Repository navigation
feat: scaffold terraform layout, CI, and perish.dev zone import - #2
Merged
Merged
Conversation
Per the design in docs/secrets.md, docs/state.md, and docs/ci.md, lay
down the directory shape the first real resources will fill:
- terraform/cloudflare/ — single HCP workspace (we manage one apex
domain in one Cloudflare account, so per-env split is premature).
Declares the cloud {} block and cloudflare/cloudflare v5 provider
with sensitive variables HCP supplies at run time.
- terraform/github/ — single workspace for the org; uses the
integrations/github v6 provider with GitHub App auth.
- Makefile — fmt / fmt-check / init / validate / plan targets that
fan out across every leaf with a versions.tf.
- terraform/README.md — explains the workspace-per-leaf convention,
why there is no per-environment split yet, and the procedure for
adding new workspaces.
No real resources yet. terraform validate should pass once HCP
workspaces are created and tokens are wired up.
GitHub Actions workflow that runs on every PR (including from forks) and on pushes to main: - fmt job: terraform fmt -check -recursive across terraform/. - validate job: matrix over each leaf dir, runs terraform init with -backend=false (no HCP auth, no state access) then terraform validate. No secrets are referenced. Real plans and applies run in HCP Terraform via its VCS integration, not from this workflow — keeping the trust boundary clean per docs/ci.md.
- terraform/cloudflare/main.tf: add locals for domain, account_id, and zone_id (non-credentials, safe to commit per docs/secrets.md), an import block for the existing zone, and the cloudflare_zone resource it imports into. - terraform/cloudflare/variables.tf: drop cloudflare_account_id var; the value lives in locals now. - scripts/cf_discover.py: uv-runnable Python script that lists DNS records, Workers scripts and routes, R2 buckets, and Pages projects via the Cloudflare API and emits matching import blocks + resource stubs to terraform/cloudflare/generated.tf. Re-runnable; commit its output and review the diff. Code is speculative until HCP Terraform is set up — see docs/setup.md (added in a follow-up commit).
Step-by-step out-of-band setup that has to happen before any of the Terraform code in this repo can actually run: HCP org/workspaces, Cloudflare API token with the scopes cf_discover.py needs, GitHub App creation and installation, local terraform login, and finally the cf_discover import flow.
The hand-rolled discovery script duplicated Cloudflare's own cf-terraforming CLI without matching its coverage or upkeep. Delete it and document cf-terraforming instead: - docs/import.md: runbook for cf-terraforming v0.27 — install, generate HCL, emit modern import blocks, verify the plan. Lists what's supported in the v5 provider (DNS records, R2 buckets, Pages projects, KV namespaces) and what's intentionally out of scope (Workers script content — lives in the app repo, not here). - docs/setup.md: step 7 now points at import.md instead of the script. - terraform/cloudflare/main.tf: comment references cf-terraforming instead of the deleted script. Saves us from maintaining a parallel import tool that would lag every provider release.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Implements the contracts merged in #1.
Branched off #1 and stacked on it. Merge #1 first.
Test plan