Webforge server defined as code with OpenToFu and GHA workflow for CI and CD

[btlogy]

Part of #4161 Move off Trac - Execution - Forgejo

Merging this PR should trigger the automatic deployment of the OpenToFu plan defining a new VPS hosted by Hetzner.
This new VPS named webforge should be automatically provisioned with NixOS 24.11 and accessible by SSH using the authorized key defined in the plan and the IP populated in the resulting state.

NOTE:

• The file describing the current state of the related resources is handled in an S3 bucket hosted by AWS and managed by LeastAuthority:
  

  infrastructure/tf/core/main.tf

  Lines 7 to 15 in cb7be2f

  	backend "s3" {
  	bucket = "tf-state-tahoe-infra"
  	encrypt = true
  	key = "state"
  	workspace_key_prefix = "wks:"
  	region = "eu-central-1"
  	dynamodb_table = "tf-state-tahoe-infra"
  	}

  
  This is not ideal, but seems better to start with than any alternative I could thing of (e.g.: introduce yet an other untested 3rd party). But we should create an issue/ticket to consider any improvement if this get merged.
• Automatic update the tahoe-lafs.org zone will only be possible if/when the plan will be given access to the required API (see #4162 Infrastructure as Code to manage DNS configurations).

[github-actions]

ToFu - core

Step	Outcome
✏️ Format	success
🔧 Init ️	success
🔍 Validate	success
📄 Plan	success
🛂 Verify	success
👉 Result	change(s): 5 to add, 0 to change, 0 to destroy.

show change(s)

OpenTofu will perform the following actions:

  # hcloud_rdns.webforge_ipv4 will be created
  + resource "hcloud_rdns" "webforge_ipv4" {
      + dns_ptr    = "webforge.tahoe-lafs.org"
      + id         = (known after apply)
      + ip_address = (known after apply)
      + server_id  = (known after apply)
    }

  # hcloud_rdns.webforge_ipv6 will be created
  + resource "hcloud_rdns" "webforge_ipv6" {
      + dns_ptr    = "webforge.tahoe-lafs.org"
      + id         = (known after apply)
      + ip_address = (known after apply)
      + server_id  = (known after apply)
    }

  # hcloud_server.webforge will be created
  + resource "hcloud_server" "webforge" {
      + allow_deprecated_images    = false
      + backup_window              = (known after apply)
      + backups                    = true
      + datacenter                 = (known after apply)
      + delete_protection          = false
      + firewall_ids               = (known after apply)
      + id                         = (known after apply)
      + ignore_remote_firewall_ids = false
      + image                      = "debian-12"
      + ipv4_address               = (known after apply)
      + ipv6_address               = (known after apply)
      + ipv6_network               = (known after apply)
      + keep_disk                  = false
      + labels                     = {
          + "env"    = "prod"
          + "source" = "tf-tahoe-lafs-core"
        }
      + location                   = "hel1"
      + name                       = "webforge"
      + primary_disk_size          = (known after apply)
      + rebuild_protection         = false
      + server_type                = "cx32"
      + shutdown_before_deletion   = false
      + ssh_keys                   = [
          + "tf-benoit-000619776016",
          + "tf-florian-000018054987",
        ]
      + status                     = (known after apply)
      + user_data                  = "8fL+4BE7QHom0AK2E96oM/BFPbU="
    }

  # hcloud_ssh_key.ssh_keys["tf-benoit-000619776016"] will be created
  + resource "hcloud_ssh_key" "ssh_keys" {
      + fingerprint = (known after apply)
      + id          = (known after apply)
      + labels      = {}
      + name        = "tf-benoit-000619776016"
      + public_key  = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIZtWY7t8HVnaz6bluYsrAlzZC3MZtb8g0nO5L5fCQKR [email protected]"
    }

  # hcloud_ssh_key.ssh_keys["tf-florian-000018054987"] will be created
  + resource "hcloud_ssh_key" "ssh_keys" {
      + fingerprint = (known after apply)
      + id          = (known after apply)
      + labels      = {}
      + name        = "tf-florian-000018054987"
      + public_key  = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJlPneIaRT/mqu13N83ctEftub4O6zAfi6qgzZKerU5o [email protected]"
    }

Plan: 5 to add, 0 to change, 0 to destroy.

show error(s)

Pusher: @btlogy, Action: pull_request
Workflow: tahoe-lafs/infrastructure/.github/workflows/tf-core.yml@refs/pull/21/merge

[hacklschorsch]

"Je n’ai fait celle-ci plus longue que parce que je n’ai pas eu le loisir de la faire plus courte."

[btlogy]

As discussed with @hacklschorsch, I've created the following issue to get rid of the remote back-end managed by us at Least Authority:

• Migrate the OpenToFu state out of LeastAuthority perimeter #22