🤖 infra/ — the Eleven Cloud IaC skeleton

OpenTofu for the AWS side of the planet-scale plan (issue #550). This layer manages the static skeleton only — buckets, IAM, and (later) VPC/NLB/ASG. All intelligence lives in the lchat binary; the boundary test from the plan holds for every change here: if the IaC needs to know an instance hostname, the design is wrong.

Environments

• dev/ — the proof-of-concept environment in the dev account (427880590669, eu-west-1, AWS profile eleven-dev). Test data only: nothing in this account is production, and the production fleet stays on the router box until #550's build triggers fire.

Running

cd infra/dev
AWS_PROFILE=eleven-dev tofu init
AWS_PROFILE=eleven-dev tofu plan
AWS_PROFILE=eleven-dev tofu apply

State lives in S3 (eleven-tofu-state-427880590669, versioned, private) with native lockfile locking — no DynamoDB lock table needed. That bucket is the one imperatively-created resource (chicken and egg); everything else is declared here. Being hand-managed, its hardening is hand-applied too: full Block Public Access, and a DenyInsecureTransport bucket policy (deny on aws:SecureTransport=false, applied 2026-07-15) matching the TLS-only policy every declared bucket carries — reapply both if the bucket is ever recreated.

What exists (dev)

• eleven-dev-instances-… — the instance-state bucket: Litestream replication targets, one prefix per instance. Versioning on, lifecycle keeps the last 5 noncurrent versions, Block Public Access. Instance DBs are opaque ciphertext plus routing metadata the server already sees, so replicating them here is threat-model-free (the E2EE rule did the hard part).
• eleven-dev-home-… — the home vault bucket for the s3Store backend work (#550 Part 1): same posture.
• A scoped litestream-canary IAM user/policy confined to the canary's prefix — the shape per-instance credentials will take; the admin dev-agent and dev-agent-james users (one per operator; James's key is sealed in the secrets vault) are console-made and not managed here.