fb53b81a93
- Add terragrunt-apply step to Argo CI pipeline (plan+apply on main push when infra/live/ or infra/modules/ change) - Bake OpenTofu 1.9.0 + Terragrunt 0.77.12 into ci-builder-cpu image with SHA256 checksum verification - Remove 3 ghost node pools (foxhunt, gitlab, h100-sxm8) from kapsule module to match Scaleway reality - Make terragrunt.hcl single source of truth (remove variable defaults) - Fix GitLab TF state lock methods (POST/DELETE for HTTP backend) - Harden PAT rotation: more retries, verification step, recovery docs - Add weekly PAT expiry check CronJob (warns 14 days before expiry) Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
61 lines
1.8 KiB
HCL
61 lines
1.8 KiB
HCL
# Root Terragrunt config for foxhunt production
|
|
# All child modules inherit provider, backend, and common inputs from here.
|
|
|
|
locals {
|
|
region = "fr-par"
|
|
zone = "fr-par-2"
|
|
project_id = get_env("SCW_DEFAULT_PROJECT_ID")
|
|
}
|
|
|
|
# Remote state in GitLab Terraform state backend (project root/foxhunt, ID=1)
|
|
# Token stored in k8s secret gitlab-terraform-state-token
|
|
# Set TF_HTTP_USERNAME and TF_HTTP_PASSWORD env vars before running terragrunt.
|
|
remote_state {
|
|
backend = "http"
|
|
generate = {
|
|
path = "backend.tf"
|
|
if_exists = "overwrite"
|
|
}
|
|
config = {
|
|
address = "${get_env("GITLAB_TF_STATE_URL", "https://tf.fxhnt.ai")}/api/v4/projects/1/terraform/state/${path_relative_to_include()}"
|
|
lock_address = "${get_env("GITLAB_TF_STATE_URL", "https://tf.fxhnt.ai")}/api/v4/projects/1/terraform/state/${path_relative_to_include()}/lock"
|
|
unlock_address = "${get_env("GITLAB_TF_STATE_URL", "https://tf.fxhnt.ai")}/api/v4/projects/1/terraform/state/${path_relative_to_include()}/lock"
|
|
lock_method = "POST"
|
|
unlock_method = "DELETE"
|
|
}
|
|
}
|
|
|
|
# Generate provider config for all child modules
|
|
generate "provider" {
|
|
path = "provider.tf"
|
|
if_exists = "overwrite"
|
|
contents = <<-EOF
|
|
terraform {
|
|
required_version = ">= 1.8.0"
|
|
required_providers {
|
|
scaleway = {
|
|
source = "scaleway/scaleway"
|
|
version = "~> 2.46"
|
|
}
|
|
random = {
|
|
source = "hashicorp/random"
|
|
version = "~> 3.6"
|
|
}
|
|
}
|
|
}
|
|
|
|
provider "scaleway" {
|
|
region = "${local.region}"
|
|
zone = "${local.zone}"
|
|
project_id = "${local.project_id}"
|
|
}
|
|
EOF
|
|
}
|
|
|
|
# Common inputs available to all child modules
|
|
inputs = {
|
|
region = local.region
|
|
zone = local.zone
|
|
project_id = local.project_id
|
|
}
|