feat: more iac #46

zackpollard · 2024-06-05T11:47:49Z

Github IAC
R2 container

TODO:
1password iac

github-actions · 2024-06-05T11:48:34Z

Execution result of "run-all plan" in "deployment/modules/cloudflare"

time=2024-06-05T11:48:10Z level=info msg=The stack at /github/workspace/deployment/modules/cloudflare will be processed in the following order for command plan:
Group 1
- Module /github/workspace/deployment/modules/cloudflare/api-keys

Group 2
- Module /github/workspace/deployment/modules/cloudflare/account


time=2024-06-05T11:48:10Z level=info msg=Downloading Terraform configurations from file:///github/workspace/deployment/modules/cloudflare/api-keys into /github/workspace/deployment/modules/cloudflare/api-keys/.terragrunt-cache/TFVDVlSA5SsBH5Wly1xPTUuJJPM/bTr-O2m_pTIZuQ2gkmEyYMvp2pA prefix=[/github/workspace/deployment/modules/cloudflare/api-keys] 

Initializing the backend...

Successfully configured the backend "pg"! OpenTofu will automatically
use this backend unless the backend configuration changes.

Initializing provider plugins...
- Reusing previous version of cloudflare/cloudflare from the dependency lock file
- Installing cloudflare/cloudflare v4.34.0...
- Installed cloudflare/cloudflare v4.34.0 (signed, key ID C76001609EE3B136)

Providers are signed by their developers.
If you'd like to know more about provider signing, you can read about it here:
https://opentofu.org/docs/cli/plugins/signing/

OpenTofu has been successfully initialized!
data.cloudflare_api_token_permission_groups.all: Reading...
cloudflare_api_token.mich_cloudflare_token: Refreshing state... [id=0fe963ede76902976c92f2470115b71b]
data.cloudflare_api_token_permission_groups.all: Read complete after 0s [id=bb20dc5cc9aef2087aa6f764330e0f69]
cloudflare_api_token.terraform_cloudflare_pages_upload: Refreshing state... [id=3b1d2c2eb5dde9b32b0513f4bb22e5be]
cloudflare_api_token.terraform_cloudflare_docs: Refreshing state... [id=2c53cc4981aac350370f2be87419a5c7]
cloudflare_api_token.terraform_cloudflare_account: Refreshing state... [id=ec09021dcc0b5d8a490d0730d3ad193d]

OpenTofu used the selected providers to generate the following execution
plan. Resource actions are indicated with the following symbols:
  + create
  - destroy

OpenTofu will perform the following actions:

  # cloudflare_api_token.mich_cloudflare_r2_token will be created
  + resource "cloudflare_api_token" "mich_cloudflare_r2_token" {
      + id          = (known after apply)
      + issued_on   = (known after apply)
      + modified_on = (known after apply)
      + name        = "mich_r2_token"
      + status      = (known after apply)
      + value       = (sensitive value)

      + condition {
          + request_ip {
              + in = [
                  + "162.55.86.82/24",
                ]
            }
        }

      + policy {
          + effect            = "allow"
          + permission_groups = [
              + "2efd5506f9c8494dacb1fa10a3e7d5b6",
            ]
          + resources         = {
              + "com.cloudflare.edge.r2.bucket.*" = "*"
            }
        }
    }

  # cloudflare_api_token.mich_cloudflare_token will be destroyed
  # (because cloudflare_api_token.mich_cloudflare_token is not in configuration)
  - resource "cloudflare_api_token" "mich_cloudflare_token" {
      - id          = "0fe963ede76902976c92f2470115b71b" -> null
      - issued_on   = "2024-06-03T11:54:52Z" -> null
      - modified_on = "2024-06-03T11:54:52Z" -> null
      - name        = "mich_r2_token" -> null
      - status      = "active" -> null
      - value       = (sensitive value) -> null

      - condition {
          - request_ip {
              - in     = [
                  - "162.55.86.82/24",
                ] -> null
              - not_in = [] -> null
            }
        }

      - policy {
          - effect            = "allow" -> null
          - permission_groups = [
              - "2efd5506f9c8494dacb1fa10a3e7d5b6",
            ] -> null
          - resources         = {
              - "com.cloudflare.edge.r2.bucket.*" = "*"
            } -> null
        }
    }

Plan: 1 to add, 0 to change, 1 to destroy.

Changes to Outputs:
  + mich_cloudflare_r2_token_id           = (sensitive value)
  + mich_cloudflare_r2_token_value        = (sensitive value)
  - mich_cloudflare_token_id              = (sensitive value) -> null
  - mich_cloudflare_token_value           = (sensitive value) -> null
time=2024-06-05T11:48:17Z level=info msg=Downloading Terraform configurations from file:///github/workspace/deployment/modules/cloudflare/account into /github/workspace/deployment/modules/cloudflare/account/.terragrunt-cache/ViIwJVqOi819kqZ36VVuOJy6bPE/Am9lfe1IU0ZwMZddtsARYYEARwE prefix=[/github/workspace/deployment/modules/cloudflare/account] 

Initializing the backend...

Successfully configured the backend "pg"! OpenTofu will automatically
use this backend unless the backend configuration changes.

Initializing provider plugins...
- terraform.io/builtin/terraform is built in to OpenTofu
- Reusing previous version of cloudflare/cloudflare from the dependency lock file
- Installing cloudflare/cloudflare v4.34.0...
- Installed cloudflare/cloudflare v4.34.0 (signed, key ID C76001609EE3B136)

Providers are signed by their developers.
If you'd like to know more about provider signing, you can read about it here:
https://opentofu.org/docs/cli/plugins/signing/

OpenTofu has been successfully initialized!
data.terraform_remote_state.api_keys_state: Reading...
data.terraform_remote_state.api_keys_state: Read complete after 2s
cloudflare_zone.immich_cloud: Refreshing state... [id=12b623403e6269c077cf8abe75df1383]
cloudflare_zone.immich_app: Refreshing state... [id=44063ef29305ea931e687178bc94d9c0]
cloudflare_record.immich_app_a_preview: Refreshing state... [id=dbd64a89ef0162d93cb5e4b96db478a0]
cloudflare_pages_project.immich_app_archive: Refreshing state... [id=immich-app-archive]
cloudflare_record.immich_app_a_testing: Refreshing state... [id=82a56a72ac5e35f8d2dd2ad704c0a920]
cloudflare_pages_project.immich_app_preview: Refreshing state... [id=immich-app-preview]
cloudflare_record.immich_app_a_star_dot_preview: Refreshing state... [id=4424193cef2e4dd3f2770fb85e8db98c]
cloudflare_pages_project.immich_app: Refreshing state... [id=immich-app]
cloudflare_record.immich_cloud_a_mich: Refreshing state... [id=a122e9564b666b5b37e3dac766b473f6]
cloudflare_record.immich_cloud_cname_star_dot_root: Refreshing state... [id=84483aa1d6904513536b23be07b6c355]
cloudflare_record.immich_cloud_cname_root: Refreshing state... [id=894cdac356c34540b4f03efa06623e44]
cloudflare_zone_settings_override.immich_cloud: Refreshing state... [id=12b623403e6269c077cf8abe75df1383]
cloudflare_record.immich_app_a_demo: Refreshing state... [id=7fceae38ca564a86052ab452ad7afc5d]
cloudflare_record.immich_app_aaaa_docs: Refreshing state... [id=8efbc50d88398aac86c25f09e090b0ea]
cloudflare_record.immich_app_mx_root_35: Refreshing state... [id=9f935cb3c92033823f44c9a7a40a6db1]
cloudflare_record.immich_app_cname__domainconnect: Refreshing state... [id=4f551a245cd261358504c416456689c9]
cloudflare_record.immich_app_mx_root_73: Refreshing state... [id=68ee5b26ca9d9db5259767780b0b2dd1]
cloudflare_record.immich_app_aaaa_documentation: Refreshing state... [id=e26765f012e0696da7d18f996080d080]
cloudflare_record.immich_app_mx_root_54: Refreshing state... [id=95689119c10f73ef70e93544b0989cb9]
cloudflare_zone_settings_override.immich_app: Refreshing state... [id=44063ef29305ea931e687178bc94d9c0]
cloudflare_record.immich_app_txt_root_cloudflare_mx: Refreshing state... [id=5af8a940e3678ac68393f6ee8539348d]
cloudflare_record.immich_app_txt_1password_verification: Refreshing state... [id=04023e1bf3b43f9db0bf108c9ed99149]
cloudflare_ruleset.immich_app_redirects: Refreshing state... [id=9a71791e55a44e89b81f4da4f5fdf195]

OpenTofu used the selected providers to generate the following execution
plan. Resource actions are indicated with the following symbols:
  + create
  ~ update in-place
  - destroy

OpenTofu will perform the following actions:

  # cloudflare_pages_project.immich_app will be updated in-place
  ~ resource "cloudflare_pages_project" "immich_app" {
        id                = "immich-app"
        name              = "immich-app"
        # (5 unchanged attributes hidden)

      - build_config {
          - build_caching = false -> null
        }

        # (1 unchanged block hidden)
    }

  # cloudflare_r2_bucket.mich-backups will be created
  + resource "cloudflare_r2_bucket" "mich-backups" {
      + account_id = "601adaaa1eab190cdfe2945f9a6c89d0"
      + id         = (known after apply)
      + location   = "weur"
      + name       = "mich-backups"
    }

  # cloudflare_record.immich_app_a_preview will be destroyed
  # (because cloudflare_record.immich_app_a_preview is not in configuration)
  - resource "cloudflare_record" "immich_app_a_preview" {
      - created_on  = "2024-05-22T16:09:31.670257Z" -> null
      - hostname    = "preview.immich.app" -> null
      - id          = "dbd64a89ef0162d93cb5e4b96db478a0" -> null
      - metadata    = {
          - "auto_added"             = "false"
          - "managed_by_apps"        = "false"
          - "managed_by_argo_tunnel" = "false"
        } -> null
      - modified_on = "2024-05-22T16:10:01.524182Z" -> null
      - name        = "preview" -> null
      - proxiable   = true -> null
      - proxied     = false -> null
      - tags        = [] -> null
      - ttl         = 1 -> null
      - type        = "A" -> null
      - value       = "141.144.207.87" -> null
      - zone_id     = "44063ef29305ea931e687178bc94d9c0" -> null
    }

