From b315698634edff83d2b5bc7beab87e839ae4c756 Mon Sep 17 00:00:00 2001
From: unkin-agent <unkin-agent@unkin.net>
Date: Sun, 30 Aug 2026 00:45:43 +1000
Subject: [PATCH] refactor: parameterise rancher api_url and pin rancher2 to ~>
 14.0

The provider api_url was hardcoded to the derived environment URL, leaving CI
no way to point a plan at a different endpoint. The rancher2 constraint of
>= 5.0.0 also permitted nine majors of drift against the 14.1.1 the lockfile
resolves.

- Add a generated variable "rancher_url" defaulting to the same
  https://${path_relative_to_include()} expression; the provider now reads
  var.rancher_url, so TF_VAR_rancher_url overrides without changing defaults.
- Pin rancher/rancher2 to ~> 14.0 in modules/rancher/versions.tf.
---
 environments/root.hcl       | 9 ++++++++-
 modules/rancher/versions.tf | 2 +-
 2 files changed, 9 insertions(+), 2 deletions(-)

diff --git a/environments/root.hcl b/environments/root.hcl
index 321d6a6..b156492 100644
--- a/environments/root.hcl
+++ b/environments/root.hcl
@@ -3,7 +3,7 @@ generate "backend" {
   if_exists = "overwrite"
   contents  = <<EOF
 provider "rancher2" {
-  api_url   = "https://${path_relative_to_include()}"
+  api_url   = var.rancher_url
   token_key = var.rancher_token
 }
 
@@ -20,6 +20,13 @@ variable "rancher_token" {
   sensitive = true
 }
 
+# Defaults to the environment's public URL; an exported TF_VAR_rancher_url
+# takes precedence over terragrunt inputs.
+variable "rancher_url" {
+  type    = string
+  default = "https://${path_relative_to_include()}"
+}
+
 terraform {
   backend "consul" {
     address = "https://consul.service.consul"
diff --git a/modules/rancher/versions.tf b/modules/rancher/versions.tf
index cd6adc2..9f55cce 100644
--- a/modules/rancher/versions.tf
+++ b/modules/rancher/versions.tf
@@ -3,7 +3,7 @@ terraform {
   required_providers {
     rancher2 = {
       source  = "rancher/rancher2"
-      version = ">= 5.0.0"
+      version = "~> 14.0"
     }
     vault = {
       source  = "hashicorp/vault"