Download this file
| 1 | # đŸ¤– Production-facing resources in the AWS account: the fleet-backup bucket |
| 2 | # the router box replicates instance DBs into (all ciphertext — the E2EE rule |
| 3 | # is what makes off-box replication threat-model-free), plus account |
| 4 | # hardening (CloudTrail). Separate state from dev/ so a dev teardown can |
| 5 | # never touch prod backups. |
| 6 | |
| 7 | terraform { |
| 8 | required_version = ">= 1.10" |
| 9 | |
| 10 | required_providers { |
| 11 | aws = { |
| 12 | source = "hashicorp/aws" |
| 13 | version = "~> 6.0" |
| 14 | } |
| 15 | dnsimple = { |
| 16 | source = "dnsimple/dnsimple" |
| 17 | version = "~> 1.0" |
| 18 | } |
| 19 | } |
| 20 | |
| 21 | backend "s3" { |
| 22 | bucket = "eleven-tofu-state-427880590669" |
| 23 | key = "prod/terraform.tfstate" |
| 24 | region = "eu-west-1" |
| 25 | use_lockfile = true |
| 26 | } |
| 27 | } |
| 28 | |
| 29 | provider "aws" { |
| 30 | region = "eu-west-1" |
| 31 | |
| 32 | default_tags { |
| 33 | tags = { |
| 34 | project = "eleven" |
| 35 | env = "prod" |
| 36 | managed = "opentofu" |
| 37 | } |
| 38 | } |
| 39 | } |
| 40 | |
| 41 | data "aws_caller_identity" "current" {} |
| 42 | |
| 43 | locals { |
| 44 | account_id = data.aws_caller_identity.current.account_id |
| 45 | } |
| 46 | |
amadan