infrapuzzle/terraform/AGENTS.md

Core Terraform Infrastructure Agent Documentation

This directory manages the core external cloud infrastructure, DNS zones, Authentik SSO, Google Cloud platform integrations, and Google Workspace configurations for Infrapuzzle.

Key Files & Resources

• authentik.tf: Provisions Authentik SSO flows, applications, groups, proxy outposts, OIDC providers, and custom styling with haumdaucher-theme.css.
• authentik.secret.auto.tfvars: Git-crypt encrypted token variables for authenticating with the cluster Authentik API.
• haumdaucher-theme.css: Custom branded stylesheet injected into Authentik login and flow pages.
• ovh.tf: DNS zone and record definitions for haumdaucher.de, moritzgraf.de, and other domains.
• gcp_apis.tf: Enables foundational Google Cloud APIs.
• gcp_backups.tf: Provisions GCP service account and credentials for Velero Google Drive cluster backups (k8s/velero/gdrive_sa.json.secret).
• gcp_calendar.tf: Provisions GCP service account and credentials for OpenClaw Google Calendar integration (k8s/openclaw/calendar_sa.json.secret).
• google_workspace.tf: DNS records for Google Workspace (MX, SPF, DKIM, TXT verification).
• versions.tf: Terraform provider versions and requirements.

Usage & Execution

# Initialize providers (OVH, Authentik, Google, Local, Random)
terraform init

# Review execution plan
terraform plan

# Apply infrastructure changes
terraform apply

Important

Secrets in this directory (such as authentik.secret.auto.tfvars) and generated service account keys are encrypted using git-crypt. Ensure the repository is unlocked before planning or applying.