Architecture: Terraform IaC
Terraform IaC Conventions (pal-e-services)
Infrastructure is managed via OpenTofu in
pal-e-services/terraform/. Woodpecker CI runs tofu plan on PRs and tofu apply on merge to main.Services Map Pattern
Services are defined as a map in
k3s.tfvars keyed by service name. Each entry provisions: Harbor project + robot accounts, k8s namespace, pull secret, ArgoCD app, and Tailscale funnel ingress. The key name propagates everywhere — renaming requires moved blocks to avoid destroy/recreate.State Management
When renaming a services map key, use
moved blocks in the relevant .tf files to migrate state without destroying resources. Precedent: keycloak.tf moved blocks. Always run tofu plan to verify no unexpected destroys before merging.Secrets
Woodpecker injects
tfvars_content secret containing k3s.tfvars. After any tfvars change, the secret must be synced via Woodpecker UI or API.