Hybrid cloud cluster monorepo with Ansible, K8s, NixOS, and Terraform.
cute.haus
ansible
terraform
nix
k8s
terraform: move to b2
Aly Raffauf
(May 14, 2026, 1:09 PM EDT)
f2dead9e
74da7c1a
+39
-1
+4
.envrc
+4
.envrc
···
14
14
15
15
export_sops_secret CLOUDFLARE_API_TOKEN secrets/cloudflare.yaml '["api_token"]'
16
16
export_sops_secret HCLOUD_TOKEN secrets/hetzner.yaml '["api_token"]'
17
+
18
+
# Terraform's s3 backend (pointing at B2) reads these.
19
+
export_sops_secret AWS_ACCESS_KEY_ID secrets/b2.yaml '["B2_KEY_ID"]'
20
+
export_sops_secret AWS_SECRET_ACCESS_KEY secrets/b2.yaml '["B2_APP_KEY"]'
+8
.gitignore
+8
.gitignore
···
11
11
12
12
# Bun deps for scripts/ (regenerated by `bun install`)
13
13
scripts/node_modules/
14
+
15
+
# Terraform state lives in B2 (aly-backups/cute.haus/terraform/), but the
16
+
# local cache + plan files can still appear in this directory.
17
+
terraform/.terraform/
18
+
terraform/.terraform.lock.hcl
19
+
terraform/*.tfstate
20
+
terraform/*.tfstate.*
21
+
terraform/*.tfplan
+27
-1
terraform/providers.tf
+27
-1
terraform/providers.tf
···
1
1
terraform {
2
-
required_version = ">= 1.5"
2
+
required_version = ">= 1.10"
3
3
4
4
required_providers {
5
5
cloudflare = {
···
10
10
source = "hetznercloud/hcloud"
11
11
version = "~> 1.48"
12
12
}
13
+
}
14
+
15
+
# State in B2 alongside CNPG + Longhorn backups. Auth via AWS_ACCESS_KEY_ID /
16
+
# AWS_SECRET_ACCESS_KEY (B2 application key in secrets/b2.yaml). Bucket has
17
+
# versioning enabled, so state history is recoverable from B2 if a bad apply
18
+
# corrupts it.
19
+
#
20
+
# No state locking: B2's S3 API at us-east-005 doesn't honor the
21
+
# If-None-Match conditional-PUT header that terraform's use_lockfile uses
22
+
# (501 NotImplemented). DynamoDB-based locking is overkill for single-user
23
+
# operation; the discipline is "don't run terraform from two places at once."
24
+
backend "s3" {
25
+
bucket = "aly-backups"
26
+
key = "cute.haus/terraform/terraform.tfstate"
27
+
region = "us-east-005"
28
+
29
+
endpoints = {
30
+
s3 = "https://s3.us-east-005.backblazeb2.com"
31
+
}
32
+
33
+
skip_credentials_validation = true
34
+
skip_metadata_api_check = true
35
+
skip_region_validation = true
36
+
skip_requesting_account_id = true
37
+
use_path_style = true
38
+
skip_s3_checksum = true
13
39
}
14
40
}
15
41