burrow/infra/releases/README.md

Burrow Release Storage

This OpenTofu stack owns Google Cloud Storage buckets used as Burrow's first release-storage backup target.

Garage is the required S3-compatible primary target. CI uses repo-owned storage wrappers: they upload to Garage first, then mirror to GCS unless the backup is explicitly disabled.

The host activation point is services.burrow.garage, enabled by the forge host. It creates the initial single-node Garage layout and buckets from host-local runtime secrets.

It may manage:

• the release artifact bucket served by releases.burrow.net
• the signed package repository bucket served by packages.burrow.net
• the private Nix cache backup bucket for nix.burrow.net
• public object-read IAM for download buckets
• object-admin IAM for the Burrow Forgejo runner service account

It must not manage:

• Google service-account JSON keys
• release signing keys
• package repository metadata
• DNS or CDN cutover

GCS access is keyless. Forgejo jobs run Scripts/ci/google-wif-auth.sh to trade an Authentik-issued OIDC token for the Google runner service account in project project-88c23ce9-918a-470a-b33, then use gcloud storage against the managed backup buckets. The normal release path does not use rclone or Google service-account JSON keys.

The Nix cache backup bucket defaults to private. Attic remains the public cache surface at nix.burrow.net; GCS is only a backup target for the Garage attic bucket.

Run

Scripts/releases-tofu.sh init -backend-config=backend.hcl
Scripts/releases-tofu.sh plan -var-file=terraform.tfvars

For local syntax work without remote state:

Scripts/releases-tofu.sh init -backend=false
Scripts/releases-tofu.sh validate

Start with manage_google = false. Import existing buckets before enabling management if they already exist.