OXYGENHUB

Terraform state 0

The hub keeps this repository's Terraform and OpenTofu state, sealed at rest, with its last 20 versions, outside the repository's history. Point a configuration at it with this backend block, naming the state in place of NAME (a repository may keep several):

terraform {
  backend "http" {
    address        = "https://oxygenhub.io/api/v1/repos/andymccall/oxygenvcs-web/terraform/state/NAME"
    lock_address   = "https://oxygenhub.io/api/v1/repos/andymccall/oxygenvcs-web/terraform/state/NAME"
    unlock_address = "https://oxygenhub.io/api/v1/repos/andymccall/oxygenvcs-web/terraform/state/NAME"
    username       = "flow"
  }
}

From a pipeline

A job uses it with an identity token of this hub's, so it needs no cloud credential for the state. Give the job identity "https://oxygenhub.io/terraform" { mount-path "/run/secrets/tf" }, run export TF_HTTP_PASSWORD=$(cat /run/secrets/tf) before tofu init, and let its sandbox reach this hub (network "egress" { allow "oxygenhub.io" }, beside whatever else it reaches).

From your machine

Set TF_HTTP_PASSWORD to one of your tokens with repo:write, as someone with the write role here. Reading a state needs that too: states hold secrets.

States

The states are shown to people who can write to this repository.