tofu.env

# tofu.env - source this from the repo root before any tofu command.

# Everything below is cwd-relative on purpose: tofu itself must run from the
# repo root anyway, so sourcing from anywhere else fails loudly here instead
# of half-working.
if [ ! -f secrets.enc.json ]; then
  echo "tofu.env: source this from the repo root (no secrets.enc.json in $PWD)" >&2
  return 1 2>/dev/null || exit 1
fi

# Assign before exporting: `export VAR=$(cmd)` reports export's exit status,
# not cmd's, so a failed decrypt would silently export an empty passphrase.
_tofu_env_passphrase="$(sops -d --extract '["state"]["passphrase"]' secrets.enc.json)" || {
  echo "tofu.env: sops decryption failed; is the age key at ~/.config/sops/age/keys.txt?" >&2
  unset _tofu_env_passphrase
  return 1 2>/dev/null || exit 1
}
if [ -z "$_tofu_env_passphrase" ]; then
  echo "tofu.env: sops returned an empty passphrase" >&2
  unset _tofu_env_passphrase
  return 1 2>/dev/null || exit 1
fi
export TF_VAR_state_passphrase="$_tofu_env_passphrase"
unset _tofu_env_passphrase

# Rotation slot: a placeholder outside rotation windows, the pre-rotation
# passphrase during one. See README.md, "Rotating the state passphrase".
_tofu_env_previous="$(sops -d --extract '["state"]["passphrase_previous"]' secrets.enc.json)" || {
  echo "tofu.env: sops decryption of passphrase_previous failed" >&2
  unset _tofu_env_previous
  return 1 2>/dev/null || exit 1
}
if [ -z "$_tofu_env_previous" ]; then
  echo "tofu.env: sops returned an empty passphrase_previous" >&2
  unset _tofu_env_previous
  return 1 2>/dev/null || exit 1
fi
export TF_VAR_state_passphrase_previous="$_tofu_env_previous"
unset _tofu_env_previous

mkdir -p logs
# Keep this at INFO: at DEBUG/TRACE the provider logs full HTTP bodies - the
# API token and rendered user-data - into the log file.
export TF_LOG=INFO
export TF_LOG_PATH="$PWD/logs/tofu.log"

# Layer 2: lets ansible-playbook/ansible-inventory run from the repo root
# without -i or cwd tricks (ANSIBLE_CONFIG outranks cwd-based discovery).
export ANSIBLE_CONFIG="$PWD/ansible/ansible.cfg"

# The only place collections are read from - scripts/install-collections.sh
# writes here, every ansible command reads here, and CI names the same path in
# its job env: block. Singular _PATH: ansible-compat hard errors on the plural
# ANSIBLE_COLLECTIONS_PATHS, and ansible-lint runs through ansible-compat.
#
# Under .venv/ deliberately: recreating the venv takes the collections with it,
# so a rebuilt environment can never keep serving a stale set. Setting this
# also *replaces* ansible's defaults (~/.ansible/collections and
# /usr/share/ansible/collections), which is the point - what is not pinned in
# ansible/requirements.yml must not resolve here either.
export ANSIBLE_COLLECTIONS_PATH="$PWD/.venv/share/ansible/collections"

# Activate Python venv for ansible
if [ -f "$PWD/.venv/bin/activate" ]; then
  source "$PWD/.venv/bin/activate"
else
  echo "Python venv not found! See README"
fi