tofu state to s3

Bug: T352164

.gitattributes

@@ -6,3 +6,5 @@ ansible/files/csi-secret-cinderplugin.yaml.codfw1dev.crypt filter=git-crypt diff
 paws/codfw-secrets.yaml filter=git-crypt diff=git-crypt
 paws/files/minesweeper/secrets/** filter=git-crypt diff=git-crypt
 tofu/secrets.tf filter=git-crypt diff=git-crypt
+secrets-eqiad1.sh filter=git-crypt diff=git-crypt
+secrets-codfw1dev.sh filter=git-crypt diff=git-crypt

README.md

@@ -116,3 +116,8 @@ bash deploy.sh <eqiad1|codfw1dev>
 update the web proxy in horizon to point to current cluster.
 
 https://wikitech.wikimedia.org/wiki/PAWS/Admin#Deployment
+
+#### Disaster Recovery
+If the entire project is removed two parts of paws are not managed by tofu/ansible.
+Object storage container: An object storage container named "tofu-state" will need to be generated in horizon. This is where the state file for tofu resides.
+NFS: The NFS server is not included. And a fresh NFS server will be needed for paws to operate.

deploy.sh

@@ -31,14 +31,16 @@ if ! command -v tofu ; then
   exit 1
 fi
 
+source secrets-${datacenter}.sh
+
 python3 -m venv .venv/deploy
 source .venv/deploy/bin/activate
 pip install ansible==8.1.0 kubernetes==26.1.0
 
 
 cd tofu
-tofu init
-tofu apply -var datacenter=${datacenter}  # -auto-approve
+tofu init -backend-config access_key="${ACCESS_KEY}" -backend-config secret_key="${SECRET_KEY}"
+tofu apply -var datacenter=${datacenter} # -auto-approve
 export KUBECONFIG=$(pwd)/kube.config
 
 cd ../ansible

tofu/main.tf

@@ -1,4 +1,15 @@
 terraform {
+  backend "s3" {
+    #access_key                  = "7f5dc99840424406ae1e888d21b936a7"
+    bucket                      = "tofu-state"
+    endpoint                    = "https://object.eqiad1.wikimediacloud.org"
+    key                         = "paws-state"
+    region                      = "default"
+    #secret_key                  = var.ec2_credential_secret[var.datacenter]
+    skip_credentials_validation = "true"
+    skip_region_validation      = "true"
+    use_path_style              = "true"
+  }
   required_version = ">= 1.5.3"
   required_providers {
     openstack = {