{% extends "base.html" %}
{% import "repo_tabs.html" as m %}
{% block title %}Terraform state · {{ repo.owner }}/{{ repo.name }}{% endblock %}
{% block bodyattrs %} data-repo="{{ repo.url }}"{% endblock %}
{% block tabs %}{% call m::tabs(repo, "terraform") %}{% endblock %}
{% block content %}
<div class="head"><h1>Terraform state <small>{{ states.len() }}</small></h1></div>
<p>The hub keeps this repository's Terraform and OpenTofu state, sealed at rest, with its last {{ crate::terraform::VERSIONS_KEPT }} versions, outside the repository's history. Point a configuration at it with this backend block, naming the state in place of <code>NAME</code> (a repository may keep several):</p>
<pre class="snippet">terraform {
  backend "http" {
    address        = "{{ shell.base_url }}/api/v1/repos/{{ repo.owner }}/{{ repo.name }}/terraform/state/NAME"
    lock_address   = "{{ shell.base_url }}/api/v1/repos/{{ repo.owner }}/{{ repo.name }}/terraform/state/NAME"
    unlock_address = "{{ shell.base_url }}/api/v1/repos/{{ repo.owner }}/{{ repo.name }}/terraform/state/NAME"
    username       = "flow"
  }
}</pre>
<h2>From a pipeline</h2>
<p>A job uses it with an identity token of this hub's, so it needs no cloud credential for the state. Give the job <code>identity "{{ shell.base_url }}/terraform" {% raw %}{{% endraw %} mount-path "/run/secrets/tf" {% raw %}}{% endraw %}</code>, run <code>export TF_HTTP_PASSWORD=$(cat /run/secrets/tf)</code> before <code>tofu init</code>, and let its sandbox reach this hub (<code>network "egress" {% raw %}{{% endraw %} allow "{{ shell.base_url|host }}" {% raw %}}{% endraw %}</code>, beside whatever else it reaches).</p>
<h2>From your machine</h2>
<p>Set <code>TF_HTTP_PASSWORD</code> to one of your tokens with <code>repo:write</code>, as someone with the write role here. Reading a state needs that too: states hold secrets.</p>
<h2>States</h2>
{% if let Some(n) = notice %}<p class="note">{{ n }}</p>{% endif %}
{% if let Some(e) = error %}<p class="error">{{ e }}</p>{% endif %}
{% if !repo.can(crate::auth::Access::Write) %}<p class="mute">The states are shown to people who can write to this repository.</p>
{% else if states.is_empty() %}<p class="empty">No state yet: the first <code>tofu apply</code> through the backend makes one.</p>{% else %}
<div class="table"><table>
<tr><th>State</th><th>Serial</th><th>Last written</th><th>Lock</th><th>Versions kept</th><th></th></tr>
{% for v in states %}<tr><td><strong>{{ v.s.name }}</strong></td><td>{% if v.s.body.is_empty() %}<span class="mute">deleted</span>{% else %}{{ v.s.serial }}{% endif %}</td><td class="small">{% if v.s.updated_by.is_empty() %}<span class="mute">never</span>{% else %}by {{ v.s.updated_by }} <time title="{{ v.s.updated_ms|when_i }}">{{ v.s.updated_ms|ago_i }}</time>{% endif %}</td><td class="small">{% if v.s.lock_id.is_empty() %}<span class="mute">free</span>{% else %}held by {{ v.s.locked_by }}{% if let Some(t) = v.s.locked_ms %} <time title="{{ t|when_i }}">{{ t|ago_i }}</time>{% endif %}{% endif %}</td><td>{{ v.versions.len() }}</td><td class="small">{% if !v.s.body.is_empty() %}<a href="{{ repo.url }}/terraform/{{ v.s.name|urlencode }}/download">download</a>{% endif %}</td></tr>{% endfor %}
</table></div>
{% for v in states %}{% if !v.versions.is_empty() %}
<details class="tf-versions">
  <summary><strong>{{ v.s.name }}</strong>: {{ v.versions.len() }} kept {% if v.versions.len() == 1 %}version{% else %}versions{% endif %}</summary>
  <p class="small mute">Each write keeps the state it replaced (the last {{ crate::terraform::VERSIONS_KEPT }}). Restoring one writes it again with the next serial, so OpenTofu and Terraform take it, and keeps the current state as a version: restoring never loses anything, and a later version can be restored in turn.</p>
  <div class="table"><table>
  <tr><th>Serial</th><th>Written by</th><th>When</th><th></th></tr>
  {% for k in v.versions %}<tr><td>{{ k.serial }}</td><td class="small">{{ k.created_by }}</td><td class="small"><time title="{{ k.created_ms|when_i }}">{{ k.created_ms|ago_i }}</time></td><td class="small"><a href="{{ repo.url }}/terraform/{{ v.s.name|urlencode }}/download?version={{ k.id }}">download</a>{% if repo.can_maintain() %} <form class="tiny" method="post" action="{{ repo.url }}/terraform/{{ v.s.name|urlencode }}/restore" data-confirm="Restore {{ v.s.name }} to serial {{ k.serial }}? It becomes the current state; the current one is kept as a version."><input type="hidden" name="_csrf" value="{{ shell.csrf }}"><input type="hidden" name="version" value="{{ k.id }}"><button>restore</button></form>{% endif %}</td></tr>{% endfor %}
  </table></div>
</details>
{% endif %}{% endfor %}
{% endif %}
{% endblock %}