mirror of
https://github.com/jjbrunton/Sauci.git
synced 2026-10-31 10:19:43 +00:00
jjbruntonandClaude Opus 4.5
c309fbaa98
- Remove root-level main.tf, variables.tf, outputs.tf, versions.tf (duplicated the module-based approach) - Remove duplicate terraform/templates/ directory - Remove stale terraform.tfvars.example and .terraform.lock.hcl - Remove outdated scripts/import-production.sh - Fix non-prod SMTP error by using merge() to completely omit SMTP fields instead of setting them to null - Update README to remove workspace migration section The environment directories approach (terraform/environments/*) is now the only supported method. Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
170 lines
4.2 KiB
Markdown
170 lines
4.2 KiB
Markdown
# Terraform Infrastructure
|
|
|
|
This directory contains Terraform configuration for managing Supabase project settings as Infrastructure as Code (IaC).
|
|
|
|
## Directory Structure
|
|
|
|
```
|
|
terraform/
|
|
├── modules/
|
|
│ └── supabase/ # Shared Supabase configuration module
|
|
│ ├── main.tf # Resource definitions
|
|
│ ├── variables.tf # Module inputs
|
|
│ ├── outputs.tf # Module outputs
|
|
│ └── templates/ # Email templates
|
|
├── environments/
|
|
│ ├── prod/ # Production (ckjcrkjpmhqhiucifukx)
|
|
│ │ ├── main.tf
|
|
│ │ ├── variables.tf
|
|
│ │ ├── versions.tf
|
|
│ │ └── outputs.tf
|
|
│ └── non-prod/ # Non-production (itbzhrvlgvdmzbnhzhyx)
|
|
│ ├── main.tf
|
|
│ ├── variables.tf
|
|
│ ├── versions.tf
|
|
│ └── outputs.tf
|
|
└── README.md
|
|
```
|
|
|
|
## What's Managed
|
|
|
|
| Resource | Description |
|
|
|----------|-------------|
|
|
| `supabase_settings` | API config, Auth settings, Connection pooler |
|
|
|
|
**Not managed by Terraform** (managed via migrations/CLI):
|
|
- Database schema & migrations
|
|
- Edge functions
|
|
- Storage buckets
|
|
- RLS policies
|
|
|
|
## Initial Setup
|
|
|
|
### 1. Install Terraform
|
|
|
|
```bash
|
|
# macOS
|
|
brew install terraform
|
|
|
|
# Or download from https://terraform.io/downloads
|
|
```
|
|
|
|
### 2. Get Supabase Access Token
|
|
|
|
1. Go to https://supabase.com/dashboard/account/tokens
|
|
2. Create a new token
|
|
3. Save it securely
|
|
|
|
### 3. Initialize an Environment
|
|
|
|
```bash
|
|
cd terraform/environments/non-prod # or prod
|
|
export TF_VAR_supabase_access_token=sbp_xxxxx
|
|
terraform init
|
|
```
|
|
|
|
### 4. Import Existing Settings
|
|
|
|
For each environment, import the existing Supabase settings:
|
|
|
|
```bash
|
|
# Non-prod
|
|
cd terraform/environments/non-prod
|
|
terraform import module.supabase.supabase_settings.main itbzhrvlgvdmzbnhzhyx
|
|
|
|
# Prod
|
|
cd terraform/environments/prod
|
|
terraform import module.supabase.supabase_settings.main ckjcrkjpmhqhiucifukx
|
|
```
|
|
|
|
### 5. Verify Configuration
|
|
|
|
```bash
|
|
terraform plan
|
|
```
|
|
|
|
If the plan shows changes, update the module to match the current settings, then re-run plan until it shows no changes.
|
|
|
|
## Workflow: Making Changes
|
|
|
|
**Always test in non-prod first, then promote to prod.**
|
|
|
|
### 1. Make Changes to the Module
|
|
|
|
Edit files in `terraform/modules/supabase/` to change shared configuration.
|
|
|
|
### 2. Apply to Non-Prod
|
|
|
|
```bash
|
|
cd terraform/environments/non-prod
|
|
export TF_VAR_supabase_access_token=sbp_xxxxx
|
|
terraform plan # Review changes
|
|
terraform apply # Apply changes
|
|
```
|
|
|
|
### 3. Verify in Non-Prod
|
|
|
|
Test the changes in the non-prod environment.
|
|
|
|
### 4. Apply to Prod
|
|
|
|
```bash
|
|
cd terraform/environments/prod
|
|
export TF_VAR_supabase_access_token=sbp_xxxxx
|
|
terraform plan # Review changes
|
|
terraform apply # Apply changes
|
|
```
|
|
|
|
### 5. Commit Changes
|
|
|
|
```bash
|
|
git add terraform/
|
|
git commit -m "Update Supabase settings: <description>"
|
|
git push
|
|
```
|
|
|
|
## Environment-Specific Settings
|
|
|
|
Some settings differ between environments. These are controlled by the `is_production` variable in the module:
|
|
|
|
| Setting | Production | Non-Prod |
|
|
|---------|-----------|----------|
|
|
| SMTP | Resend (custom) | Default |
|
|
| Email rate limit | 25/hour | 3/hour |
|
|
|
|
## CI/CD
|
|
|
|
The GitHub Action (`.github/workflows/deploy-supabase.yml`) can be configured to:
|
|
- Run `terraform plan` on PRs
|
|
- Run `terraform apply` on merge to master
|
|
|
|
Required secret: `SUPABASE_ACCESS_TOKEN`
|
|
|
|
Update the workflow to use the new directory structure:
|
|
|
|
```yaml
|
|
- name: Apply to Non-Prod
|
|
working-directory: terraform/environments/non-prod
|
|
run: terraform apply -auto-approve
|
|
|
|
- name: Apply to Prod
|
|
working-directory: terraform/environments/prod
|
|
run: terraform apply -auto-approve
|
|
```
|
|
|
|
## Remote State (Recommended)
|
|
|
|
For team environments, configure a remote backend in each environment's `versions.tf`:
|
|
|
|
- **Terraform Cloud** (free for small teams)
|
|
- **S3 backend** (if you have AWS)
|
|
|
|
## Secrets
|
|
|
|
**Never commit secrets to git!**
|
|
|
|
- Use environment variables: `export TF_VAR_supabase_access_token=...`
|
|
- Use GitHub Secrets for CI/CD
|
|
- OAuth provider credentials are set in Supabase Dashboard, not Terraform
|
|
|