Frank
02883d3ed2
Copy of the legacy ~/.pi/agent/docs tree rebuilt as the command-center knowledge base: concept files promoted to path identity, index listings stripped of frontmatter, all wikilinks/relative links resolved, every checkable claim verified against the live fleet (Dankserver = Ryzen 7 7700X + RTX 3090; Strix Halo is Dankclaw), unverifiable claims tagged. kb-lint exits 0.
80 lines
2.3 KiB
Markdown
80 lines
2.3 KiB
Markdown
---
|
|
type: reference
|
|
title: Terraform and OpenTofu
|
|
description: Current best practices for Terraform and OpenTofu - module structure, state management, backends, and orchestration.
|
|
tags:
|
|
- terraform
|
|
- opentofu
|
|
- iac
|
|
- infrastructure
|
|
- engineering
|
|
timestamp: 2026-08-11
|
|
verified: 2026-08-28
|
|
---
|
|
# Terraform and OpenTofu
|
|
|
|
This page covers current (2025/2026) best practices for Terraform and OpenTofu.
|
|
|
|
## OpenTofu vs Terraform
|
|
|
|
OpenTofu is the open-source fork of Terraform. It uses the MPL 2.0 license. Terraform moved to the Business Source License. Both remain compatible with the same configurations and most providers.
|
|
|
|
Use OpenTofu when license portability matters. Use Terraform when you need HashiCorp's commercial extensions.
|
|
|
|
## Module Structure
|
|
|
|
Separate infrastructure into layers:
|
|
|
|
```
|
|
infrastructure/
|
|
├── modules/ # Reusable building blocks
|
|
└── environments/
|
|
├── dev/
|
|
├── stage/
|
|
└── prod/
|
|
```
|
|
|
|
Environment modules call the reusable modules. Root modules declare providers and the backend.
|
|
|
|
## State Management
|
|
|
|
Never commit `.tfstate` to version control. Use a remote backend only.
|
|
|
|
The AWS remote backend uses S3 and DynamoDB:
|
|
|
|
* `bucket` for the state bucket.
|
|
* `key` for the state file path.
|
|
* `dynamodb_table` for state locking.
|
|
* `encrypt` for encryption at rest.
|
|
|
|
Enable versioning and server-side encryption on the state bucket.
|
|
|
|
Use separate state files per environment. Do not use workspaces for separate environments.
|
|
|
|
## Security and Lifecycle
|
|
|
|
* Mark sensitive values with `sensitive = true`.
|
|
* Pin provider versions with `required_providers`.
|
|
* Run `terraform import` to adopt existing infrastructure.
|
|
* Run `terraform plan` periodically to detect drift.
|
|
* Use lifecycle blocks for resource replacement policies.
|
|
|
|
## Related Tools
|
|
|
|
* Terragrunt for orchestration: DRY config, hooks, and run queues.
|
|
* Pulumi for infrastructure as code in real programming languages.
|
|
* Packer for building machine images.
|
|
* Atlantis for pull request based Terraform CI/CD.
|
|
|
|
## Citations
|
|
|
|
* [Terraform documentation](https://developer.hashicorp.com/terraform)
|
|
* [OpenTofu](https://opentofu.org/)
|
|
* [Terragrunt](https://terragrunt.com/)
|
|
* [AWS backend](https://developer.hashicorp.com/terraform/language/settings/backends/s3)
|
|
|
|
## See Also
|
|
|
|
* [Cloud Providers](cloud.md)
|
|
* [Kubernetes](kubernetes.md)
|