Frank
02883d3ed2
Copy of the legacy ~/.pi/agent/docs tree rebuilt as the command-center knowledge base: concept files promoted to path identity, index listings stripped of frontmatter, all wikilinks/relative links resolved, every checkable claim verified against the live fleet (Dankserver = Ryzen 7 7700X + RTX 3090; Strix Halo is Dankclaw), unverifiable claims tagged. kb-lint exits 0.
2.3 KiB
type, title, description, tags, timestamp, verified
| type | title | description | tags | timestamp | verified | |||||
|---|---|---|---|---|---|---|---|---|---|---|
| reference | Terraform and OpenTofu | Current best practices for Terraform and OpenTofu - module structure, state management, backends, and orchestration. |
|
2026-08-11 | 2026-08-28 |
Terraform and OpenTofu
This page covers current (2025/2026) best practices for Terraform and OpenTofu.
OpenTofu vs Terraform
OpenTofu is the open-source fork of Terraform. It uses the MPL 2.0 license. Terraform moved to the Business Source License. Both remain compatible with the same configurations and most providers.
Use OpenTofu when license portability matters. Use Terraform when you need HashiCorp's commercial extensions.
Module Structure
Separate infrastructure into layers:
infrastructure/
├── modules/ # Reusable building blocks
└── environments/
├── dev/
├── stage/
└── prod/
Environment modules call the reusable modules. Root modules declare providers and the backend.
State Management
Never commit .tfstate to version control. Use a remote backend only.
The AWS remote backend uses S3 and DynamoDB:
bucketfor the state bucket.keyfor the state file path.dynamodb_tablefor state locking.encryptfor encryption at rest.
Enable versioning and server-side encryption on the state bucket.
Use separate state files per environment. Do not use workspaces for separate environments.
Security and Lifecycle
- Mark sensitive values with
sensitive = true. - Pin provider versions with
required_providers. - Run
terraform importto adopt existing infrastructure. - Run
terraform planperiodically to detect drift. - Use lifecycle blocks for resource replacement policies.
Related Tools
- Terragrunt for orchestration: DRY config, hooks, and run queues.
- Pulumi for infrastructure as code in real programming languages.
- Packer for building machine images.
- Atlantis for pull request based Terraform CI/CD.