# Jonpulsifer Infra Terraform

> Module Layout

- Skill: `tomevault-io/jonpulsifer-infra-terraform` (Agent Skill, multi-file: 2 files)
- Install (CLI): `npx skillmds@latest add tomevault-io/jonpulsifer-infra-terraform`
- Raw SKILL.md: https://api.skillmd.com/api/skills/tomevault-io/jonpulsifer-infra-terraform/raw
- Safety review: pending (external: skill-scanner PASS, skillspector PASS)
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: DevOps & Infra
- Author: tomevault-io (https://skillmd.com/u/tomevault-io)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/tomevault-io/jonpulsifer-infra-terraform

---


## Module Layout

All Terraform lives under `terraform/`. Each subdirectory below is an independent root module with its own state:

```
terraform/gcp/organization/       # org-level IAM, folders, billing
terraform/gcp/projects/<name>/    # per-project resources
terraform/cloudflare/             # DNS, tunnels, security rules
terraform/vault/                  # auth backends, PKI, policies
terraform/argo/                   # ArgoCD application definitions
terraform/unifi/                  # VLANs, BGP, clients
terraform/tailscale/              # devices, routes, ACL policy
terraform/google-workspace/       # Workspace users, groups, domains
terraform/k8s/                    # Flux bootstrap for both clusters
terraform/modules/                # reusable modules consumed via relative paths
```

## Standard Workflow

Applies run through **Atlantis on the PR**, not locally. Open a PR with your `.tf`
changes; Atlantis autoplans on the changed module(s). Review the plan comment, then
comment `atlantis apply` — a successful apply automerges the PR.

```bash
cd terraform/<module-dir>
terraform init
terraform plan     # local inspection only
```

Do **not** run `terraform apply` against remote state — it races Atlantis and causes
state lock contention / drift. CI (`terraform.yml`) only validates; Atlantis is the
only thing that applies. See `kubernetes-gitops` for the Atlantis ↔ ArgoCD auth and
token-rotation details.

## Validation (no backend)

```bash
terraform init -backend=false
terraform validate
```

## Formatting

CI auto-formats and commits on merge to `main`. Run locally before committing:

```bash
terraform fmt -recursive
```

## CI Behaviour

- **On PR**: validates all changed `*.tf` directories in a matrix job.
- **On merge to `main`**: auto-formats and commits (`style: format terraform files`), then regenerates terraform-docs (`docs: regenerate terraform documentation`).
- Do not manually commit formatting fixes — CI handles it.

## Notes

- Terraform state is remote; `.tfstate` files are gitignored.
- `terraform/gcp/organization/` manages the GCP org hierarchy — changes affect all projects.
- `terraform/cloudflare/` Tunnel modules control external ingress for folly and offsite clusters.
- `terraform/modules/` are reusable (no backend); root modules reference them via relative paths (e.g. homelab-ng → `../../../modules/gce-vpc`).

---
> Source: [jonpulsifer/infra](https://github.com/jonpulsifer/infra) — distributed by [TomeVault](https://tomevault.io).
<!-- tomevault:4.0:skill_md:2026-06-19 -->