# terraform-binarylane

Terraform/Terragrunt for BinaryLane cloud infrastructure.

## Layout

```
environments/root.hcl                # consul state backend
environments/global/terragrunt.hcl
modules/binarylane/
```

`make plan` / `make apply` reconcile every unit. `make pre-commit` runs the
hooks. State lives in Consul under `infra/terraform/binarylane/<unit>/state`.

## Auth

The BinaryLane API token is read from `kv/service/terraform/binarylane` (field
`token`) and passed in as `TF_VAR_binarylane_token`; Consul state creds come
from `consul_root/au/syd1/creds/terraform-binarylane`. Both are granted to the
`terraform_binarylane` AppRole and the `woodpecker_terraform_binarylane` k8s
role in terraform-vault.

## Mail edge

Each DMZ VPC (`syd`, `mel`) holds a postfix edge host and a vpn host. The vpn
host runs wg0 to prodnxsr0020 and forwards the lab routes for its VPC; the edge
host reaches the lab through it and has no WireGuard. wg0 is bootstrapped from
a key in `user_data` (readable via the BinaryLane API); Puppet then manages it
from Vault, so rotate by replacing `wireguard_asymmetric_key.vpn` here and
letting Puppet roll it out.