  # cloudflare_record.immich_app_a_star_dot_preview will be destroyed
  # (because cloudflare_record.immich_app_a_star_dot_preview is not in configuration)
  - resource "cloudflare_record" "immich_app_a_star_dot_preview" {
      - created_on  = "2024-05-22T16:09:31.652703Z" -> null
      - hostname    = "*.preview.immich.app" -> null
      - id          = "4424193cef2e4dd3f2770fb85e8db98c" -> null
      - metadata    = {
          - "auto_added"             = "false"
          - "managed_by_apps"        = "false"
          - "managed_by_argo_tunnel" = "false"
        } -> null
      - modified_on = "2024-05-22T16:09:56.711377Z" -> null
      - name        = "*.preview" -> null
      - proxiable   = true -> null
      - proxied     = false -> null
      - tags        = [] -> null
      - ttl         = 1 -> null
      - type        = "A" -> null
      - value       = "141.144.207.87" -> null
      - zone_id     = "44063ef29305ea931e687178bc94d9c0" -> null
    }

  # cloudflare_record.immich_app_a_testing will be destroyed
  # (because cloudflare_record.immich_app_a_testing is not in configuration)
  - resource "cloudflare_record" "immich_app_a_testing" {
      - created_on  = "2024-05-22T16:09:31.679391Z" -> null
      - hostname    = "testing.immich.app" -> null
      - id          = "82a56a72ac5e35f8d2dd2ad704c0a920" -> null
      - metadata    = {
          - "auto_added"             = "false"
          - "managed_by_apps"        = "false"
          - "managed_by_argo_tunnel" = "false"
        } -> null
      - modified_on = "2024-05-22T16:09:31.679391Z" -> null
      - name        = "testing" -> null
      - proxiable   = true -> null
      - proxied     = true -> null
      - tags        = [] -> null
      - ttl         = 1 -> null
      - type        = "A" -> null
      - value       = "143.198.72.84" -> null
      - zone_id     = "44063ef29305ea931e687178bc94d9c0" -> null
    }

Plan: 1 to add, 1 to change, 3 to destroy.

jrasm91

Can you add new lines to the end of all your files?

zackpollard · 2024-06-05T12:19:24Z

Can you add new lines to the end of all your files?

Yea it's kind of annoying that terraform and terragrunt fmt don't deal with this

bo0tzz · 2024-06-05T12:31:52Z

While we're here - it seems to me like the tf plan comment has a lot of extraneous info. If that is indeed the case (obvs I don't know tofu), is it possible to limit that to just the "OpenTofu will perform the following actions: (...)" bit?

zackpollard · 2024-06-05T13:12:19Z

While we're here - it seems to me like the tf plan comment has a lot of extraneous info. If that is indeed the case (obvs I don't know tofu), is it possible to limit that to just the "OpenTofu will perform the following actions: (...)" bit?

We already spoke about this on discord, it's not possible with this github action and I don't plan on looking into shortening it as realistically it's not an issue, just a bit annoying

github-actions · 2024-06-05T13:28:34Z

Execution result of "run-all plan" in "deployment/modules/cloudflare"

time=2024-06-05T13:28:10Z level=info msg=The stack at /github/workspace/deployment/modules/cloudflare will be processed in the following order for command plan:
Group 1
- Module /github/workspace/deployment/modules/cloudflare/api-keys

Group 2
- Module /github/workspace/deployment/modules/cloudflare/account


time=2024-06-05T13:28:10Z level=info msg=Downloading Terraform configurations from file:///github/workspace/deployment/modules/cloudflare/api-keys into /github/workspace/deployment/modules/cloudflare/api-keys/.terragrunt-cache/TFVDVlSA5SsBH5Wly1xPTUuJJPM/bTr-O2m_pTIZuQ2gkmEyYMvp2pA prefix=[/github/workspace/deployment/modules/cloudflare/api-keys] 

Initializing the backend...

Successfully configured the backend "pg"! OpenTofu will automatically
use this backend unless the backend configuration changes.

Initializing provider plugins...
- Reusing previous version of cloudflare/cloudflare from the dependency lock file
- Installing cloudflare/cloudflare v4.34.0...
- Installed cloudflare/cloudflare v4.34.0 (signed, key ID C76001609EE3B136)

Providers are signed by their developers.
If you'd like to know more about provider signing, you can read about it here:
https://opentofu.org/docs/cli/plugins/signing/

OpenTofu has been successfully initialized!
data.cloudflare_api_token_permission_groups.all: Reading...
cloudflare_api_token.mich_cloudflare_token: Refreshing state... [id=0fe963ede76902976c92f2470115b71b]
data.cloudflare_api_token_permission_groups.all: Read complete after 0s [id=bb20dc5cc9aef2087aa6f764330e0f69]
cloudflare_api_token.terraform_cloudflare_pages_upload: Refreshing state... [id=3b1d2c2eb5dde9b32b0513f4bb22e5be]
cloudflare_api_token.terraform_cloudflare_docs: Refreshing state... [id=2c53cc4981aac350370f2be87419a5c7]
cloudflare_api_token.terraform_cloudflare_account: Refreshing state... [id=ec09021dcc0b5d8a490d0730d3ad193d]

OpenTofu used the selected providers to generate the following execution
plan. Resource actions are indicated with the following symbols:
  + create
  - destroy

OpenTofu will perform the following actions:

  # cloudflare_api_token.mich_cloudflare_r2_token will be created
  + resource "cloudflare_api_token" "mich_cloudflare_r2_token" {
      + id          = (known after apply)
      + issued_on   = (known after apply)
      + modified_on = (known after apply)
      + name        = "mich_r2_token"
      + status      = (known after apply)
      + value       = (sensitive value)

      + condition {
          + request_ip {
              + in = [
                  + "162.55.86.82/24",
                ]
            }
        }

      + policy {
          + effect            = "allow"
          + permission_groups = [
              + "2efd5506f9c8494dacb1fa10a3e7d5b6",
            ]
          + resources         = {
              + "com.cloudflare.edge.r2.bucket.*" = "*"
            }
        }
    }

  # cloudflare_api_token.mich_cloudflare_token will be destroyed
  # (because cloudflare_api_token.mich_cloudflare_token is not in configuration)
  - resource "cloudflare_api_token" "mich_cloudflare_token" {
      - id          = "0fe963ede76902976c92f2470115b71b" -> null
      - issued_on   = "2024-06-03T11:54:52Z" -> null
      - modified_on = "2024-06-03T11:54:52Z" -> null
      - name        = "mich_r2_token" -> null
      - status      = "active" -> null
      - value       = (sensitive value) -> null

      - condition {
          - request_ip {
              - in     = [
                  - "162.55.86.82/24",
                ] -> null
              - not_in = [] -> null
            }
        }

      - policy {
          - effect            = "allow" -> null
          - permission_groups = [
              - "2efd5506f9c8494dacb1fa10a3e7d5b6",
            ] -> null
          - resources         = {
              - "com.cloudflare.edge.r2.bucket.*" = "*"
            } -> null
        }
    }

Plan: 1 to add, 0 to change, 1 to destroy.

Changes to Outputs:
  + mich_cloudflare_r2_token_id           = (sensitive value)
  + mich_cloudflare_r2_token_value        = (sensitive value)
  - mich_cloudflare_token_id              = (sensitive value) -> null
  - mich_cloudflare_token_value           = (sensitive value) -> null
time=2024-06-05T13:28:17Z level=info msg=Downloading Terraform configurations from file:///github/workspace/deployment/modules/cloudflare/account into /github/workspace/deployment/modules/cloudflare/account/.terragrunt-cache/ViIwJVqOi819kqZ36VVuOJy6bPE/Am9lfe1IU0ZwMZddtsARYYEARwE prefix=[/github/workspace/deployment/modules/cloudflare/account] 

Initializing the backend...

Successfully configured the backend "pg"! OpenTofu will automatically
use this backend unless the backend configuration changes.

Initializing provider plugins...
- terraform.io/builtin/terraform is built in to OpenTofu
- Reusing previous version of cloudflare/cloudflare from the dependency lock file
- Installing cloudflare/cloudflare v4.34.0...
- Installed cloudflare/cloudflare v4.34.0 (signed, key ID C76001609EE3B136)

Providers are signed by their developers.
If you'd like to know more about provider signing, you can read about it here:
https://opentofu.org/docs/cli/plugins/signing/

OpenTofu has been successfully initialized!
data.terraform_remote_state.api_keys_state: Reading...
data.terraform_remote_state.api_keys_state: Read complete after 1s
cloudflare_pages_project.immich_app_archive: Refreshing state... [id=immich-app-archive]
cloudflare_record.immich_app_a_preview: Refreshing state... [id=dbd64a89ef0162d93cb5e4b96db478a0]
cloudflare_record.immich_app_a_testing: Refreshing state... [id=82a56a72ac5e35f8d2dd2ad704c0a920]
cloudflare_zone.immich_cloud: Refreshing state... [id=12b623403e6269c077cf8abe75df1383]
cloudflare_record.immich_app_a_star_dot_preview: Refreshing state... [id=4424193cef2e4dd3f2770fb85e8db98c]
cloudflare_zone.immich_app: Refreshing state... [id=44063ef29305ea931e687178bc94d9c0]
cloudflare_pages_project.immich_app_preview: Refreshing state... [id=immich-app-preview]
cloudflare_pages_project.immich_app: Refreshing state... [id=immich-app]
cloudflare_record.immich_app_cname__domainconnect: Refreshing state... [id=4f551a245cd261358504c416456689c9]
cloudflare_record.immich_app_txt_1password_verification: Refreshing state... [id=04023e1bf3b43f9db0bf108c9ed99149]
cloudflare_ruleset.immich_app_redirects: Refreshing state... [id=9a71791e55a44e89b81f4da4f5fdf195]
cloudflare_zone_settings_override.immich_app: Refreshing state... [id=44063ef29305ea931e687178bc94d9c0]
cloudflare_record.immich_app_aaaa_documentation: Refreshing state... [id=e26765f012e0696da7d18f996080d080]
cloudflare_record.immich_app_mx_root_35: Refreshing state... [id=9f935cb3c92033823f44c9a7a40a6db1]
cloudflare_record.immich_app_mx_root_54: Refreshing state... [id=95689119c10f73ef70e93544b0989cb9]
cloudflare_record.immich_app_a_demo: Refreshing state... [id=7fceae38ca564a86052ab452ad7afc5d]
cloudflare_record.immich_app_txt_root_cloudflare_mx: Refreshing state... [id=5af8a940e3678ac68393f6ee8539348d]
cloudflare_record.immich_app_mx_root_73: Refreshing state... [id=68ee5b26ca9d9db5259767780b0b2dd1]
cloudflare_record.immich_app_aaaa_docs: Refreshing state... [id=8efbc50d88398aac86c25f09e090b0ea]
cloudflare_record.immich_cloud_a_mich: Refreshing state... [id=a122e9564b666b5b37e3dac766b473f6]
cloudflare_record.immich_cloud_cname_star_dot_root: Refreshing state... [id=84483aa1d6904513536b23be07b6c355]
cloudflare_record.immich_cloud_cname_root: Refreshing state... [id=894cdac356c34540b4f03efa06623e44]
cloudflare_zone_settings_override.immich_cloud: Refreshing state... [id=12b623403e6269c077cf8abe75df1383]

