002bd382e9
Some checks failed
Cache: Publish Nix / Publish Nix Cache (push) Waiting to run
Build Rust / Cargo Test (push) Successful in 4m14s
Build Site / Next.js Build (push) Failing after 6s
Infra: OpenTofu / OpenTofu (grafana) (push) Successful in 5s
Lint Governance / BEP Metadata (push) Successful in 0s
Build: Android / Android Rust Core Stub (push) Failing after 23s
54 lines
1.8 KiB
Markdown
54 lines
1.8 KiB
Markdown
# Burrow Release Storage
|
|
|
|
This OpenTofu stack owns Google Cloud Storage buckets used as Burrow's first
|
|
release-storage backup target.
|
|
|
|
Garage is the required S3-compatible primary target. CI uses repo-owned storage
|
|
wrappers: they upload to Garage first, then mirror to GCS unless the backup is
|
|
explicitly disabled.
|
|
|
|
The host activation point is `services.burrow.garage`, enabled by the forge
|
|
host. It creates the initial single-node Garage layout and buckets from
|
|
host-local runtime secrets.
|
|
|
|
It may manage:
|
|
|
|
- the release artifact bucket served by `releases.burrow.net`
|
|
- the signed package repository bucket served by `packages.burrow.net`
|
|
- the private Nix cache backup bucket for `nix.burrow.net`
|
|
- public object-read IAM for download buckets
|
|
- object-admin IAM for the Burrow Forgejo runner service account
|
|
|
|
It must not manage:
|
|
|
|
- Google service-account JSON keys
|
|
- release signing keys
|
|
- package repository metadata
|
|
- DNS or CDN cutover
|
|
|
|
GCS access is keyless. Forgejo jobs run `Scripts/ci/google-wif-auth.sh` to
|
|
trade an Authentik-issued OIDC token for the Google runner service account in
|
|
project `project-88c23ce9-918a-470a-b33`, then use `gcloud storage` against the
|
|
managed backup buckets. The normal release path does not use rclone or Google
|
|
service-account JSON keys.
|
|
|
|
The Nix cache backup bucket defaults to private. Attic remains the public cache
|
|
surface at `nix.burrow.net`; GCS is only a backup target for the Garage `attic`
|
|
bucket.
|
|
|
|
## Run
|
|
|
|
```sh
|
|
Scripts/releases-tofu.sh init -backend-config=backend.hcl
|
|
Scripts/releases-tofu.sh plan -var-file=terraform.tfvars
|
|
```
|
|
|
|
For local syntax work without remote state:
|
|
|
|
```sh
|
|
Scripts/releases-tofu.sh init -backend=false
|
|
Scripts/releases-tofu.sh validate
|
|
```
|
|
|
|
Start with `manage_google = false`. Import existing buckets before enabling
|
|
management if they already exist.
|