.github/workflows/arrow.yml

@@ -5,16 +5,17 @@ env:
   DEPLOY_IDENTITY_BASE64: ${{ secrets.DEPLOY_IDENTITY_BASE64 }}
   ARROW_IDENTITY_BASE64: ${{ secrets.ARROW_IDENTITY_BASE64 }}
   CLOUDFLARE_R2_ENDPOINT: "${{ secrets.CLOUDFLARE_ACCOUNT_ID }}.r2.cloudflarestorage.com"
-  AWS_ACCESS_KEY_ID: ${{ secrets.CLOUDFLARE_R2_ACCESS_KEY }}
-  AWS_SECRET_ACCESS_KEY: ${{ secrets.CLOUDFLARE_R2_SECRET_KEY }}
-  AWS_ENDPOINT_URL_S3: "https://${{ secrets.CLOUDFLARE_ACCOUNT_ID }}.r2.cloudflarestorage.com"
+  TF_VAR_cloudflare_account_id: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
+  TF_VAR_cloudflare_r2_access_key: ${{ secrets.CLOUDFLARE_R2_ACCESS_KEY }}
+  TF_VAR_cloudflare_r2_secret_key: ${{ secrets.CLOUDFLARE_R2_SECRET_KEY }}
   TF_VAR_vultr_api_key: ${{ secrets.VULTR_API_KEY }}
 
 on:
   workflow_dispatch:
     inputs:
       rebuild:
-        type: boolean
+        type: bool
+        required: true
         default: false
       action:
         type: choice
@@ -75,14 +76,21 @@ jobs:
       # Checks whether Terraform is formatted properly. If this fails, you
       # should install the pre-commit hook.
       - name: Check Formatting
-        working-directory: ${{ env.TERRAFORM_DIRECTORY }}
         run: |
           terraform fmt -no-color -check -diff -recursive
 
       # Connects to remote state backend and download providers.
       - name: Terraform Init
         working-directory: ${{ env.TERRAFORM_DIRECTORY }}
-        run: terraform init
+        run: |
+          terraform init \
+            -backend-config="endpoint=${{ env.CLOUDFLARE_R2_ENDPOINT }}" \
+            -backend-config="workspace_key_prefix=${{ github.repository }}/arrow" \
+            -backend-config="key=state.tfstate" \
+            -backend-config="skip_credentials_validation=true" \
+            -backend-config="skip_region_validation=true" \
+            -backend-config="region=anything" \
+            -backend-config="bucket=noahmasur-terraform"
 
       # Deploys infrastructure or changes to infrastructure.
       - name: Terraform Apply

hosts/arrow/main.tf

@@ -1,22 +1,5 @@
 terraform {
-  backend "s3" {
-    bucket                      = "noahmasur-terraform"
-    key                         = "arrow.tfstate"
-    region                      = "auto"
-    skip_credentials_validation = true
-    skip_metadata_api_check     = true
-    skip_region_validation      = true
-    skip_requesting_account_id  = true
-    skip_s3_checksum            = true
-    use_path_style              = true
-    /*
-      ENVIRONMENT VARIABLES
-      ---------------------
-      AWS_ACCESS_KEY_ID     - R2 token
-      AWS_SECRET_ACCESS_KEY - R2 secret
-      AWS_ENDPOINT_URL_S3   - R2 location: https://ACCOUNT_ID.r2.cloudflarestorage.com
-    */
-  }
+    backend "s3" {}
   required_version = ">= 1.0.0"
   required_providers {
     aws = {
@@ -34,10 +17,21 @@ terraform {
 #   image_file = one(fileset(path.root, "result/iso/nixos.iso"))
 # }
 
-# variable "cloudflare_r2_endpoint" {
-#   type        = string
-#   description = "Domain for the Cloudflare R2 endpoint"
-# }
+variable "cloudflare_account_id" {
+    type = string
+    description = "ID of the Cloudflare account"
+}
+
+variable "cloudflare_r2_access_key" {
+    type = string
+    description = "Non-sensitive access key ID for Cloudflare R2"
+}
+
+variable "cloudflare_r2_secret_key" {
+    type = string
+    description = "Sensitive access key secret for Cloudflare R2"
+    sensitive = true
+}
 
 variable "vultr_api_key" {
     type = string
@@ -46,11 +40,18 @@ variable "vultr_api_key" {
 }
 
 provider "aws" {
-  region                      = "auto"
+  region = "us-east-1"
+
+  access_key = var.cloudflare_r2_access_key
+  secret_key = var.cloudflare_r2_secret_key
+
   skip_credentials_validation = true
-  skip_metadata_api_check     = true
   skip_region_validation      = true
   skip_requesting_account_id  = true
+
+  endpoints {
+    s3 = "https://${var.cloudflare_account_id}.r2.cloudflarestorage.com"
+  }
 }
 
 provider "vultr" {

hosts/tempest/default.nix

@@ -103,7 +103,6 @@ inputs.nixpkgs.lib.nixosSystem {
       mullvad.enable = false;
       nixlang.enable = true;
       rust.enable = true;
-      terraform.enable = true;
       yt-dlp.enable = true;
       gaming = {
         dwarf-fortress.enable = true;

overlays/caddy.nix

@@ -31,7 +31,7 @@ in {
 
     src = prev.caddy.src;
 
-    vendorHash = "sha256-zeuvCk7kZa/W/roC12faCQDav4RB8RT1dR2Suh2yjD8=";
+    vendorHash = "sha256-woDPiGGSjophbmCyd30+JwWku0HQjBvNqGalkHuOiOA=";
 
     overrideModAttrs = (_: {
       preBuild = ''