Hybrid cloud cluster monorepo with Ansible, K8s, NixOS, and Terraform.
cute.haus
ansible
terraform
nix
k8s
terraform: add b2
Aly Raffauf
(May 27, 2026, 5:23 PM EDT)
149a7afa
4aeed0aa
+206
+4
.envrc
+4
.envrc
···
18
18
# Terraform's s3 backend (pointing at B2) reads these.
19
19
export_sops_secret AWS_ACCESS_KEY_ID secrets/b2.yaml '["B2_KEY_ID"]'
20
20
export_sops_secret AWS_SECRET_ACCESS_KEY secrets/b2.yaml '["B2_APP_KEY"]'
21
+
22
+
# B2 native provider reads these.
23
+
export_sops_secret B2_APPLICATION_KEY_ID secrets/b2.yaml '["B2_KEY_ID"]'
24
+
export_sops_secret B2_APPLICATION_KEY secrets/b2.yaml '["B2_APP_KEY"]'
+13
terraform/.terraform.lock.hcl
+13
terraform/.terraform.lock.hcl
···
1
1
# This file is maintained automatically by "terraform init".
2
2
# Manual edits may be lost in future updates.
3
3
4
+
provider "registry.terraform.io/backblaze/b2" {
5
+
version = "0.12.1"
6
+
constraints = "~> 0.12"
7
+
hashes = [
8
+
"h1:Z+NjSzzoCP7A8p65qGab43e6fGQFsuoet2ghAPs4Emg=",
9
+
"zh:4c7a3832f94bb2e46af0ce557bfee4227d4c94c7d626a243fdc58a48268b66ba",
10
+
"zh:58279e49cb9d350b00670c16a7c15ee6f4c2b7b935f25240f490599da6ca674e",
11
+
"zh:931bf63adae2b26ebac5794096c625aa2989fb5b39fa67f2f023efbc6e2946d5",
12
+
"zh:b7290453def715d49723d70f7e3047651229f45f57ab56975261e6867378c150",
13
+
"zh:c675c7be91214dc02193c0cb649022923648fbf768358738091dfa68d92e4ea5",
14
+
]
15
+
}
16
+
4
17
provider "registry.terraform.io/cloudflare/cloudflare" {
5
18
version = "5.19.1"
6
19
constraints = "~> 5.0"
+181
terraform/b2_buckets.tf
+181
terraform/b2_buckets.tf
···
1
+
resource "b2_bucket" "aly_anime" {
2
+
bucket_name = "aly-anime"
3
+
bucket_type = "allPrivate"
4
+
default_server_side_encryption {
5
+
mode = "SSE-B2"
6
+
algorithm = "AES256"
7
+
}
8
+
lifecycle_rules {
9
+
days_from_hiding_to_deleting = 7
10
+
file_name_prefix = ""
11
+
}
12
+
}
13
+
14
+
resource "b2_bucket" "aly_apps" {
15
+
bucket_name = "aly-apps"
16
+
bucket_type = "allPrivate"
17
+
default_server_side_encryption {
18
+
mode = "SSE-B2"
19
+
algorithm = "AES256"
20
+
}
21
+
lifecycle_rules {
22
+
days_from_hiding_to_deleting = 7
23
+
file_name_prefix = ""
24
+
}
25
+
}
26
+
27
+
resource "b2_bucket" "aly_archive" {
28
+
bucket_name = "aly-archive"
29
+
bucket_type = "allPrivate"
30
+
default_server_side_encryption {
31
+
mode = "SSE-B2"
32
+
algorithm = "AES256"
33
+
}
34
+
lifecycle_rules {
35
+
days_from_hiding_to_deleting = 60
36
+
file_name_prefix = ""
37
+
}
38
+
}
39
+
40
+
resource "b2_bucket" "aly_audiobooks" {
41
+
bucket_name = "aly-audiobooks"
42
+
bucket_type = "allPrivate"
43
+
default_server_side_encryption {
44
+
mode = "SSE-B2"
45
+
algorithm = "AES256"
46
+
}
47
+
lifecycle_rules {
48
+
days_from_hiding_to_deleting = 7
49
+
file_name_prefix = ""
50
+
}
51
+
}
52
+
53
+
resource "b2_bucket" "aly_backups" {
54
+
bucket_name = "aly-backups"
55
+
bucket_type = "allPrivate"
56
+
default_server_side_encryption {
57
+
mode = "SSE-B2"
58
+
algorithm = "AES256"
59
+
}
60
+
lifecycle_rules {
61
+
days_from_hiding_to_deleting = 7
62
+
file_name_prefix = ""
63
+
}
64
+
}
65
+
66
+
resource "b2_bucket" "aly_camera" {
67
+
bucket_name = "aly-camera"
68
+
bucket_type = "allPrivate"
69
+
default_server_side_encryption {