OpenTofu used the selected providers to generate the following execution
plan. Resource actions are indicated with the following symbols:
  + create
  ~ update in-place
  - destroy

OpenTofu will perform the following actions:

  # cloudflare_pages_project.immich_app will be updated in-place
  ~ resource "cloudflare_pages_project" "immich_app" {
        id                = "immich-app"
        name              = "immich-app"
        # (5 unchanged attributes hidden)

      - build_config {
          - build_caching = false -> null
        }

        # (1 unchanged block hidden)
    }

  # cloudflare_r2_bucket.mich-backups will be created
  + resource "cloudflare_r2_bucket" "mich-backups" {
      + account_id = "601adaaa1eab190cdfe2945f9a6c89d0"
      + id         = (known after apply)
      + location   = "weur"
      + name       = "mich-backups"
    }

  # cloudflare_record.immich_app_a_preview will be destroyed
  # (because cloudflare_record.immich_app_a_preview is not in configuration)
  - resource "cloudflare_record" "immich_app_a_preview" {
      - created_on  = "2024-05-22T16:09:31.670257Z" -> null
      - hostname    = "preview.immich.app" -> null
      - id          = "dbd64a89ef0162d93cb5e4b96db478a0" -> null
      - metadata    = {
          - "auto_added"             = "false"
          - "managed_by_apps"        = "false"
          - "managed_by_argo_tunnel" = "false"
        } -> null
      - modified_on = "2024-05-22T16:10:01.524182Z" -> null
      - name        = "preview" -> null
      - proxiable   = true -> null
      - proxied     = false -> null
      - tags        = [] -> null
      - ttl         = 1 -> null
      - type        = "A" -> null
      - value       = "141.144.207.87" -> null
      - zone_id     = "44063ef29305ea931e687178bc94d9c0" -> null
    }

  # cloudflare_record.immich_app_a_star_dot_preview will be destroyed
  # (because cloudflare_record.immich_app_a_star_dot_preview is not in configuration)
  - resource "cloudflare_record" "immich_app_a_star_dot_preview" {
      - created_on  = "2024-05-22T16:09:31.652703Z" -> null
      - hostname    = "*.preview.immich.app" -> null
      - id          = "4424193cef2e4dd3f2770fb85e8db98c" -> null
      - metadata    = {
          - "auto_added"             = "false"
          - "managed_by_apps"        = "false"
          - "managed_by_argo_tunnel" = "false"
        } -> null
      - modified_on = "2024-05-22T16:09:56.711377Z" -> null
      - name        = "*.preview" -> null
      - proxiable   = true -> null
      - proxied     = false -> null
      - tags        = [] -> null
      - ttl         = 1 -> null
      - type        = "A" -> null
      - value       = "141.144.207.87" -> null
      - zone_id     = "44063ef29305ea931e687178bc94d9c0" -> null
    }

  # cloudflare_record.immich_app_a_testing will be destroyed
  # (because cloudflare_record.immich_app_a_testing is not in configuration)
  - resource "cloudflare_record" "immich_app_a_testing" {
      - created_on  = "2024-05-22T16:09:31.679391Z" -> null
      - hostname    = "testing.immich.app" -> null
      - id          = "82a56a72ac5e35f8d2dd2ad704c0a920" -> null
      - metadata    = {
          - "auto_added"             = "false"
          - "managed_by_apps"        = "false"
          - "managed_by_argo_tunnel" = "false"
        } -> null
      - modified_on = "2024-05-22T16:09:31.679391Z" -> null
      - name        = "testing" -> null
      - proxiable   = true -> null
      - proxied     = true -> null
      - tags        = [] -> null
      - ttl         = 1 -> null
      - type        = "A" -> null
      - value       = "143.198.72.84" -> null
      - zone_id     = "44063ef29305ea931e687178bc94d9c0" -> null
    }

Plan: 1 to add, 1 to change, 3 to destroy.

github-actions · 2024-06-05T13:31:51Z

Execution result of "run-all plan" in "deployment/modules/cloudflare"

time=2024-06-05T13:31:21Z level=info msg=The stack at /github/workspace/deployment/modules/cloudflare will be processed in the following order for command plan:
Group 1
- Module /github/workspace/deployment/modules/cloudflare/api-keys

Group 2
- Module /github/workspace/deployment/modules/cloudflare/account


time=2024-06-05T13:31:21Z level=info msg=Downloading Terraform configurations from file:///github/workspace/deployment/modules/cloudflare/api-keys into /github/workspace/deployment/modules/cloudflare/api-keys/.terragrunt-cache/TFVDVlSA5SsBH5Wly1xPTUuJJPM/bTr-O2m_pTIZuQ2gkmEyYMvp2pA prefix=[/github/workspace/deployment/modules/cloudflare/api-keys] 

Initializing the backend...

Successfully configured the backend "pg"! OpenTofu will automatically
use this backend unless the backend configuration changes.

Initializing provider plugins...
- Reusing previous version of cloudflare/cloudflare from the dependency lock file
- Installing cloudflare/cloudflare v4.34.0...
- Installed cloudflare/cloudflare v4.34.0 (signed, key ID C76001609EE3B136)

Providers are signed by their developers.
If you'd like to know more about provider signing, you can read about it here:
https://opentofu.org/docs/cli/plugins/signing/

OpenTofu has been successfully initialized!
Acquiring state lock. This may take a few moments...
data.cloudflare_api_token_permission_groups.all: Reading...
cloudflare_api_token.mich_cloudflare_token: Refreshing state... [id=0fe963ede76902976c92f2470115b71b]
data.cloudflare_api_token_permission_groups.all: Read complete after 0s [id=bb20dc5cc9aef2087aa6f764330e0f69]
cloudflare_api_token.terraform_cloudflare_pages_upload: Refreshing state... [id=3b1d2c2eb5dde9b32b0513f4bb22e5be]
cloudflare_api_token.terraform_cloudflare_docs: Refreshing state... [id=2c53cc4981aac350370f2be87419a5c7]
cloudflare_api_token.terraform_cloudflare_account: Refreshing state... [id=ec09021dcc0b5d8a490d0730d3ad193d]

OpenTofu used the selected providers to generate the following execution
plan. Resource actions are indicated with the following symbols:
  + create
  - destroy

OpenTofu will perform the following actions:

  # cloudflare_api_token.mich_cloudflare_r2_token will be created
  + resource "cloudflare_api_token" "mich_cloudflare_r2_token" {
      + id          = (known after apply)
      + issued_on   = (known after apply)
      + modified_on = (known after apply)
      + name        = "mich_r2_token"
      + status      = (known after apply)
      + value       = (sensitive value)

      + condition {
          + request_ip {
              + in = [
                  + "162.55.86.82/24",
                ]
            }
        }

      + policy {
          + effect            = "allow"
          + permission_groups = [
              + "2efd5506f9c8494dacb1fa10a3e7d5b6",
            ]
          + resources         = {
              + "com.cloudflare.edge.r2.bucket.*" = "*"
            }
        }
    }

  # cloudflare_api_token.mich_cloudflare_token will be destroyed
  # (because cloudflare_api_token.mich_cloudflare_token is not in configuration)
  - resource "cloudflare_api_token" "mich_cloudflare_token" {
      - id          = "0fe963ede76902976c92f2470115b71b" -> null
      - issued_on   = "2024-06-03T11:54:52Z" -> null
      - modified_on = "2024-06-03T11:54:52Z" -> null
      - name        = "mich_r2_token" -> null
      - status      = "active" -> null
      - value       = (sensitive value) -> null

      - condition {
          - request_ip {
              - in     = [
                  - "162.55.86.82/24",
                ] -> null
              - not_in = [] -> null
            }
        }

      - policy {
          - effect            = "allow" -> null
          - permission_groups = [
              - "2efd5506f9c8494dacb1fa10a3e7d5b6",
            ] -> null
          - resources         = {
              - "com.cloudflare.edge.r2.bucket.*" = "*"
            } -> null
        }
    }

Plan: 1 to add, 0 to change, 1 to destroy.

Changes to Outputs:
  + mich_cloudflare_r2_token_id           = (sensitive value)
  + mich_cloudflare_r2_token_value        = (sensitive value)
  - mich_cloudflare_token_id              = (sensitive value) -> null
  - mich_cloudflare_token_value           = (sensitive value) -> null
time=2024-06-05T13:31:31Z level=info msg=Downloading Terraform configurations from file:///github/workspace/deployment/modules/cloudflare/account into /github/workspace/deployment/modules/cloudflare/account/.terragrunt-cache/ViIwJVqOi819kqZ36VVuOJy6bPE/Am9lfe1IU0ZwMZddtsARYYEARwE prefix=[/github/workspace/deployment/modules/cloudflare/account] 

Initializing the backend...

Successfully configured the backend "pg"! OpenTofu will automatically
use this backend unless the backend configuration changes.

