Ecosyste.ms: Awesome
An open API service indexing awesome lists of open source software.
https://github.com/nimbolus/terraform-backend
A state backend server which implements the Terraform HTTP backend API with pluggable modules for authentication, storage, locking and state encryption.
https://github.com/nimbolus/terraform-backend
hacktoberfest terraform terraform-backend terraform-backends terraform-http-backend
Last synced: 28 days ago
JSON representation
A state backend server which implements the Terraform HTTP backend API with pluggable modules for authentication, storage, locking and state encryption.
- Host: GitHub
- URL: https://github.com/nimbolus/terraform-backend
- Owner: nimbolus
- License: bsd-3-clause
- Created: 2022-03-21T16:26:18.000Z (over 2 years ago)
- Default Branch: main
- Last Pushed: 2024-05-07T18:39:14.000Z (6 months ago)
- Last Synced: 2024-09-27T19:21:00.683Z (about 1 month ago)
- Topics: hacktoberfest, terraform, terraform-backend, terraform-backends, terraform-http-backend
- Language: Go
- Homepage:
- Size: 221 KB
- Stars: 40
- Watchers: 3
- Forks: 4
- Open Issues: 1
-
Metadata Files:
- Readme: README.md
- License: LICENSE
Awesome Lists containing this project
README
# Terraform Backend Server
A state backend server which implements the Terraform HTTP backend API with plugable modules for authentication, storage, locking and state encryption.
> :warning: **Disclaimer**: This code is in an early development state and not tested extensively for bugs and security issues. If you find some, please raise an issue or merge request.
Supported authentication methods:
- HTTP basic auth
- JSON Web Tokens
Supported storage backends:
- local file system
- S3
- Postgres
Supported lock backends:
- local map
- Redis
- Postgres
Supported KMS (encryption) backends:
- local AES key
- AES from HashiCorp Vault Key/Value store (v2)
- HashiCorp Vault Transit engine
## Deployment
Run locally for development:
```sh
LOG_LEVEL=debug go run cmd/terraform-backend.go
```
or use [docker-compose](./docker-compose.yml):
```sh
docker-compose up -d
```
### Default settings
The following table describes the default configuration, although the backend server will run with these values, it's not scalable and therefore only for testing purposes.
| Environment Variable | Type | Default | Description |
|------------------------|--------|------------|----------------------------------------------------------------------------------------------------------------|
| LOG_LEVEL | string | `info` | Log level (options are: `fatal`, `info`, `warning`, `debug`, `trace`) |
| LISTEN_ADDR | string | `:8080` | Address the HTTP server listens on |
| TLS_KEY | string | -- | Path to TLS key file for listening with TLS (fallback to HTTP if not specified) |
| TLS_CERT | string | -- | Path to TLS certificate file for listening with TLS (fallback to HTTP if not specified) |
| STORAGE_BACKEND | string | `fs` | Module for state file storage (checkout [docs/storage.md](./docs/storage.md) for other options) |
| STORAGE_FS_DIR | string | `./states` | File system directory for `fs` storage module to store state files |
| KMS_BACKEND | string | `local` | Module used for encryption (checkout [docs/kms.md](./docs/kms.md) for other options) |
| KMS_KEY | string | -- | Key for `local` KMS module, if not defined, the server will generate a new one and exit |
| LOCK_BACKEND | string | `local` | Module used for locking the state (checkout [docs/lock.md](./docs/lock.md) for other options) |
| AUTH_BASIC_ENABLED | bool | `true` | HTTP basic auth is enabled by default (checkout [docs/auth.md](./docs/auth.md) for other options) |
| FORCE_UNLOCK_ENABLED | bool | `true` | Force-unlock feature enables the native Terraform behavior which unlocks the state even if no lock id was sent |
## Usage
The path to the state is: `/state//`.
**Example Terraform backend configuration**
```hcl
terraform {
backend "http" {
address = "http://localhost:8080/state/project1/example"
lock_address = "http://localhost:8080/state/project1/example"
unlock_address = "http://localhost:8080/state/project1/example"
username = "basic"
password = "some-random-secret"
}
}
```
For more information about username and password checkout [docs/auth.md](./docs/auth.md)
## Tests
Run unit tests:
```sh
go test ./...
```
Run integration tests:
```sh
docker-compose up -d redis postgres minio
go test ./... --tags integration -count=1
```