Categorygithub.com/nimbolus/terraform-backend

# README

Terraform Backend Server

A state backend server which implements the Terraform HTTP backend API with plugable modules for authentication, storage, locking and state encryption.

:warning: Disclaimer: This code is in an early development state and not tested extensively for bugs and security issues. If you find some, please raise an issue or merge request.

Supported authentication methods:

  • HTTP basic auth
  • JSON Web Tokens

Supported storage backends:

  • local file system
  • S3
  • Postgres

Supported lock backends:

  • local map
  • Redis
  • Postgres

Supported KMS (encryption) backends:

  • local AES key
  • AES from HashiCorp Vault Key/Value store (v2)
  • HashiCorp Vault Transit engine

Deployment

Run locally for development:

LOG_LEVEL=debug go run cmd/terraform-backend.go

or use docker-compose:

docker-compose up -d

Default settings

The following table describes the default configuration, although the backend server will run with these values, it's not scalable and therefore only for testing purposes.

Environment VariableTypeDefaultDescription
LOG_LEVELstringinfoLog level (options are: fatal, info, warning, debug, trace)
LISTEN_ADDRstring:8080Address the HTTP server listens on
TLS_KEYstring--Path to TLS key file for listening with TLS (fallback to HTTP if not specified)
TLS_CERTstring--Path to TLS certificate file for listening with TLS (fallback to HTTP if not specified)
STORAGE_BACKENDstringfsModule for state file storage (checkout docs/storage.md for other options)
STORAGE_FS_DIRstring./statesFile system directory for fs storage module to store state files
KMS_BACKENDstringlocalModule used for encryption (checkout docs/kms.md for other options)
KMS_KEYstring--Key for local KMS module, if not defined, the server will generate a new one and exit
LOCK_BACKENDstringlocalModule used for locking the state (checkout docs/lock.md for other options)
AUTH_BASIC_ENABLEDbooltrueHTTP basic auth is enabled by default (checkout docs/auth.md for other options)
FORCE_UNLOCK_ENABLEDbooltrueForce-unlock feature enables the native Terraform behavior which unlocks the state even if no lock id was sent

Usage

The path to the state is: /state/<project-id>/<state-name>.

Example Terraform backend configuration

terraform {
  backend "http" {
    address        = "http://localhost:8080/state/project1/example"
    lock_address   = "http://localhost:8080/state/project1/example"
    unlock_address = "http://localhost:8080/state/project1/example"
    username       = "basic"
    password       = "some-random-secret"
  }
}

For more information about username and password checkout docs/auth.md

Tests

Run unit tests:

go test ./...

Run integration tests:

docker-compose up -d redis postgres minio
go test ./... --tags integration -count=1

# Packages

No description provided by the author
No description provided by the author