Initializing provider plugins...
- terraform.io/builtin/terraform is built in to OpenTofu
- Reusing previous version of cloudflare/cloudflare from the dependency lock file
- Installing cloudflare/cloudflare v4.34.0...
- Installed cloudflare/cloudflare v4.34.0 (signed, key ID C76001609EE3B136)

Providers are signed by their developers.
If you'd like to know more about provider signing, you can read about it here:
https://opentofu.org/docs/cli/plugins/signing/

OpenTofu has been successfully initialized!
Acquiring state lock. This may take a few moments...
data.terraform_remote_state.api_keys_state: Reading...
data.terraform_remote_state.api_keys_state: Read complete after 3s
cloudflare_record.immich_app_a_testing: Refreshing state... [id=82a56a72ac5e35f8d2dd2ad704c0a920]
cloudflare_record.immich_app_a_star_dot_preview: Refreshing state... [id=4424193cef2e4dd3f2770fb85e8db98c]
cloudflare_zone.immich_cloud: Refreshing state... [id=12b623403e6269c077cf8abe75df1383]
cloudflare_zone.immich_app: Refreshing state... [id=44063ef29305ea931e687178bc94d9c0]
cloudflare_record.immich_app_a_preview: Refreshing state... [id=dbd64a89ef0162d93cb5e4b96db478a0]
cloudflare_pages_project.immich_app_preview: Refreshing state... [id=immich-app-preview]
cloudflare_pages_project.immich_app_archive: Refreshing state... [id=immich-app-archive]
cloudflare_pages_project.immich_app: Refreshing state... [id=immich-app]
cloudflare_record.immich_cloud_a_mich: Refreshing state... [id=a122e9564b666b5b37e3dac766b473f6]
cloudflare_record.immich_cloud_cname_star_dot_root: Refreshing state... [id=84483aa1d6904513536b23be07b6c355]
cloudflare_record.immich_cloud_cname_root: Refreshing state... [id=894cdac356c34540b4f03efa06623e44]
cloudflare_zone_settings_override.immich_cloud: Refreshing state... [id=12b623403e6269c077cf8abe75df1383]
cloudflare_record.immich_app_cname__domainconnect: Refreshing state... [id=4f551a245cd261358504c416456689c9]
cloudflare_record.immich_app_aaaa_docs: Refreshing state... [id=8efbc50d88398aac86c25f09e090b0ea]
cloudflare_record.immich_app_txt_1password_verification: Refreshing state... [id=04023e1bf3b43f9db0bf108c9ed99149]
cloudflare_record.immich_app_aaaa_documentation: Refreshing state... [id=e26765f012e0696da7d18f996080d080]
cloudflare_record.immich_app_mx_root_73: Refreshing state... [id=68ee5b26ca9d9db5259767780b0b2dd1]
cloudflare_ruleset.immich_app_redirects: Refreshing state... [id=9a71791e55a44e89b81f4da4f5fdf195]
cloudflare_record.immich_app_a_demo: Refreshing state... [id=7fceae38ca564a86052ab452ad7afc5d]
cloudflare_record.immich_app_txt_root_cloudflare_mx: Refreshing state... [id=5af8a940e3678ac68393f6ee8539348d]
cloudflare_record.immich_app_mx_root_35: Refreshing state... [id=9f935cb3c92033823f44c9a7a40a6db1]
cloudflare_zone_settings_override.immich_app: Refreshing state... [id=44063ef29305ea931e687178bc94d9c0]
cloudflare_record.immich_app_mx_root_54: Refreshing state... [id=95689119c10f73ef70e93544b0989cb9]

OpenTofu used the selected providers to generate the following execution
plan. Resource actions are indicated with the following symbols:
  + create
  ~ update in-place
  - destroy

OpenTofu will perform the following actions:

  # cloudflare_pages_project.immich_app will be updated in-place
  ~ resource "cloudflare_pages_project" "immich_app" {
        id                = "immich-app"
        name              = "immich-app"
        # (5 unchanged attributes hidden)

      - build_config {
          - build_caching = false -> null
        }

        # (1 unchanged block hidden)
    }

  # cloudflare_r2_bucket.mich-backups will be created
  + resource "cloudflare_r2_bucket" "mich-backups" {
      + account_id = "601adaaa1eab190cdfe2945f9a6c89d0"
      + id         = (known after apply)
      + location   = "weur"
      + name       = "mich-backups"
    }

  # cloudflare_record.immich_app_a_preview will be destroyed
  # (because cloudflare_record.immich_app_a_preview is not in configuration)
  - resource "cloudflare_record" "immich_app_a_preview" {
      - created_on  = "2024-05-22T16:09:31.670257Z" -> null
      - hostname    = "preview.immich.app" -> null
      - id          = "dbd64a89ef0162d93cb5e4b96db478a0" -> null
      - metadata    = {
          - "auto_added"             = "false"
          - "managed_by_apps"        = "false"
          - "managed_by_argo_tunnel" = "false"
        } -> null
      - modified_on = "2024-05-22T16:10:01.524182Z" -> null
      - name        = "preview" -> null
      - proxiable   = true -> null
      - proxied     = false -> null
      - tags        = [] -> null
      - ttl         = 1 -> null
      - type        = "A" -> null
      - value       = "141.144.207.87" -> null
      - zone_id     = "44063ef29305ea931e687178bc94d9c0" -> null
    }

  # cloudflare_record.immich_app_a_star_dot_preview will be destroyed
  # (because cloudflare_record.immich_app_a_star_dot_preview is not in configuration)
  - resource "cloudflare_record" "immich_app_a_star_dot_preview" {
      - created_on  = "2024-05-22T16:09:31.652703Z" -> null
      - hostname    = "*.preview.immich.app" -> null
      - id          = "4424193cef2e4dd3f2770fb85e8db98c" -> null
      - metadata    = {
          - "auto_added"             = "false"
          - "managed_by_apps"        = "false"
          - "managed_by_argo_tunnel" = "false"
        } -> null
      - modified_on = "2024-05-22T16:09:56.711377Z" -> null
      - name        = "*.preview" -> null
      - proxiable   = true -> null
      - proxied     = false -> null
      - tags        = [] -> null
      - ttl         = 1 -> null
      - type        = "A" -> null
      - value       = "141.144.207.87" -> null
      - zone_id     = "44063ef29305ea931e687178bc94d9c0" -> null
    }

  # cloudflare_record.immich_app_a_testing will be destroyed
  # (because cloudflare_record.immich_app_a_testing is not in configuration)
  - resource "cloudflare_record" "immich_app_a_testing" {
      - created_on  = "2024-05-22T16:09:31.679391Z" -> null
      - hostname    = "testing.immich.app" -> null
      - id          = "82a56a72ac5e35f8d2dd2ad704c0a920" -> null
      - metadata    = {
          - "auto_added"             = "false"
          - "managed_by_apps"        = "false"
          - "managed_by_argo_tunnel" = "false"
        } -> null
      - modified_on = "2024-05-22T16:09:31.679391Z" -> null
      - name        = "testing" -> null
      - proxiable   = true -> null
      - proxied     = true -> null
      - tags        = [] -> null
      - ttl         = 1 -> null
      - type        = "A" -> null
      - value       = "143.198.72.84" -> null
      - zone_id     = "44063ef29305ea931e687178bc94d9c0" -> null
    }

Plan: 1 to add, 1 to change, 3 to destroy.

github-actions · 2024-06-05T14:29:10Z

Execution result of "run-all plan" in "deployment"

time=2024-06-05T14:28:34Z level=info msg=The stack at /github/workspace/deployment will be processed in the following order for command plan:
Group 1
- Module /github/workspace/deployment/modules/cloudflare/api-keys

Group 2
- Module /github/workspace/deployment/modules/cloudflare/account
- Module /github/workspace/deployment/modules/github/org


time=2024-06-05T14:28:34Z level=info msg=Downloading Terraform configurations from file:///github/workspace/deployment/modules/cloudflare/api-keys into /github/workspace/deployment/modules/cloudflare/api-keys/.terragrunt-cache/TFVDVlSA5SsBH5Wly1xPTUuJJPM/bTr-O2m_pTIZuQ2gkmEyYMvp2pA prefix=[/github/workspace/deployment/modules/cloudflare/api-keys] 

Initializing the backend...

Successfully configured the backend "pg"! OpenTofu will automatically
use this backend unless the backend configuration changes.

Initializing provider plugins...
- Reusing previous version of cloudflare/cloudflare from the dependency lock file
- Installing cloudflare/cloudflare v4.34.0...
- Installed cloudflare/cloudflare v4.34.0 (signed, key ID C76001609EE3B136)

Providers are signed by their developers.
If you'd like to know more about provider signing, you can read about it here:
https://opentofu.org/docs/cli/plugins/signing/

OpenTofu has been successfully initialized!
Acquiring state lock. This may take a few moments...
data.cloudflare_api_token_permission_groups.all: Reading...
cloudflare_api_token.mich_cloudflare_token: Refreshing state... [id=0fe963ede76902976c92f2470115b71b]
data.cloudflare_api_token_permission_groups.all: Read complete after 0s [id=bb20dc5cc9aef2087aa6f764330e0f69]
cloudflare_api_token.terraform_cloudflare_pages_upload: Refreshing state... [id=3b1d2c2eb5dde9b32b0513f4bb22e5be]
cloudflare_api_token.terraform_cloudflare_docs: Refreshing state... [id=2c53cc4981aac350370f2be87419a5c7]
cloudflare_api_token.terraform_cloudflare_account: Refreshing state... [id=ec09021dcc0b5d8a490d0730d3ad193d]

OpenTofu used the selected providers to generate the following execution
plan. Resource actions are indicated with the following symbols:
  + create
  - destroy

OpenTofu will perform the following actions:

  # cloudflare_api_token.mich_cloudflare_r2_token will be created
  + resource "cloudflare_api_token" "mich_cloudflare_r2_token" {
      + id          = (known after apply)
      + issued_on   = (known after apply)
      + modified_on = (known after apply)
      + name        = "mich_r2_token"
      + status      = (known after apply)
      + value       = (sensitive value)

      + condition {
          + request_ip {
              + in = [
                  + "162.55.86.82/24",
                ]
            }
        }

      + policy {
          + effect            = "allow"
          + permission_groups = [
              + "2efd5506f9c8494dacb1fa10a3e7d5b6",
            ]
          + resources         = {
              + "com.cloudflare.edge.r2.bucket.*" = "*"
            }
        }
    }

  # cloudflare_api_token.mich_cloudflare_token will be destroyed
  # (because cloudflare_api_token.mich_cloudflare_token is not in configuration)
  - resource "cloudflare_api_token" "mich_cloudflare_token" {
      - id          = "0fe963ede76902976c92f2470115b71b" -> null
      - issued_on   = "2024-06-03T11:54:52Z" -> null
      - modified_on = "2024-06-03T11:54:52Z" -> null
      - name        = "mich_r2_token" -> null
      - status      = "active" -> null
      - value       = (sensitive value) -> null

      - condition {
          - request_ip {
              - in     = [
                  - "162.55.86.82/24",
                ] -> null
              - not_in = [] -> null
            }
        }

      - policy {
          - effect            = "allow" -> null
          - permission_groups = [
              - "2efd5506f9c8494dacb1fa10a3e7d5b6",
            ] -> null
          - resources         = {
              - "com.cloudflare.edge.r2.bucket.*" = "*"
            } -> null
        }
    }

Plan: 1 to add, 0 to change, 1 to destroy.

Changes to Outputs:
  + mich_cloudflare_r2_token_id           = (sensitive value)
  + mich_cloudflare_r2_token_value        = (sensitive value)
  - mich_cloudflare_token_id              = (sensitive value) -> null
  - mich_cloudflare_token_value           = (sensitive value) -> null
time=2024-06-05T14:28:48Z level=info msg=Downloading Terraform configurations from file:///github/workspace/deployment/modules/github/org into /github/workspace/deployment/modules/github/org/.terragrunt-cache/fjLfy0-bfbo44op14XdvtPbOclo/rQYQ5Hh1yBhge0iwDdQXfhsp1sw prefix=[/github/workspace/deployment/modules/github/org] 
time=2024-06-05T14:28:48Z level=info msg=Downloading Terraform configurations from file:///github/workspace/deployment/modules/cloudflare/account into /github/workspace/deployment/modules/cloudflare/account/.terragrunt-cache/ViIwJVqOi819kqZ36VVuOJy6bPE/Am9lfe1IU0ZwMZddtsARYYEARwE prefix=[/github/workspace/deployment/modules/cloudflare/account] 

Initializing the backend...

