infra-as-code

Infrastructure as Code

Canonical infrastructure as code with OpenTofu (the open-source Terraform fork; the binary is tofu). A repository that needs a BSL-licensed feature or employer-mandated HashiCorp Terraform pins terraform in its own mise configuration and documents the deviation.

Defaults

• Default to OpenTofu via mise: opentofu tool, tofu binary; verify provider, backend, state, and language-feature compatibility before a Terraform migration.
• Use the template tasks and hooks: mise.toml exposes the canonical vocabulary per mise — check fans out to format, validate, lint (tflint), scan (trivy), and leaks; lefthook.yml wires the hooks per lefthook.
• Generate docs with terraform-docs: mise run build injects the inputs/outputs table between the TF_DOCS markers in README.md (add them once at scaffold time) per terraform-docs.yml, without cloud access.
• Authenticate without service-account keys: Application Default Credentials locally; Workload Identity Federation in CI per github-actions.

Workflow

1. Resolve the target: identify the root module, backend, workspace (tofu workspace show), cloud project, credentials, and the authorized change scope. A fresh clone runs mise run install first: validation, linting, and tests need tofu init providers and tflint --init rulesets.
2. Edit minimally: change the smallest root module that owns the resource; keep one state per concern (one GCS prefix per small root module: smaller blast radius, faster plans).
3. Check before planning: run mise run check and mise run test; tests stay offline only while every provider is mocked (the starter's mock_provider), otherwise plan-mode tests can authenticate, refresh state, and read data sources. Native tests over tests/*.tftest.hcl use command = plan (main.tftest.hcl); encode "must never happen" rules (public buckets, missing labels) as check:scan trivy findings or plan-test assertions.
4. Plan explicitly: mise run plan writes tmp/plan.tfplan for the selected backend, workspace, and cloud target; feed secrets per State and secrets below. A plan can access APIs, state, and data sources, so keep plan and apply out of automatic gates.
5. Review the plan: read tofu show tmp/plan.tfplan and flag every replacement, destroy, IAM change, and cost-relevant resource before asking for apply authority.
6. Apply the reviewed plan when authorized: tofu apply tmp/plan.tfplan against the same target, then delete the saved plan.
7. Verify: re-read the changed resources and run the same target's plan with its secret inputs, e.g. sops exec-env secrets.enc.env 'tofu plan -input=false -detailed-exitcode'; exit 0 means no remaining drift, 2 means pending changes, 1 is an error.