49 lines
1.9 KiB
Bash
Executable File
49 lines
1.9 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# Run OpenTofu with TF_VAR_* creds injected from Infisical /tofu/.
|
|
# Usage: infisical login && INFISICAL_PROJECT_ID=<id> ./itofu.sh <init|plan|apply|...>
|
|
set -euo pipefail
|
|
|
|
INFISICAL_PROJECT_ID="${INFISICAL_PROJECT_ID:-}"
|
|
INFISICAL_ENV="${INFISICAL_ENV:-prod}"
|
|
TOFU_PATH="/tofu"
|
|
PLAN_FILE="${WEOWN_TOFU_PLAN:-plan.tfplan}"
|
|
|
|
: "${INFISICAL_PROJECT_ID:?INFISICAL_PROJECT_ID not set. Export it (e.g. from site.conf) before running itofu.sh.}"
|
|
|
|
command -v infisical >/dev/null 2>&1 || { echo "ERROR: infisical CLI not found." >&2; exit 1; }
|
|
command -v tofu >/dev/null 2>&1 || { echo "ERROR: tofu not found." >&2; exit 1; }
|
|
infisical export --projectId="$INFISICAL_PROJECT_ID" --env="$INFISICAL_ENV" --path="$TOFU_PATH" >/dev/null 2>&1 || {
|
|
echo "ERROR: cannot read $INFISICAL_PROJECT_ID $INFISICAL_ENV $TOFU_PATH — run 'infisical login' and check your access." >&2; exit 1; }
|
|
[ "$#" -ge 1 ] || { echo "usage: ./itofu.sh <init|plan|apply|output|destroy|...> [args]" >&2; exit 1; }
|
|
|
|
irun() { infisical run --projectId="$INFISICAL_PROJECT_ID" --env="$INFISICAL_ENV" --path="$TOFU_PATH" -- "$@"; }
|
|
|
|
# S3 backend reads AWS_* env on every state op — so ALL tofu calls go through trun.
|
|
# shellcheck disable=SC2016
|
|
trun() { irun bash -c 'export AWS_ACCESS_KEY_ID="$TF_VAR_spaces_access_key" AWS_SECRET_ACCESS_KEY="$TF_VAR_spaces_secret_key"; exec tofu "$@"' itofu "$@"; }
|
|
|
|
case "$1" in
|
|
init)
|
|
shift
|
|
# shellcheck disable=SC2016
|
|
irun bash -c 'export AWS_ACCESS_KEY_ID="$TF_VAR_spaces_access_key" AWS_SECRET_ACCESS_KEY="$TF_VAR_spaces_secret_key"; exec tofu init -reconfigure \
|
|
-backend-config="sse_customer_key=$TF_VAR_spaces_encryption_key" "$@"' itofu "$@"
|
|
;;
|
|
plan)
|
|
shift
|
|
trun plan -out="$PLAN_FILE" "$@"
|
|
;;
|
|
apply)
|
|
shift
|
|
if [ "$#" -eq 0 ] && [ -f "$PLAN_FILE" ]; then
|
|
set +e; trun apply "$PLAN_FILE"; rc=$?; set -e
|
|
rm -f "$PLAN_FILE"
|
|
exit "$rc"
|
|
fi
|
|
trun apply "$@"
|
|
;;
|
|
*)
|
|
trun "$@"
|
|
;;
|
|
esac
|