Initializing the backend...

Successfully configured the backend "pg"! OpenTofu will automatically
use this backend unless the backend configuration changes.

Successfully configured the backend "pg"! OpenTofu will automatically
use this backend unless the backend configuration changes.

Initializing provider plugins...
- terraform.io/builtin/terraform is built in to OpenTofu
- Reusing previous version of integrations/github from the dependency lock file

Initializing provider plugins...
- terraform.io/builtin/terraform is built in to OpenTofu
- Reusing previous version of cloudflare/cloudflare from the dependency lock file
- Installing integrations/github v6.2.1...
- Installing cloudflare/cloudflare v4.34.0...
- Installed integrations/github v6.2.1. Signature validation was skipped due to the registry not containing GPG keys for this provider

OpenTofu has been successfully initialized!
- Installed cloudflare/cloudflare v4.34.0 (signed, key ID C76001609EE3B136)

Providers are signed by their developers.
If you'd like to know more about provider signing, you can read about it here:
https://opentofu.org/docs/cli/plugins/signing/

OpenTofu has been successfully initialized!
Acquiring state lock. This may take a few moments...
Acquiring state lock. This may take a few moments...
data.terraform_remote_state.api_keys_state: Reading...
github_actions_organization_secret.test_secret: Refreshing state... [id=test_secret]
data.terraform_remote_state.api_keys_state: Reading...
data.terraform_remote_state.api_keys_state: Read complete after 3s

OpenTofu used the selected providers to generate the following execution
plan. Resource actions are indicated with the following symbols:
  + create
  - destroy

OpenTofu will perform the following actions:

  # github_actions_organization_secret.cloudflare_api_token_pages_upload will be created
  + resource "github_actions_organization_secret" "cloudflare_api_token_pages_upload" {
      + created_at      = (known after apply)
      + id              = (known after apply)
      + plaintext_value = (sensitive value)
      + secret_name     = "CLOUDFLARE_API_TOKEN_PAGES_UPLOAD"
      + updated_at      = (known after apply)
      + visibility      = "all"
    }

  # github_actions_organization_secret.test_secret will be destroyed
  # (because github_actions_organization_secret.test_secret is not in configuration)
  - resource "github_actions_organization_secret" "test_secret" {
      - created_at              = "2024-06-03 16:42:34 +0000 UTC" -> null
      - id                      = "test_secret" -> null
      - plaintext_value         = (sensitive value) -> null
      - secret_name             = "test_secret" -> null
      - selected_repository_ids = [] -> null
      - updated_at              = "2024-06-03 16:42:34 +0000 UTC" -> null
      - visibility              = "private" -> null
    }

Plan: 1 to add, 0 to change, 1 to destroy.
data.terraform_remote_state.api_keys_state: Read complete after 3s
cloudflare_zone.immich_app: Refreshing state... [id=44063ef29305ea931e687178bc94d9c0]
cloudflare_zone.immich_cloud: Refreshing state... [id=12b623403e6269c077cf8abe75df1383]
cloudflare_record.immich_app_a_star_dot_preview: Refreshing state... [id=4424193cef2e4dd3f2770fb85e8db98c]
cloudflare_pages_project.immich_app_preview: Refreshing state... [id=immich-app-preview]
cloudflare_pages_project.immich_app_archive: Refreshing state... [id=immich-app-archive]
cloudflare_pages_project.immich_app: Refreshing state... [id=immich-app]
cloudflare_record.immich_app_a_testing: Refreshing state... [id=82a56a72ac5e35f8d2dd2ad704c0a920]
cloudflare_record.immich_app_a_preview: Refreshing state... [id=dbd64a89ef0162d93cb5e4b96db478a0]
cloudflare_record.immich_app_mx_root_35: Refreshing state... [id=9f935cb3c92033823f44c9a7a40a6db1]
cloudflare_record.immich_app_aaaa_documentation: Refreshing state... [id=e26765f012e0696da7d18f996080d080]
cloudflare_record.immich_app_aaaa_docs: Refreshing state... [id=8efbc50d88398aac86c25f09e090b0ea]
cloudflare_zone_settings_override.immich_app: Refreshing state... [id=44063ef29305ea931e687178bc94d9c0]
cloudflare_record.immich_app_txt_1password_verification: Refreshing state... [id=04023e1bf3b43f9db0bf108c9ed99149]
cloudflare_record.immich_app_mx_root_73: Refreshing state... [id=68ee5b26ca9d9db5259767780b0b2dd1]
cloudflare_record.immich_app_txt_root_cloudflare_mx: Refreshing state... [id=5af8a940e3678ac68393f6ee8539348d]
cloudflare_record.immich_app_mx_root_54: Refreshing state... [id=95689119c10f73ef70e93544b0989cb9]
cloudflare_record.immich_app_cname__domainconnect: Refreshing state... [id=4f551a245cd261358504c416456689c9]
cloudflare_record.immich_app_a_demo: Refreshing state... [id=7fceae38ca564a86052ab452ad7afc5d]
cloudflare_ruleset.immich_app_redirects: Refreshing state... [id=9a71791e55a44e89b81f4da4f5fdf195]
cloudflare_zone_settings_override.immich_cloud: Refreshing state... [id=12b623403e6269c077cf8abe75df1383]
cloudflare_record.immich_cloud_cname_root: Refreshing state... [id=894cdac356c34540b4f03efa06623e44]
cloudflare_record.immich_cloud_cname_star_dot_root: Refreshing state... [id=84483aa1d6904513536b23be07b6c355]
cloudflare_record.immich_cloud_a_mich: Refreshing state... [id=a122e9564b666b5b37e3dac766b473f6]

OpenTofu used the selected providers to generate the following execution
plan. Resource actions are indicated with the following symbols:
  + create
  ~ update in-place
  - destroy

OpenTofu will perform the following actions:

  # cloudflare_pages_project.immich_app will be updated in-place
  ~ resource "cloudflare_pages_project" "immich_app" {
        id                = "immich-app"
        name              = "immich-app"
        # (5 unchanged attributes hidden)

      - build_config {
          - build_caching = false -> null
        }

        # (1 unchanged block hidden)
    }

  # cloudflare_r2_bucket.mich-backups will be created
  + resource "cloudflare_r2_bucket" "mich-backups" {
      + account_id = "601adaaa1eab190cdfe2945f9a6c89d0"
      + id         = (known after apply)
      + location   = "weur"
      + name       = "mich-backups"
    }

  # cloudflare_record.immich_app_a_preview will be destroyed
  # (because cloudflare_record.immich_app_a_preview is not in configuration)
  - resource "cloudflare_record" "immich_app_a_preview" {
      - created_on  = "2024-05-22T16:09:31.670257Z" -> null
      - hostname    = "preview.immich.app" -> null
      - id          = "dbd64a89ef0162d93cb5e4b96db478a0" -> null
      - metadata    = {
          - "auto_added"             = "false"
          - "managed_by_apps"        = "false"
          - "managed_by_argo_tunnel" = "false"
        } -> null
      - modified_on = "2024-05-22T16:10:01.524182Z" -> null
      - name        = "preview" -> null
      - proxiable   = true -> null
      - proxied     = false -> null
      - tags        = [] -> null
      - ttl         = 1 -> null
      - type        = "A" -> null
      - value       = "141.144.207.87" -> null
      - zone_id     = "44063ef29305ea931e687178bc94d9c0" -> null
    }

  # cloudflare_record.immich_app_a_star_dot_preview will be destroyed
  # (because cloudflare_record.immich_app_a_star_dot_preview is not in configuration)
  - resource "cloudflare_record" "immich_app_a_star_dot_preview" {
      - created_on  = "2024-05-22T16:09:31.652703Z" -> null
      - hostname    = "*.preview.immich.app" -> null
      - id          = "4424193cef2e4dd3f2770fb85e8db98c" -> null
      - metadata    = {
          - "auto_added"             = "false"
          - "managed_by_apps"        = "false"
          - "managed_by_argo_tunnel" = "false"
        } -> null
      - modified_on = "2024-05-22T16:09:56.711377Z" -> null
      - name        = "*.preview" -> null
      - proxiable   = true -> null
      - proxied     = false -> null
      - tags        = [] -> null
      - ttl         = 1 -> null
      - type        = "A" -> null
      - value       = "141.144.207.87" -> null
      - zone_id     = "44063ef29305ea931e687178bc94d9c0" -> null
    }

  # cloudflare_record.immich_app_a_testing will be destroyed
  # (because cloudflare_record.immich_app_a_testing is not in configuration)
  - resource "cloudflare_record" "immich_app_a_testing" {
      - created_on  = "2024-05-22T16:09:31.679391Z" -> null
      - hostname    = "testing.immich.app" -> null
      - id          = "82a56a72ac5e35f8d2dd2ad704c0a920" -> null
      - metadata    = {
          - "auto_added"             = "false"
          - "managed_by_apps"        = "false"
          - "managed_by_argo_tunnel" = "false"
        } -> null
      - modified_on = "2024-05-22T16:09:31.679391Z" -> null
      - name        = "testing" -> null
      - proxiable   = true -> null
      - proxied     = true -> null
      - tags        = [] -> null
      - ttl         = 1 -> null
      - type        = "A" -> null
      - value       = "143.198.72.84" -> null
      - zone_id     = "44063ef29305ea931e687178bc94d9c0" -> null
    }

Plan: 1 to add, 1 to change, 3 to destroy.

deployment/example.secrets.sh

deployment/modules/cloudflare/account/r2.tf

deployment/modules/cloudflare/api-keys/locals.tf

bo0tzz · 2024-06-05T14:48:57Z

deployment/modules/github/org/secrets.tf

+resource "github_actions_organization_secret" "cloudflare_api_token_pages_upload" {
+  secret_name     = "CLOUDFLARE_API_TOKEN_PAGES_UPLOAD"
+  plaintext_value = data.terraform_remote_state.api_keys_state.outputs.terraform_key_cloudflare_pages_upload
+  visibility      = "all"


Do we (maybe later?) want to scope this to only the immich-app repo?

