# terraform/

Infrastructure state management. Each subdirectory is an independent Terraform workspace
with its own state backend.

## Workspaces

| Directory | What it manages | State backend |
|-----------|----------------|---------------|
| `proxmox/` | Proxmox VMs and LXCs on pve1 | Remote (configure in bootstrap/) |
| `dns/` | Dynu dynamic DNS records | Remote |
| `docker/` | Docker container catalog (documentation-only, read-only) | Local |
| `bootstrap/` | Remote state backend resources | Local (chicken-and-egg) |

## Usage

```bash
# Dry-run: show what would change
cd terraform/proxmox
terraform init
terraform plan

# Detect drift only (exit 2 = drift, exit 0 = in sync)
terraform plan -detailed-exitcode

# Apply (confirm first — always review the plan)
terraform apply
```

## Credentials

Never commit credentials. Use `terraform.tfvars` (git-ignored) or environment variables:

```bash
# Proxmox
export TF_VAR_proxmox_endpoint="https://pve1.sweet.home:8006/"
export TF_VAR_proxmox_api_token_id="terraform@pve!tf"
export TF_VAR_proxmox_api_token_secret="<token>"

# Dynu DNS
export TF_VAR_dynu_api_key="<api_key>"
```

## Importing existing resources

See `docs/internal/implementation-plan.md` Phase 2 for the `terraform import` commands
to bring existing Proxmox resources under state management.

## Drift detection

The `drift-detect` CI workflow runs `terraform plan -detailed-exitcode` daily on all
workspaces and sends a Gotify notification if any drift is detected.