pal-e-docs

Architecture: Tofu Provider Consumers

arch-tofu-consumers Doc

architecture active
Project

Architecture: Tofu Provider Consumers

Purpose

How pal-e-platform and pal-e-services consume the three custom OpenTofu providers (godaddy, appstoreconnect, orka) to provision infrastructure for iOS apps.

Consumer Split

Repo Scope Providers Used
pal-e-platform Infrastructure primitives: DNS records, bundle IDs, profiles, Mac VMs, Keycloak realms godaddy, appstoreconnect, orka
pal-e-services Application-level config: service registration, Keycloak users/clients/roles, app deployments (none directly — consumes platform outputs)

Data Flow

For a new iOS app:
  • pal-e-platform: tofu apply creates DNS record (godaddy), bundle ID + profile (appstoreconnect), Mac VM (orka)
  • Manual step: operator creates app in App Store Connect web UI (API restriction)
  • pal-e-platform: tofu import imports the app resource
  • pal-e-services: registers the service, configures Keycloak realm users/clients, sets up Woodpecker pipeline
  • Woodpecker: Mac agent runs xcodebuild + xcrun altool to build, sign, upload

Docs Pattern

Both repos follow the CLAUDE.md → README.md symlink + docs/ pattern. README.md is a TOC linking into docs/ which contain mermaid diagrams. Tickets #1533 and #1534 bring these repos into compliance.

Keycloak Split

Platform creates realms (infrastructure primitive). Services manages what lives inside realms — users, clients, roles, group mappings — because these are application-scoped.
  • Repos: pal-e-platform, pal-e-services
  • Tickets: #1533 (pal-e-platform docs), #1534 (pal-e-services docs)
  • Board: board-project-ios-infrastructure