I've mostly been pretty lax with anything but the master keys, but we can scope this if you want to reasonably easily

github-actions · 2024-06-05T16:30:29Z

Execution result of "run-all plan" in "deployment"

time=2024-06-05T16:28:22Z level=info msg=The stack at /github/workspace/deployment will be processed in the following order for command plan:
Group 1
- Module /github/workspace/deployment/modules/cloudflare/api-keys

Group 2
- Module /github/workspace/deployment/modules/cloudflare/account
- Module /github/workspace/deployment/modules/github/org


time=2024-06-05T16:28:22Z level=info msg=Downloading Terraform configurations from file:///github/workspace/deployment/modules/cloudflare/api-keys into /github/workspace/deployment/modules/cloudflare/api-keys/.terragrunt-cache/TFVDVlSA5SsBH5Wly1xPTUuJJPM/bTr-O2m_pTIZuQ2gkmEyYMvp2pA prefix=[/github/workspace/deployment/modules/cloudflare/api-keys] 

Initializing the backend...

Successfully configured the backend "pg"! OpenTofu will automatically
use this backend unless the backend configuration changes.

Initializing provider plugins...
- Reusing previous version of cloudflare/cloudflare from the dependency lock file
- Installing cloudflare/cloudflare v4.34.0...
- Installed cloudflare/cloudflare v4.34.0 (signed, key ID C76001609EE3B136)

Providers are signed by their developers.
If you'd like to know more about provider signing, you can read about it here:
https://opentofu.org/docs/cli/plugins/signing/

OpenTofu has been successfully initialized!
data.cloudflare_api_token_permission_groups.all: Reading...
cloudflare_api_token.mich_cloudflare_token: Refreshing state... [id=0fe963ede76902976c92f2470115b71b]
data.cloudflare_api_token_permission_groups.all: Read complete after 1s [id=bb20dc5cc9aef2087aa6f764330e0f69]
cloudflare_api_token.terraform_cloudflare_account: Refreshing state... [id=ec09021dcc0b5d8a490d0730d3ad193d]
cloudflare_api_token.terraform_cloudflare_pages_upload: Refreshing state... [id=3b1d2c2eb5dde9b32b0513f4bb22e5be]
cloudflare_api_token.terraform_cloudflare_docs: Refreshing state... [id=2c53cc4981aac350370f2be87419a5c7]

OpenTofu used the selected providers to generate the following execution
plan. Resource actions are indicated with the following symbols:
  + create
  - destroy

OpenTofu will perform the following actions:

  # cloudflare_api_token.mich_cloudflare_r2_token will be created
  + resource "cloudflare_api_token" "mich_cloudflare_r2_token" {
      + id          = (known after apply)
      + issued_on   = (known after apply)
      + modified_on = (known after apply)
      + name        = "mich_r2_token"
      + status      = (known after apply)
      + value       = (sensitive value)

      + condition {
          + request_ip {
              + in = [
                  + "162.55.86.82/32",
                ]
            }
        }

      + policy {
          + effect            = "allow"
          + permission_groups = [
              + "2efd5506f9c8494dacb1fa10a3e7d5b6",
            ]
          + resources         = {
              + "com.cloudflare.edge.r2.bucket.*" = "*"
            }
        }
    }

  # cloudflare_api_token.mich_cloudflare_token will be destroyed
  # (because cloudflare_api_token.mich_cloudflare_token is not in configuration)
  - resource "cloudflare_api_token" "mich_cloudflare_token" {
      - id          = "0fe963ede76902976c92f2470115b71b" -> null
      - issued_on   = "2024-06-03T11:54:52Z" -> null
      - modified_on = "2024-06-03T11:54:52Z" -> null
      - name        = "mich_r2_token" -> null
      - status      = "active" -> null
      - value       = (sensitive value) -> null

      - condition {
          - request_ip {
              - in     = [
                  - "162.55.86.82/24",
                ] -> null
              - not_in = [] -> null
            }
        }

      - policy {
          - effect            = "allow" -> null
          - permission_groups = [
              - "2efd5506f9c8494dacb1fa10a3e7d5b6",
            ] -> null
          - resources         = {
              - "com.cloudflare.edge.r2.bucket.*" = "*"
            } -> null
        }
    }

Plan: 1 to add, 0 to change, 1 to destroy.

Changes to Outputs:
  + mich_cloudflare_r2_token_id           = (sensitive value)
  + mich_cloudflare_r2_token_value        = (sensitive value)
  - mich_cloudflare_token_id              = (sensitive value) -> null
  - mich_cloudflare_token_value           = (sensitive value) -> null
time=2024-06-05T16:28:31Z level=info msg=Downloading Terraform configurations from file:///github/workspace/deployment/modules/cloudflare/account into /github/workspace/deployment/modules/cloudflare/account/.terragrunt-cache/ViIwJVqOi819kqZ36VVuOJy6bPE/Am9lfe1IU0ZwMZddtsARYYEARwE prefix=[/github/workspace/deployment/modules/cloudflare/account] 
time=2024-06-05T16:28:31Z level=info msg=Downloading Terraform configurations from file:///github/workspace/deployment/modules/github/org into /github/workspace/deployment/modules/github/org/.terragrunt-cache/fjLfy0-bfbo44op14XdvtPbOclo/rQYQ5Hh1yBhge0iwDdQXfhsp1sw prefix=[/github/workspace/deployment/modules/github/org] 

Initializing the backend...

Initializing the backend...

Successfully configured the backend "pg"! OpenTofu will automatically
use this backend unless the backend configuration changes.

Successfully configured the backend "pg"! OpenTofu will automatically
use this backend unless the backend configuration changes.

Initializing provider plugins...
- terraform.io/builtin/terraform is built in to OpenTofu
- Reusing previous version of integrations/github from the dependency lock file

Initializing provider plugins...
- terraform.io/builtin/terraform is built in to OpenTofu
- Reusing previous version of cloudflare/cloudflare from the dependency lock file
- Installing integrations/github v6.2.1...
- Installing cloudflare/cloudflare v4.34.0...
- Installed integrations/github v6.2.1. Signature validation was skipped due to the registry not containing GPG keys for this provider

OpenTofu has been successfully initialized!
- Installed cloudflare/cloudflare v4.34.0 (signed, key ID C76001609EE3B136)

Providers are signed by their developers.
If you'd like to know more about provider signing, you can read about it here:
https://opentofu.org/docs/cli/plugins/signing/

OpenTofu has been successfully initialized!
data.terraform_remote_state.api_keys_state: Reading...
github_actions_organization_secret.test_secret: Refreshing state... [id=test_secret]
data.terraform_remote_state.api_keys_state: Reading...
data.terraform_remote_state.api_keys_state: Read complete after 2s

OpenTofu used the selected providers to generate the following execution
plan. Resource actions are indicated with the following symbols:
  + create
  - destroy

OpenTofu will perform the following actions:

  # github_actions_organization_secret.cloudflare_api_token_pages_upload will be created
  + resource "github_actions_organization_secret" "cloudflare_api_token_pages_upload" {
      + created_at      = (known after apply)
      + id              = (known after apply)
      + plaintext_value = (sensitive value)
      + secret_name     = "CLOUDFLARE_API_TOKEN_PAGES_UPLOAD"
      + updated_at      = (known after apply)
      + visibility      = "all"
    }

  # github_actions_organization_secret.test_secret will be destroyed
  # (because github_actions_organization_secret.test_secret is not in configuration)
  - resource "github_actions_organization_secret" "test_secret" {
      - created_at              = "2024-06-03 16:42:34 +0000 UTC" -> null
      - id                      = "test_secret" -> null
      - plaintext_value         = (sensitive value) -> null
      - secret_name             = "test_secret" -> null
      - selected_repository_ids = [] -> null
      - updated_at              = "2024-06-03 16:42:34 +0000 UTC" -> null
      - visibility              = "private" -> null
    }

Plan: 1 to add, 0 to change, 1 to destroy.
data.terraform_remote_state.api_keys_state: Read complete after 2s
cloudflare_record.immich_app_a_preview: Refreshing state... [id=dbd64a89ef0162d93cb5e4b96db478a0]
cloudflare_zone.immich_app: Refreshing state... [id=44063ef29305ea931e687178bc94d9c0]
cloudflare_pages_project.immich_app: Refreshing state... [id=immich-app]
cloudflare_zone.immich_cloud: Refreshing state... [id=12b623403e6269c077cf8abe75df1383]
cloudflare_record.immich_app_a_star_dot_preview: Refreshing state... [id=4424193cef2e4dd3f2770fb85e8db98c]
cloudflare_pages_project.immich_app_archive: Refreshing state... [id=immich-app-archive]
cloudflare_record.immich_app_a_testing: Refreshing state... [id=82a56a72ac5e35f8d2dd2ad704c0a920]
cloudflare_pages_project.immich_app_preview: Refreshing state... [id=immich-app-preview]
cloudflare_record.immich_cloud_cname_star_dot_root: Refreshing state... [id=84483aa1d6904513536b23be07b6c355]
cloudflare_record.immich_cloud_a_mich: Refreshing state... [id=a122e9564b666b5b37e3dac766b473f6]
cloudflare_zone_settings_override.immich_cloud: Refreshing state... [id=12b623403e6269c077cf8abe75df1383]
cloudflare_record.immich_cloud_cname_root: Refreshing state... [id=894cdac356c34540b4f03efa06623e44]
cloudflare_record.immich_app_aaaa_docs: Refreshing state... [id=8efbc50d88398aac86c25f09e090b0ea]
cloudflare_record.immich_app_mx_root_54: Refreshing state... [id=95689119c10f73ef70e93544b0989cb9]
cloudflare_record.immich_app_txt_1password_verification: Refreshing state... [id=04023e1bf3b43f9db0bf108c9ed99149]
cloudflare_record.immich_app_mx_root_35: Refreshing state... [id=9f935cb3c92033823f44c9a7a40a6db1]
cloudflare_record.immich_app_mx_root_73: Refreshing state... [id=68ee5b26ca9d9db5259767780b0b2dd1]
cloudflare_record.immich_app_cname__domainconnect: Refreshing state... [id=4f551a245cd261358504c416456689c9]
cloudflare_record.immich_app_aaaa_documentation: Refreshing state... [id=e26765f012e0696da7d18f996080d080]
cloudflare_zone_settings_override.immich_app: Refreshing state... [id=44063ef29305ea931e687178bc94d9c0]
cloudflare_record.immich_app_txt_root_cloudflare_mx: Refreshing state... [id=5af8a940e3678ac68393f6ee8539348d]
cloudflare_ruleset.immich_app_redirects: Refreshing state... [id=9a71791e55a44e89b81f4da4f5fdf195]
cloudflare_record.immich_app_a_demo: Refreshing state... [id=7fceae38ca564a86052ab452ad7afc5d]

OpenTofu used the selected providers to generate the following execution
plan. Resource actions are indicated with the following symbols:
  + create
  ~ update in-place
  - destroy

