Wire Forge-native release infrastructure

infra/releases/README.md

@@ -0,0 +1,54 @@
+# Burrow Release Storage
+
+This OpenTofu stack owns Google Cloud Storage buckets used as Burrow's first
+release-storage backup target.
+
+Garage is the required S3-compatible primary target. CI uses repo-owned storage
+wrappers: they upload to Garage first, then mirror to GCS unless the backup is
+explicitly disabled.
+
+The host activation point is `services.burrow.garage`, enabled by the forge
+host. It creates the initial single-node Garage layout and buckets from
+host-local runtime secrets.
+
+It may manage:
+
+- the release artifact bucket served by `releases.burrow.net`
+- the signed package repository bucket served by `packages.burrow.net`
+- the private Nix cache backup bucket for `nix.burrow.net`
+- public object-read IAM for download buckets
+- object-admin IAM for the Burrow Forgejo runner service account
+
+It must not manage:
+
+- Google service-account JSON keys
+- release signing keys
+- package repository metadata
+- DNS or CDN cutover
+
+GCS access is keyless. Forgejo jobs run `Scripts/ci/google-wif-auth.sh` to
+trade an Authentik-issued OIDC token for the Google runner service account in
+project `project-88c23ce9-918a-470a-b33`, then use `gcloud storage` against the
+managed backup buckets. The normal release path does not use rclone or Google
+service-account JSON keys.
+
+The Nix cache backup bucket defaults to private. Attic remains the public cache
+surface at `nix.burrow.net`; GCS is only a backup target for the Garage `attic`
+bucket.
+
+## Run
+
+```sh
+Scripts/releases-tofu.sh init -backend-config=backend.hcl
+Scripts/releases-tofu.sh plan -var-file=terraform.tfvars
+```
+
+For local syntax work without remote state:
+
+```sh
+Scripts/releases-tofu.sh init -backend=false
+Scripts/releases-tofu.sh validate
+```
+
+Start with `manage_google = false`. Import existing buckets before enabling
+management if they already exist.