infra¶

Infrastructure as Code for Dashecorp. One repo, organized by provider.

Structure¶

cloudflare/
  dashecorp.com/     DNS, tunnels, Access policies, Pages

github/
  dashecorp/         Dashecorp org repos, webhooks, branch protection, Actions
                     secrets, deploy environments and their approval gates
  stig-johnny/       Stig-Johnny repos, webhooks
  enterprise/        GitHub Enterprise settings

gcp/
  dashecorp/         GCP VM (k3s), the agents' home (agent-home disk, NFS from
                     the k3s server; replaces Filestore, infra#508), Artifact
                     Registry, Tailscale, the rig-location state object (infra#669)

k8s/
  dell/k3s/          The Dell's k3s version and flags, applied by the post-merge
                     `apply (hosts)` job over the tailnet (infra#503)

tailscale/
  main.tf            Tailscale ACLs

Usage¶

Each directory is an independent OpenTofu root module:

cd github/dashecorp
tofu init
tofu plan
tofu apply

CI runs tofu plan on PRs and tofu apply on merge to main. Plans and applies share each stack's GCS state lock, so each waits up to 10 minutes for a lock another run holds instead of failing (-lock-timeout, infra#529). Main runs are serialized; PR plans run in parallel.

Workflows (.github/workflows/):

Workflow	Runs on	Does
`terraform.yml`	PRs, push to main, dispatch	Plans every module on a PR; applies every module, then `k8s/dell/k3s` over the tailnet, on main
`rig-location.yml`	dispatch only	The rig-location switch: GCP's power (`gcp`) and the stable host's CNAME (`primary`). `gcp=standby` and `primary=dell` wait for the operator in the `rig-standby` environment (docs)
`rig-location-selftest.yml`	PRs touching `scripts/rig-location*.sh`, dispatch	Runs `scripts/rig-location.selftest.sh`: the switch's helper against a fake `curl`, no network, no secrets (infra#679)
`tofu-force-unlock.yml`	dispatch only	Releases a stuck state lock
`docs-check.yml`	PRs	Doc frontmatter and cross-references

The rig docs site (rig-docs Pages project) is built and deployed by dashecorp/rig-gitops deploy-docs.yml (hourly and on push), not from here. infra's daily docs.yml duplicate was retired on 2026-10-22.

Rules¶

Secrets in .tfvars only — never commit .tfvars files
One tofu apply per directory — independent state
All repos private — no exceptions
State in GCS — gs://tablez-terraform-state (legacy bucket name; rename tracked separately as a destructive migration)