# Dh Infra

> Infrastructure-as-code operations with Terraform. Use when user wants to run terraform, manage infrastructure, bootstrap new hosts, change infrastructure, or says "terraform", "infrastructure", "IaC", "provision". Use when this capability is needed.

- Skill: `tomevault-io/dh-infra` (Agent Skill, multi-file: 2 files)
- Install (CLI): `npx skillmds@latest add tomevault-io/dh-infra`
- Raw SKILL.md: https://api.skillmd.com/api/skills/tomevault-io/dh-infra/raw
- Safety review: pending (external: skill-scanner PASS, skillspector PASS)
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: DevOps & Infra
- Author: tomevault-io (https://skillmd.com/u/tomevault-io)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/tomevault-io/dh-infra

---


# Dockhand Infrastructure

Manage infrastructure-as-code operations with Terraform for Hetzner Cloud resources. Enforces environment-based safety workflows.

## Environment Safety Model

| Environment | Workflow | Direct Apply |
|-------------|----------|--------------|
| **prod** | PR-first required | Blocked |
| **test** | Direct allowed | `confirmed=true` |
| **global** | PR-first required | Blocked |

## Core Operations

### Plan Changes

Preview infrastructure changes before applying:

```
terraform_plan environment="prod"
  → Shows diff of proposed changes
  → No state modification
  → Safe to run anytime
```

For all environments:
```
terraform_plan environment="global"
terraform_plan environment="prod"
terraform_plan environment="test"
```

### Apply Changes

**Test environment** (direct allowed):
```
terraform_plan environment="test"
  → Review changes
terraform_apply environment="test" confirmed=true
  → Applied directly
```

**Production/Global** (PR workflow):
1. Create feature branch
2. Make Terraform changes
3. Run `terraform_plan` to verify
4. Create PR with plan output
5. Merge after review
6. Apply from main branch (CI/CD or manual)

### View Current State

Inspect current Terraform state:
```
terraform_show environment="prod"
  → Current resource inventory
  → Useful for debugging drift
```

### Collect Platform State

Capture full platform state for documentation:
```
collect_state environment="prod"
  → Docker services, containers, volumes
  → Outputs to state-snapshots/
  → Commit to git for drift detection
```

## Infrastructure Components

### Global Resources (infra/terraform/global/)
- Hetzner Cloud network (`platform-net`)
- Subnets per environment
- Firewalls (SSH, HTTP, HTTPS, internal)
- Object storage buckets (backups, terraform state)

### Per-Environment Resources (infra/terraform/envs/<env>/)
- Server instances (CPX31, CCX13, etc.)
- Volumes (data persistence)
- Floating IPs (if configured)
- Server-specific firewall attachments

## Common Workflows

### Add New Server

1. Create Terraform config in `infra/terraform/envs/new-server/`
2. Define server, volume, network attachment
3. Run `terraform_plan environment="new-server"`
4. Create PR with plan
5. After merge, `terraform_apply environment="new-server" confirmed=true`
6. Bootstrap with `/dh:bootstrap`

### Resize Server

1. Update `server_type` in Terraform
2. Plan: `terraform_plan environment="<env>"`
3. **Warning**: May require server restart
4. Apply during maintenance window

### Add Storage Volume

1. Add `hcloud_volume` resource
2. Plan and review size/location
3. Apply
4. Mount on server via SSH

## Bootstrap New Host

After Terraform provisions a server, bootstrap it:

```
/dh:bootstrap host=<new-host>
```

Bootstrap sequence:
1. SSH connectivity test
2. Install Docker
3. Join Docker Swarm (manager or worker)
4. Install Tailscale
5. Configure monitoring agents
6. Verify health

## State Management

### Terraform State
- Stored in Cloudflare R2 (S3-compatible)
- Backend configured per environment
- State locking via DynamoDB-compatible

### Platform State Snapshots
- Generated by `collect_state`
- Stored in `state-snapshots/` in git
- Compare for drift detection:
  ```
  diff state-snapshots/prod/latest.json state-snapshots/prod/previous.json
  ```

## Integration with dh-guardrails

The `dh-guardrails` skill enforces:
- No `terraform destroy` without explicit confirmation
- PR-first for production changes
- Backup verification before destructive operations

## Error Handling

| Error | Resolution |
|-------|------------|
| State lock | Check for running applies, force unlock if stuck |
| Provider auth | Verify HCLOUD_TOKEN in environment |
| Resource conflict | Import existing resource or rename |
| Plan drift | Run plan, review changes, decide to apply or update config |

---
> Converted and distributed by [TomeVault](https://tomevault.io/claim/masonjames) — claim your Tome and manage your conversions.
<!-- tomevault:4.0:skill_md:2026-04-14 -->