Architecture: GoDaddy Tofu

arch-godaddy-tofu Architecture

architecture active

Project

Component	Purpose	Notes
godaddy-tofu binary	OpenTofu provider plugin	Go binary, terraform-plugin-framework, registers as registry.terraform.io/ldraney/godaddy
pkg/godaddy Client	HTTP client for GoDaddy REST API	sso-key auth, net/http, 6 DNS + 2 domain methods
godaddy_dns_record resource	CRUD for individual DNS records	P0 - maps to PUT/GET/DELETE /v1/domains/{d}/records/{t}/{n}
godaddy_domain resource	Domain settings management	P1 - read-heavy, maps to PATCH /v1/domains/{d}
godaddy_dns_records data source	Read existing DNS records	P0 - maps to GET /v1/domains/{d}/records
godaddy_domains data source	List/read domain details	P1 - maps to GET /v1/domains
Hetzner edge node	Reverse proxy for custom domains	178.156.129.142, Caddy auto-TLS, Tailscale mesh to k3s
pal-e-platform/terraform/	Consumer of the provider	HCL config defining which DNS records exist

Go client inside provider repo (not separate SDK) — single language, single test suite, no cross-language overhead
DNS records as individual resources (not bulk replace-all) — safer than providers that delete unmanaged records
net/http only — no external HTTP dependencies, stdlib is sufficient for REST calls
sso-key auth — matches GoDaddy production API, credentials from provider config or env vars
Hetzner edge as reverse proxy target — Caddy handles public TLS, Tailscale handles private mesh back to k3s
Provider consumed by pal-e-platform — DNS config lives where all other infra config lives, not in godaddy-tofu repo