Homelab / Five Terraform stacks with state kept off the server.
Provisioning
The first stack creates the R2 bucket that holds every other stack’s state. The rest describe the node’s storage and base images, the containers and virtual machines, DNS and the backup bucket, and the GitOps repository with its deploy keys.
A bootstrap stack creates the remote bucket that will hold every other stack’s state.
The following stacks describe storage and base images, guests, DNS, and the GitOps repository.
Every change is reviewed as a plan before it is applied against the server.
How I built it
State does not live on the server it describes, so losing the node does not mean losing the record of what existed. Splitting bootstrap, base, guests, DNS, and GitOps into five stacks makes it possible to plan a network change without dragging the whole provisioning along, and the plan is where you find out an edit was going to recreate a guest.