# Terraform > Placeholder. Terraform is in the dev shell but no code is in tree yet. Use when this capability is needed. - Skill: `tomevault-io/terraform-31` (Agent Skill, multi-file: 2 files) - Install (CLI): `npx skillmds@latest add tomevault-io/terraform-31` - Raw SKILL.md: https://api.skillmd.com/api/skills/tomevault-io/terraform-31/raw - Safety review: pending (external: skill-scanner PASS, skillspector CAUTION) - Works with: Claude Code, Claude.ai, OpenAI Codex - Category: DevOps & Infra - Author: tomevault-io (https://skillmd.com/u/tomevault-io) - Updated: 2026-09-17 - Page: https://skillmd.com/skills/tomevault-io/terraform-31 --- # Terraform ## Status Reserved slot. `infrastructure/terraform/` is empty as of 2026-05-13. Terraform is included in the `nix develop` shell because we expect to manage Proxmox-side resources and possibly UniFi network configuration through it once the lab substrate stabilises. ## When this skill will apply Once code lands, the likely scope is: - Proxmox VM lifecycle for stateless challenge VMs (replacing the bash `deploy-*.sh` scripts for cases where state and drift matter). - DNS records for internal lab FQDNs. - WireGuard peer management on the gateway, if the UniFi provider matures enough to make that practical. ## Conventions to apply when this skill is fleshed out - One `*.tf` module per managed substrate (proxmox, dns, wireguard). - State stored encrypted, never committed. Decide on a backend before the first `terraform apply`. - Variables that look like secrets go through sops-age, not raw `.tfvars`. ## Open questions before adoption - Backend choice (local-encrypted vs remote)? - Provider versions: `Telmate/proxmox` vs `bpg/proxmox`? - Do we replace the bash deploy scripts entirely, or run Terraform on top of them for declarative drift detection only? Update this skill when those questions are answered. --- > Source: [MylesLandais/2026_secretcon](https://github.com/MylesLandais/2026_secretcon) — distributed by [TomeVault](https://tomevault.io).