# Burrow Release Storage

This OpenTofu stack owns Google Cloud Storage buckets used as Burrow's first
release-storage backup target.

Garage is the required S3-compatible primary target. CI uses repo-owned storage
wrappers: they upload to Garage first, then mirror to GCS unless the backup is
explicitly disabled.

The host activation point is `services.burrow.garage`, enabled by the forge
host. It creates the initial single-node Garage layout and buckets from
host-local runtime secrets.

It may manage:

- the release artifact bucket served by `releases.burrow.net`
- the signed package repository bucket served by `packages.burrow.net`
- the private Nix cache backup bucket for `nix.burrow.net`
- public object-read IAM for download buckets
- object-admin IAM for the Burrow Forgejo runner service account

It must not manage:

- Google service-account JSON keys
- release signing keys
- package repository metadata
- DNS or CDN cutover

GCS access is keyless. Forgejo jobs run `Scripts/ci/google-wif-auth.sh` to
trade an Authentik-issued OIDC token for the Google runner service account in
project `project-88c23ce9-918a-470a-b33`, then use `gcloud storage` against the
managed backup buckets. The normal release path does not use rclone or Google
service-account JSON keys.

The Nix cache backup bucket defaults to private. Attic remains the public cache
surface at `nix.burrow.net`; GCS is only a backup target for the Garage `attic`
bucket.

## Run

```sh
Scripts/releases-tofu.sh init -backend-config=backend.hcl
Scripts/releases-tofu.sh plan -var-file=terraform.tfvars
```

For local syntax work without remote state:

```sh
Scripts/releases-tofu.sh init -backend=false
Scripts/releases-tofu.sh validate
```

Start with `manage_google = false`. Import existing buckets before enabling
management if they already exist.