OpenTofu will perform the following actions:

  # cloudflare_pages_project.immich_app will be updated in-place
  ~ resource "cloudflare_pages_project" "immich_app" {
        id                = "immich-app"
        name              = "immich-app"
        # (5 unchanged attributes hidden)

      - build_config {
          - build_caching = false -> null
        }

        # (1 unchanged block hidden)
    }

  # cloudflare_r2_bucket.mich-backups will be created
  + resource "cloudflare_r2_bucket" "mich-backups" {
      + account_id = "601adaaa1eab190cdfe2945f9a6c89d0"
      + id         = (known after apply)
      + location   = "weur"
      + name       = "mich-backups"
    }

  # cloudflare_record.immich_app_a_preview will be destroyed
  # (because cloudflare_record.immich_app_a_preview is not in configuration)
  - resource "cloudflare_record" "immich_app_a_preview" {
      - created_on  = "2024-05-22T16:09:31.670257Z" -> null
      - hostname    = "preview.immich.app" -> null
      - id          = "dbd64a89ef0162d93cb5e4b96db478a0" -> null
      - metadata    = {
          - "auto_added"             = "false"
          - "managed_by_apps"        = "false"
          - "managed_by_argo_tunnel" = "false"
        } -> null
      - modified_on = "2024-05-22T16:10:01.524182Z" -> null
      - name        = "preview" -> null
      - proxiable   = true -> null
      - proxied     = false -> null
      - tags        = [] -> null
      - ttl         = 1 -> null
      - type        = "A" -> null
      - value       = "141.144.207.87" -> null
      - zone_id     = "44063ef29305ea931e687178bc94d9c0" -> null
    }

  # cloudflare_record.immich_app_a_star_dot_preview will be destroyed
  # (because cloudflare_record.immich_app_a_star_dot_preview is not in configuration)
  - resource "cloudflare_record" "immich_app_a_star_dot_preview" {
      - created_on  = "2024-05-22T16:09:31.652703Z" -> null
      - hostname    = "*.preview.immich.app" -> null
      - id          = "4424193cef2e4dd3f2770fb85e8db98c" -> null
      - metadata    = {
          - "auto_added"             = "false"
          - "managed_by_apps"        = "false"
          - "managed_by_argo_tunnel" = "false"
        } -> null
      - modified_on = "2024-05-22T16:09:56.711377Z" -> null
      - name        = "*.preview" -> null
      - proxiable   = true -> null
      - proxied     = false -> null
      - tags        = [] -> null
      - ttl         = 1 -> null
      - type        = "A" -> null
      - value       = "141.144.207.87" -> null
      - zone_id     = "44063ef29305ea931e687178bc94d9c0" -> null
    }

  # cloudflare_record.immich_app_a_testing will be destroyed
  # (because cloudflare_record.immich_app_a_testing is not in configuration)
  - resource "cloudflare_record" "immich_app_a_testing" {
      - created_on  = "2024-05-22T16:09:31.679391Z" -> null
      - hostname    = "testing.immich.app" -> null
      - id          = "82a56a72ac5e35f8d2dd2ad704c0a920" -> null
      - metadata    = {
          - "auto_added"             = "false"
          - "managed_by_apps"        = "false"
          - "managed_by_argo_tunnel" = "false"
        } -> null
      - modified_on = "2024-05-22T16:09:31.679391Z" -> null
      - name        = "testing" -> null
      - proxiable   = true -> null
      - proxied     = true -> null
      - tags        = [] -> null
      - ttl         = 1 -> null
      - type        = "A" -> null
      - value       = "143.198.72.84" -> null
      - zone_id     = "44063ef29305ea931e687178bc94d9c0" -> null
    }

Plan: 1 to add, 1 to change, 3 to destroy.

github-actions · 2024-06-05T16:37:54Z

Execution result of "run-all plan" in "deployment"

time=2024-06-05T16:37:26Z level=info msg=The stack at /github/workspace/deployment will be processed in the following order for command plan:
Group 1
- Module /github/workspace/deployment/modules/cloudflare/api-keys

Group 2
- Module /github/workspace/deployment/modules/cloudflare/account
- Module /github/workspace/deployment/modules/github/org


time=2024-06-05T16:37:26Z level=info msg=Downloading Terraform configurations from file:///github/workspace/deployment/modules/cloudflare/api-keys into /github/workspace/deployment/modules/cloudflare/api-keys/.terragrunt-cache/TFVDVlSA5SsBH5Wly1xPTUuJJPM/bTr-O2m_pTIZuQ2gkmEyYMvp2pA prefix=[/github/workspace/deployment/modules/cloudflare/api-keys] 

Initializing the backend...

Successfully configured the backend "pg"! OpenTofu will automatically
use this backend unless the backend configuration changes.

Initializing provider plugins...
- Reusing previous version of cloudflare/cloudflare from the dependency lock file
- Installing cloudflare/cloudflare v4.34.0...
- Installed cloudflare/cloudflare v4.34.0 (signed, key ID C76001609EE3B136)

Providers are signed by their developers.
If you'd like to know more about provider signing, you can read about it here:
https://opentofu.org/docs/cli/plugins/signing/

OpenTofu has been successfully initialized!
Acquiring state lock. This may take a few moments...
data.cloudflare_api_token_permission_groups.all: Reading...
cloudflare_api_token.mich_cloudflare_token: Refreshing state... [id=0fe963ede76902976c92f2470115b71b]
data.cloudflare_api_token_permission_groups.all: Read complete after 0s [id=bb20dc5cc9aef2087aa6f764330e0f69]
cloudflare_api_token.terraform_cloudflare_docs: Refreshing state... [id=2c53cc4981aac350370f2be87419a5c7]
cloudflare_api_token.terraform_cloudflare_pages_upload: Refreshing state... [id=3b1d2c2eb5dde9b32b0513f4bb22e5be]
cloudflare_api_token.terraform_cloudflare_account: Refreshing state... [id=ec09021dcc0b5d8a490d0730d3ad193d]

OpenTofu used the selected providers to generate the following execution
plan. Resource actions are indicated with the following symbols:
  + create
  - destroy

OpenTofu will perform the following actions:

  # cloudflare_api_token.mich_cloudflare_r2_token will be created
  + resource "cloudflare_api_token" "mich_cloudflare_r2_token" {
      + id          = (known after apply)
      + issued_on   = (known after apply)
      + modified_on = (known after apply)
      + name        = "mich_r2_token"
      + status      = (known after apply)
      + value       = (sensitive value)

      + condition {
          + request_ip {
              + in = [
                  + "162.55.86.82/32",
                ]
            }
        }

      + policy {
          + effect            = "allow"
          + permission_groups = [
              + "2efd5506f9c8494dacb1fa10a3e7d5b6",
            ]
          + resources         = {
              + "com.cloudflare.edge.r2.bucket.*" = "*"
            }
        }
    }

  # cloudflare_api_token.mich_cloudflare_token will be destroyed
  # (because cloudflare_api_token.mich_cloudflare_token is not in configuration)
  - resource "cloudflare_api_token" "mich_cloudflare_token" {
      - id          = "0fe963ede76902976c92f2470115b71b" -> null
      - issued_on   = "2024-06-03T11:54:52Z" -> null
      - modified_on = "2024-06-03T11:54:52Z" -> null
      - name        = "mich_r2_token" -> null
      - status      = "active" -> null
      - value       = (sensitive value) -> null

      - condition {
          - request_ip {
              - in     = [
                  - "162.55.86.82/24",
                ] -> null
              - not_in = [] -> null
            }
        }

      - policy {
          - effect            = "allow" -> null
          - permission_groups = [
              - "2efd5506f9c8494dacb1fa10a3e7d5b6",
            ] -> null
          - resources         = {
              - "com.cloudflare.edge.r2.bucket.*" = "*"
            } -> null
        }
    }

Plan: 1 to add, 0 to change, 1 to destroy.

Changes to Outputs:
  + mich_cloudflare_r2_token_id           = (sensitive value)
  + mich_cloudflare_r2_token_value        = (sensitive value)
  - mich_cloudflare_token_id              = (sensitive value) -> null
  - mich_cloudflare_token_value           = (sensitive value) -> null
time=2024-06-05T16:37:35Z level=info msg=Downloading Terraform configurations from file:///github/workspace/deployment/modules/github/org into /github/workspace/deployment/modules/github/org/.terragrunt-cache/fjLfy0-bfbo44op14XdvtPbOclo/rQYQ5Hh1yBhge0iwDdQXfhsp1sw prefix=[/github/workspace/deployment/modules/github/org] 
time=2024-06-05T16:37:35Z level=info msg=Downloading Terraform configurations from file:///github/workspace/deployment/modules/cloudflare/account into /github/workspace/deployment/modules/cloudflare/account/.terragrunt-cache/ViIwJVqOi819kqZ36VVuOJy6bPE/Am9lfe1IU0ZwMZddtsARYYEARwE prefix=[/github/workspace/deployment/modules/cloudflare/account] 

Initializing the backend...

Initializing the backend...

Successfully configured the backend "pg"! OpenTofu will automatically
use this backend unless the backend configuration changes.

Successfully configured the backend "pg"! OpenTofu will automatically
use this backend unless the backend configuration changes.

