# The OxygenFlow OpenTofu image

A root file system for deploy jobs (oxygenflow#56):

- Debian bookworm, slim, with CA certificates.
- OpenTofu 1.13.1, checked against its published SHA-256.
- A provider mirror in `/opt/tofu/mirror`: `hashicorp/google` 8.7.0,
  `hashicorp/google-beta` 8.7.0 (Firebase) and `cloudflare/cloudflare`
  5.28.0, checked by `tofu providers mirror` against the registry's signed
  checksums when the image is built.
- `/etc/tofu/cli.tfrc` (set by `TF_CLI_CONFIG_FILE`) installs providers
  from the mirror only.
- TFLint 0.64.0 and its Google ruleset 0.40.0, each checked against its
  release's SHA-256, the ruleset in `/opt/tflint/plugins`
  (`TFLINT_PLUGIN_DIR`): a repository's `.tflint.hcl` enables it with
  `plugin "google" { enabled = true  version = "0.40.0"  source =
  "github.com/terraform-linters/tflint-ruleset-google" }`, and linting
  needs no `tflint --init`.

So `tofu init`, `fmt` and `validate` need no network; `plan` and `apply`
reach the cloud's APIs through allow-listed egress (#55). The guest's
environment is the pipeline's, so a job sets `TF_CLI_CONFIG_FILE` itself
(below).

## Building and importing

```
images/tofu/build.sh /path/to/oxygenflow-tofu.tar
scp /path/to/oxygenflow-tofu.tar claude@earth:/home/claude/flow/dl/
ssh claude@earth 'cd ~/flow && FLOW_HOME=~/flow bin/flow rootfs import dl/oxygenflow-tofu.tar'
```

Pin the printed hash in the pipelines that use it, and push it to the hub
(`flow rootfs push HASH`) so every runner can fetch it.

A provider version in a pipeline's lock file must be in the mirror: bump
`mirror.tf`, rebuild and re-pin when a lock file changes.

## Using it

```kdl
sandbox "tofu" {
    runtime "microvm"
    rootfs "cas://blob/<hash printed by flow rootfs import>"
    memory-limit "2GiB"
    cpu-limit 2
    network "isolated"
    env {
        TF_CLI_CONFIG_FILE "/etc/tofu/cli.tfrc"
        TF_IN_AUTOMATION "1"
        TFLINT_PLUGIN_DIR "/opt/tflint/plugins"
    }
}
```