70
+
mode = "SSE-B2"
71
+
algorithm = "AES256"
72
+
}
73
+
lifecycle_rules {
74
+
days_from_hiding_to_deleting = 7
75
+
file_name_prefix = ""
76
+
}
77
+
}
78
+
79
+
resource "b2_bucket" "aly_code" {
80
+
bucket_name = "aly-code"
81
+
bucket_type = "allPrivate"
82
+
default_server_side_encryption {
83
+
mode = "SSE-B2"
84
+
algorithm = "AES256"
85
+
}
86
+
lifecycle_rules {
87
+
days_from_hiding_to_deleting = 7
88
+
file_name_prefix = ""
89
+
}
90
+
}
91
+
92
+
resource "b2_bucket" "aly_forgejo" {
93
+
bucket_name = "aly-forgejo"
94
+
bucket_type = "allPrivate"
95
+
default_server_side_encryption {
96
+
mode = "SSE-B2"
97
+
algorithm = "AES256"
98
+
}
99
+
lifecycle_rules {
100
+
days_from_hiding_to_deleting = 1
101
+
file_name_prefix = ""
102
+
}
103
+
}
104
+
105
+
resource "b2_bucket" "aly_movies" {
106
+
bucket_name = "aly-movies"
107
+
bucket_type = "allPrivate"
108
+
default_server_side_encryption {
109
+
mode = "SSE-B2"
110
+
algorithm = "AES256"
111
+
}
112
+
lifecycle_rules {
113
+
days_from_hiding_to_deleting = 7
114
+
file_name_prefix = ""
115
+
}
116
+
}
117
+
118
+
resource "b2_bucket" "aly_music" {
119
+
bucket_name = "aly-music"
120
+
bucket_type = "allPrivate"
121
+
default_server_side_encryption {
122
+
mode = "SSE-B2"
123
+
algorithm = "AES256"
124
+
}
125
+
lifecycle_rules {
126
+
days_from_hiding_to_deleting = 3
127
+
file_name_prefix = ""
128
+
}
129
+
}
130
+
131
+
resource "b2_bucket" "aly_outline" {
132
+
bucket_name = "aly-outline"
133
+
bucket_type = "allPrivate"
134
+
default_server_side_encryption {
135
+
mode = "SSE-B2"
136
+
algorithm = "AES256"
137
+
}
138
+
lifecycle_rules {
139
+
days_from_hiding_to_deleting = 7
140
+
file_name_prefix = ""
141
+
}
142
+
}
143
+
144
+
resource "b2_bucket" "aly_shows" {
145
+
bucket_name = "aly-shows"
146
+
bucket_type = "allPrivate"
147
+
default_server_side_encryption {
148
+
mode = "SSE-B2"
149
+
algorithm = "AES256"
150
+
}
151
+
lifecycle_rules {
152
+
days_from_hiding_to_deleting = 7
153
+
file_name_prefix = ""
154
+
}
155
+
}
156
+
157
+
resource "b2_bucket" "aly_sync" {
158
+
bucket_name = "aly-sync"
159
+
bucket_type = "allPrivate"
160
+
default_server_side_encryption {
161
+
mode = "SSE-B2"
162
+
algorithm = "AES256"
163
+
}
164
+
lifecycle_rules {
165
+
days_from_hiding_to_deleting = 7
166
+
file_name_prefix = ""
167
+
}
168
+
}
169
+
170
+
resource "b2_bucket" "aly_tranquil_blobs" {
171
+
bucket_name = "aly-tranquil-blobs"
172
+
bucket_type = "allPrivate"
173
+
default_server_side_encryption {
174
+
mode = "SSE-B2"
175
+
algorithm = "AES256"
176
+
}
177
+
lifecycle_rules {
178
+
days_from_hiding_to_deleting = 7
179
+
file_name_prefix = ""
180
+
}
181
+
}
+8
terraform/providers.tf
+8
terraform/providers.tf
···
2
2
required_version = ">= 1.10"
3
3
4
4
required_providers {
5
+
b2 = {
6
+
source = "Backblaze/b2"
7
+
version = "~> 0.12"
8
+
}
5
9
cloudflare = {
6
10
source = "cloudflare/cloudflare"
7
11
version = "~> 5.0"
···
41
45
42
46
provider "cloudflare" {
43
47
# Reads CLOUDFLARE_API_TOKEN from the environment.
48
+
}
49
+
50
+
provider "b2" {
51
+
# Reads B2_APPLICATION_KEY_ID and B2_APPLICATION_KEY from the environment.
44
52
}
45
53
46
54
provider "hcloud" {