Download this file
| 1 | # 🤖 The dev mesh — the AWS (Dublin, ie) half of the two-node staging fleet |
| 2 | # (docs/dev-mesh.md). Its own state key so it tears down independently of the |
| 3 | # #550 activator-proof box in infra/dev. The Helsinki (fi) node is Hetzner, |
| 4 | # hand-provisioned (like prod's Hetzner boxes) — only its scoped S3 credential |
| 5 | # lives here. |
| 6 | # |
| 7 | # Boundary rule (infra/README.md) still holds: this manages the static |
| 8 | # skeleton — box, bucket, IAM, DNS wildcards — never an instance hostname. |
| 9 | |
| 10 | terraform { |
| 11 | required_version = ">= 1.10" |
| 12 | |
| 13 | required_providers { |
| 14 | aws = { |
| 15 | source = "hashicorp/aws" |
| 16 | version = "~> 6.0" |
| 17 | } |
| 18 | dnsimple = { |
| 19 | source = "dnsimple/dnsimple" |
| 20 | version = "~> 1.0" |
| 21 | } |
| 22 | } |
| 23 | |
| 24 | backend "s3" { |
| 25 | bucket = "eleven-tofu-state-427880590669" |
| 26 | key = "dev-mesh/terraform.tfstate" |
| 27 | region = "eu-west-1" |
| 28 | use_lockfile = true |
| 29 | } |
| 30 | } |
| 31 | |
| 32 | provider "aws" { |
| 33 | region = "eu-west-1" |
| 34 | |
| 35 | default_tags { |
| 36 | tags = { |
| 37 | project = "eleven" |
| 38 | env = "dev-mesh" |
| 39 | managed = "opentofu" |
| 40 | } |
| 41 | } |
| 42 | } |
| 43 | |
| 44 | # 11ch.at lives in the Eleven DNSimple account (176940), not Paul's personal |
| 45 | # one — DNSIMPLE_TOKEN + DNSIMPLE_ACCOUNT come from the operator's dev agent |
| 46 | # item in Bitwarden at run time (`ops dev` pulls them itself), never committed. |
| 47 | provider "dnsimple" {} |
| 48 | |
| 49 | data "aws_caller_identity" "current" {} |
| 50 | |
| 51 | locals { |
| 52 | account_id = data.aws_caller_identity.current.account_id |
| 53 | } |
| 54 | |
amadan