Infrastructure

Introduction

This repository holds infrastructure as code. OpenTofu is used to provision the infrastructure.

Getting Started

Prerequisites

• OpenTofu

You need to install the CLI tool for the cloud provider you are using:

• Azure CLI
• gcloud CLI
• uv (Astral's Python environment manager)

Installation

Set up your development environment:

make install_dev

If you want to commit changes to scripts, you need to install ShellCheck, e.g. with:

brew install shellcheck

The pre-commit hooks for OpenTofu come from pre-commit-terraform. When running them outside the provided Docker image, point them at the OpenTofu binary:

export PCT_TFPATH=tofu

Create a backend

This is a one-time setup. It is not part of this infra-as-code. Populate the backend.conf with the required values.

Azure

Create a storage account and a container to store the OpenTofu state. NOTE: It might be required to add the object_id of the principal running tofu apply to the key vault with Get key permissions.

First-Time Setup

A first deploy will typically fail because the Key Vault is not yet populated with the required secrets.

One can deploy the Key Vault separately:

tofu apply -target=azurerm_key_vault.key_vault

Then manually add the "db-password" secret in the Key Vault. Then run tofu apply again to finish the deployment.

GCP

Create a bucket to store the OpenTofu state.

No service account keys are exported by this configuration. Workloads rely on ambient credentials, such as the service account attached to Cloud Run or workload identity federation.

Infrastructure Setup

Initialize (one-time setup) with

# NOTE: Populate the variables.
CSP= IDENTIFIER= bash scripts/init.sh.

For local use, you can create symbolic links to the API and UI repository.

ln -s {absolute_path_to_api_repo} api
ln -s {absolute_path_to_ui_repo} ui

Then use the deploy script to build and deploy the infrastructure:

# NOTE: Populate the variables.
CSP= IDENTIFIER= REGISTRY_NAME= REPOSITORY_NAME= bash scripts/deploy.sh

Post-Deployment Setup

1. Run alembic upgrade head against the database.
2. Populate with any data required. E.g., follow the instructions in the API repository.

Multi-Environment Setup

• Create a separate backend, e.g., backend.conf, for each environment.
• Create a separate terraform.tfvars for each environment.
• Use the -backend-config flag with tofu init to specify the backend configuration file.
• Use the -var-file flag with tofu plan and tofu apply to specify the variables file.