OpenTofu

OpenTofu describes production as code in a-novel/infra. Merges apply it, so you run tofu yourself only for the maintenance the infra runbooks describe, such as repairing state or rebuilding from nothing.

Install

Infra accepts only the version pinned in its .opentofu-version. Skip to Configure if this prints that version:

tofu version

Distribution and Homebrew packages follow their own releases, so Linux and macOS use OpenTofu's installer, which takes a version. It checks the download's signature with GnuPG or cosign. On macOS, run brew install cosign first.

PIN=https://raw.githubusercontent.com/a-novel/infra/master/.opentofu-version
VERSION=$(curl -fsSL "$PIN")
curl -fsSLo /tmp/install-opentofu.sh https://get.opentofu.org/install-opentofu.sh
sh /tmp/install-opentofu.sh --install-method standalone \
  --opentofu-version "$VERSION"
rm /tmp/install-opentofu.sh

Rerun this step whenever the pin moves, as tofu init refuses any other version.

Configure

OpenTofu reaches Google Cloud through the application default credentials of your Google Cloud CLI account. Check from an up-to-date infra checkout, where init reads the foundation state:

cd ~/git-projects/a-novel/app/infra
tofu -chdir=environments/production/foundation init

It ends with OpenTofu has been successfully initialized!.