Skip to content

Latest commit

 

History

History
86 lines (67 loc) · 3.79 KB

README.md

File metadata and controls

86 lines (67 loc) · 3.79 KB
Raw

Terraform Backend Server

A state backend server which implements the Terraform HTTP backend API with plugable modules for authentication, storage, locking and state encryption.

⚠️ Disclaimer: This code is in an early development state and not tested extensively for bugs and security issues. If you find some, please raise an issue or merge request.

Supported authentication methods:

  • HTTP basic auth
  • JSON Web Tokens

Supported storage backends:

  • local file system
  • S3
  • Postgres

Supported lock backends:

  • local map
  • Redis
  • Postgres

Supported KMS (encryption) backends:

  • local AES key
  • AES from HashiCorp Vault Key/Value store (v2)
  • HashiCorp Vault Transit engine

Deployment

Run locally for development:

LOG_LEVEL=debug go run cmd/terraform-backend.go

or use docker-compose:

docker-compose up -d

Default settings

The following table describes the default configuration, although the backend server will run with these values, it's not scalable and therefore only for testing purposes.

Environment Variable Type Default Description
LOG_LEVEL string info Log level (options are: fatal, info, warning, debug, trace)
LISTEN_ADDR string :8080 Address the HTTP server listens on
TLS_KEY string -- Path to TLS key file for listening with TLS (fallback to HTTP if not specified)
TLS_CERT string -- Path to TLS certificate file for listening with TLS (fallback to HTTP if not specified)
STORAGE_BACKEND string fs Module for state file storage (checkout docs/storage.md for other options)
STORAGE_FS_DIR string ./states File system directory for fs storage module to store state files
KMS_BACKEND string local Module used for encryption (checkout docs/kms.md for other options)
KMS_KEY string -- Key for local KMS module, if not defined, the server will generate a new one and exit
LOCK_BACKEND string local Module used for locking the state (checkout docs/lock.md for other options)
AUTH_BASIC_ENABLED bool true HTTP basic auth is enabled by default (checkout docs/auth.md for other options)
FORCE_UNLOCK_ENABLED bool true Force-unlock feature enables the native Terraform behavior which unlocks the state even if no lock id was sent

Usage

The path to the state is: /state/<project-id>/<state-name>.

Example Terraform backend configuration

terraform {
  backend "http" {
    address        = "http://localhost:8080/state/project1/example"
    lock_address   = "http://localhost:8080/state/project1/example"
    unlock_address = "http://localhost:8080/state/project1/example"
    username       = "basic"
    password       = "some-random-secret"
  }
}

For more information about username and password checkout docs/auth.md

Tests

Run unit tests:

go test ./...

Run integration tests:

docker-compose up -d redis postgres minio
go test ./... --tags integration -count=1