Initializing provider plugins...
- terraform.io/builtin/terraform is built in to OpenTofu
- Reusing previous version of integrations/github from the dependency lock file

Initializing provider plugins...
- terraform.io/builtin/terraform is built in to OpenTofu
- Reusing previous version of cloudflare/cloudflare from the dependency lock file
- Installing cloudflare/cloudflare v4.34.0...
- Installing integrations/github v6.2.1...
- Installed cloudflare/cloudflare v4.34.0 (signed, key ID C76001609EE3B136)

Providers are signed by their developers.
If you'd like to know more about provider signing, you can read about it here:
https://opentofu.org/docs/cli/plugins/signing/

OpenTofu has been successfully initialized!
- Installed integrations/github v6.2.1. Signature validation was skipped due to the registry not containing GPG keys for this provider

OpenTofu has been successfully initialized!
Acquiring state lock. This may take a few moments...
Acquiring state lock. This may take a few moments...
data.terraform_remote_state.api_keys_state: Reading...
data.terraform_remote_state.api_keys_state: Reading...
github_actions_organization_secret.test_secret: Refreshing state... [id=test_secret]
data.terraform_remote_state.api_keys_state: Read complete after 2s
data.terraform_remote_state.api_keys_state: Read complete after 2s

OpenTofu used the selected providers to generate the following execution
plan. Resource actions are indicated with the following symbols:
  + create
  - destroy

OpenTofu will perform the following actions:

  # github_actions_organization_secret.cloudflare_api_token_pages_upload will be created
  + resource "github_actions_organization_secret" "cloudflare_api_token_pages_upload" {
      + created_at      = (known after apply)
      + id              = (known after apply)
      + plaintext_value = (sensitive value)
      + secret_name     = "CLOUDFLARE_API_TOKEN_PAGES_UPLOAD"
      + updated_at      = (known after apply)
      + visibility      = "all"
    }

  # github_actions_organization_secret.test_secret will be destroyed
  # (because github_actions_organization_secret.test_secret is not in configuration)
  - resource "github_actions_organization_secret" "test_secret" {
      - created_at              = "2024-06-03 16:42:34 +0000 UTC" -> null
      - id                      = "test_secret" -> null
      - plaintext_value         = (sensitive value) -> null
      - secret_name             = "test_secret" -> null
      - selected_repository_ids = [] -> null
      - updated_at              = "2024-06-03 16:42:34 +0000 UTC" -> null
      - visibility              = "private" -> null
    }

Plan: 1 to add, 0 to change, 1 to destroy.
cloudflare_zone.immich_app: Refreshing state... [id=44063ef29305ea931e687178bc94d9c0]
cloudflare_zone.immich_cloud: Refreshing state... [id=12b623403e6269c077cf8abe75df1383]
cloudflare_pages_project.immich_app_archive: Refreshing state... [id=immich-app-archive]
cloudflare_record.immich_app_a_preview: Refreshing state... [id=dbd64a89ef0162d93cb5e4b96db478a0]
cloudflare_record.immich_app_a_testing: Refreshing state... [id=82a56a72ac5e35f8d2dd2ad704c0a920]
cloudflare_record.immich_app_a_star_dot_preview: Refreshing state... [id=4424193cef2e4dd3f2770fb85e8db98c]
cloudflare_pages_project.immich_app: Refreshing state... [id=immich-app]
cloudflare_pages_project.immich_app_preview: Refreshing state... [id=immich-app-preview]
cloudflare_record.immich_cloud_cname_root: Refreshing state... [id=894cdac356c34540b4f03efa06623e44]
cloudflare_record.immich_cloud_cname_star_dot_root: Refreshing state... [id=84483aa1d6904513536b23be07b6c355]
cloudflare_zone_settings_override.immich_cloud: Refreshing state... [id=12b623403e6269c077cf8abe75df1383]
cloudflare_record.immich_cloud_a_mich: Refreshing state... [id=a122e9564b666b5b37e3dac766b473f6]
cloudflare_zone_settings_override.immich_app: Refreshing state... [id=44063ef29305ea931e687178bc94d9c0]
cloudflare_record.immich_app_mx_root_54: Refreshing state... [id=95689119c10f73ef70e93544b0989cb9]
cloudflare_record.immich_app_mx_root_35: Refreshing state... [id=9f935cb3c92033823f44c9a7a40a6db1]
cloudflare_record.immich_app_cname__domainconnect: Refreshing state... [id=4f551a245cd261358504c416456689c9]
cloudflare_ruleset.immich_app_redirects: Refreshing state... [id=9a71791e55a44e89b81f4da4f5fdf195]
cloudflare_record.immich_app_mx_root_73: Refreshing state... [id=68ee5b26ca9d9db5259767780b0b2dd1]
cloudflare_record.immich_app_aaaa_docs: Refreshing state... [id=8efbc50d88398aac86c25f09e090b0ea]
cloudflare_record.immich_app_aaaa_documentation: Refreshing state... [id=e26765f012e0696da7d18f996080d080]
cloudflare_record.immich_app_a_demo: Refreshing state... [id=7fceae38ca564a86052ab452ad7afc5d]
cloudflare_record.immich_app_txt_root_cloudflare_mx: Refreshing state... [id=5af8a940e3678ac68393f6ee8539348d]
cloudflare_record.immich_app_txt_1password_verification: Refreshing state... [id=04023e1bf3b43f9db0bf108c9ed99149]

OpenTofu used the selected providers to generate the following execution
plan. Resource actions are indicated with the following symbols:
  + create
  ~ update in-place
  - destroy

OpenTofu will perform the following actions:

  # cloudflare_pages_project.immich_app will be updated in-place
  ~ resource "cloudflare_pages_project" "immich_app" {
        id                = "immich-app"
        name              = "immich-app"
        # (5 unchanged attributes hidden)

      - build_config {
          - build_caching = false -> null
        }

        # (1 unchanged block hidden)
    }

  # cloudflare_r2_bucket.tf_state_database_backups will be created
  + resource "cloudflare_r2_bucket" "tf_state_database_backups" {
      + account_id = "601adaaa1eab190cdfe2945f9a6c89d0"
      + id         = (known after apply)
      + location   = "weur"
      + name       = "tf-state-database-backups"
    }

  # cloudflare_record.immich_app_a_preview will be destroyed
  # (because cloudflare_record.immich_app_a_preview is not in configuration)
  - resource "cloudflare_record" "immich_app_a_preview" {
      - created_on  = "2024-05-22T16:09:31.670257Z" -> null
      - hostname    = "preview.immich.app" -> null
      - id          = "dbd64a89ef0162d93cb5e4b96db478a0" -> null
      - metadata    = {
          - "auto_added"             = "false"
          - "managed_by_apps"        = "false"
          - "managed_by_argo_tunnel" = "false"
        } -> null
      - modified_on = "2024-05-22T16:10:01.524182Z" -> null
      - name        = "preview" -> null
      - proxiable   = true -> null
      - proxied     = false -> null
      - tags        = [] -> null
      - ttl         = 1 -> null
      - type        = "A" -> null
      - value       = "141.144.207.87" -> null
      - zone_id     = "44063ef29305ea931e687178bc94d9c0" -> null
    }

  # cloudflare_record.immich_app_a_star_dot_preview will be destroyed
  # (because cloudflare_record.immich_app_a_star_dot_preview is not in configuration)
  - resource "cloudflare_record" "immich_app_a_star_dot_preview" {
      - created_on  = "2024-05-22T16:09:31.652703Z" -> null
      - hostname    = "*.preview.immich.app" -> null
      - id          = "4424193cef2e4dd3f2770fb85e8db98c" -> null
      - metadata    = {
          - "auto_added"             = "false"
          - "managed_by_apps"        = "false"
          - "managed_by_argo_tunnel" = "false"
        } -> null
      - modified_on = "2024-05-22T16:09:56.711377Z" -> null
      - name        = "*.preview" -> null
      - proxiable   = true -> null
      - proxied     = false -> null
      - tags        = [] -> null
      - ttl         = 1 -> null
      - type        = "A" -> null
      - value       = "141.144.207.87" -> null
      - zone_id     = "44063ef29305ea931e687178bc94d9c0" -> null
    }

  # cloudflare_record.immich_app_a_testing will be destroyed
  # (because cloudflare_record.immich_app_a_testing is not in configuration)
  - resource "cloudflare_record" "immich_app_a_testing" {
      - created_on  = "2024-05-22T16:09:31.679391Z" -> null
      - hostname    = "testing.immich.app" -> null
      - id          = "82a56a72ac5e35f8d2dd2ad704c0a920" -> null
      - metadata    = {
          - "auto_added"             = "false"
          - "managed_by_apps"        = "false"
          - "managed_by_argo_tunnel" = "false"
        } -> null
      - modified_on = "2024-05-22T16:09:31.679391Z" -> null
      - name        = "testing" -> null
      - proxiable   = true -> null
      - proxied     = true -> null
      - tags        = [] -> null
      - ttl         = 1 -> null
      - type        = "A" -> null
      - value       = "143.198.72.84" -> null
      - zone_id     = "44063ef29305ea931e687178bc94d9c0" -> null
    }

Plan: 1 to add, 1 to change, 3 to destroy.

zackpollard added 3 commits June 5, 2024 11:54

chore: remove unused immich.app dns records

c2fa4c8

refactor: add mich ip as a local

c224e81

refactor: give all the cloudflare api keys proper names

c31de6f

jrasm91 reviewed Jun 5, 2024

View reviewed changes

zackpollard force-pushed the chore/more-iac branch from b4eb12d to afdacff Compare June 5, 2024 13:30

zackpollard force-pushed the chore/more-iac branch 3 times, most recently from a121d91 to 51f825c Compare June 5, 2024 14:28

zackpollard marked this pull request as ready for review June 5, 2024 14:29

bo0tzz reviewed Jun 5, 2024

View reviewed changes

zackpollard force-pushed the chore/more-iac branch from 51f825c to 95107d4 Compare June 5, 2024 16:23

chore: add example.env for running locally

e79a16d

zackpollard force-pushed the chore/more-iac branch from 95107d4 to 1599412 Compare June 5, 2024 16:27

zackpollard added 5 commits June 5, 2024 17:36

feat: add r2 bucket and mich r2 cloudflare token

c4fa4a9

feat: add github org iac for secrets initially

afc7217

chore: add and tell IDE's to add newlines to end of files

5f328e5

feat: deploy github org iac through github actions

90b187b

docs: add manual setup steps required for IAC in github actions

657ba75

zackpollard force-pushed the chore/more-iac branch from 1599412 to 657ba75 Compare June 5, 2024 16:37

zackpollard merged commit 5d80b91 into main Jun 5, 2024
6 checks passed

zackpollard deleted the chore/more-iac branch June 5, 2024 18:50

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat: more iac #46

feat: more iac #46

zackpollard commented Jun 5, 2024

github-actions bot commented Jun 5, 2024

jrasm91 left a comment •

edited

Loading

zackpollard commented Jun 5, 2024

bo0tzz commented Jun 5, 2024

zackpollard commented Jun 5, 2024

github-actions bot commented Jun 5, 2024

github-actions bot commented Jun 5, 2024

github-actions bot commented Jun 5, 2024

bo0tzz Jun 5, 2024

zackpollard Jun 5, 2024

github-actions bot commented Jun 5, 2024

github-actions bot commented Jun 5, 2024

feat: more iac #46

feat: more iac #46

Conversation

zackpollard commented Jun 5, 2024

github-actions bot commented Jun 5, 2024

jrasm91 left a comment • edited Loading

Choose a reason for hiding this comment

zackpollard commented Jun 5, 2024

bo0tzz commented Jun 5, 2024

zackpollard commented Jun 5, 2024

github-actions bot commented Jun 5, 2024

github-actions bot commented Jun 5, 2024

github-actions bot commented Jun 5, 2024

bo0tzz Jun 5, 2024

Choose a reason for hiding this comment

zackpollard Jun 5, 2024

Choose a reason for hiding this comment

github-actions bot commented Jun 5, 2024

github-actions bot commented Jun 5, 2024

jrasm91 left a comment •

edited

Loading