)} \
                   tf_env=${tf-env} bash ./deployment/run/tf-single-host/run.sh
                 '';
           };

deployment/run/tf-setup.nix

@@ -2,20 +2,7 @@
   pkgs,
   lib,
   sources,
-  httpBackend,
 }:
-let
-  toBash =
-    v:
-    lib.replaceStrings [ "\"" ] [ "\\\"" ] (
-      if lib.isPath v || builtins.isNull v then
-        toString v
-      else if lib.isString v then
-        v
-      else
-        lib.strings.toJSON v
-    );
-in
 pkgs.writeScriptBin "setup" ''
   set -e
   # calculated pins
@@ -25,7 +12,5 @@ pkgs.writeScriptBin "setup" ''
   rm -f .terraform.lock.hcl
   # suppress warning on architecture-specific generated lock file:
   # `Warning: Incomplete lock file information for providers`.
-  env TF_HTTP_RETRY_MAX=1 TF_HTTP_RETRY_WAIT_MIN=0 \
-  ${toString (lib.mapAttrsToList (k: v: "${k}=\"${toBash v}\"") httpBackend)} \
   tofu init -input=false 1>/dev/null
 ''

deployment/run/tf-single-host/main.tf

@@ -1,5 +1,11 @@
 terraform {
+  # TODO un-hardcode
   backend "http" {
+    username       = "basic"
+    password       = "fake-secret"
+    address        = "http://localhost:8080/state/project1/example"
+    lock_address   = "http://localhost:8080/state/project1/example"
+    unlock_address = "http://localhost:8080/state/project1/example"
   }
 }
 

deployment/run/tf-single-host/tf-env.nix

@@ -1,7 +1,6 @@
 {
   lib,
   pkgs,
-  httpBackend,
   sources ? import ../../../npins,
 }:
 pkgs.stdenv.mkDerivation {
@@ -11,11 +10,11 @@ pkgs.stdenv.mkDerivation {
     toSource {
       root = ../../../.;
       # don't copy ignored files
-      fileset = gitTracked ../../../.;
+      fileset = intersection (gitTracked ../../../.) ../../../.;
     };
   buildInputs = [
     (pkgs.callPackage ./tf.nix { inherit sources; })
-    (pkgs.callPackage ../tf-setup.nix { inherit sources httpBackend; })
+    (pkgs.callPackage ../tf-setup.nix { inherit sources; })
   ];
   buildPhase = ''
     runHook preBuild