Opentofu

OpenTofu Skill 🥚

Infrastructure as Code using OpenTofu.

When to Use

✅ USE this skill when:

• Creating/modifying cloud resources (Servers, DNS, S3)
• Managing stateful infrastructure
• Reviewing .tf files

❌ DON'T use this skill when:

• Configuring OS internals (use ssh or ansible)
• Running one-off scripts
• Managing Kubernetes resources inside a cluster (use kubectl / helm)

Workflow

1. Init

Always run init first to download providers/modules.

tofu init

2. Plan (Dry Run)

Check what will happen. Mandatory before apply.

tofu plan -out=tfplan

3. Apply

Execute the changes.

tofu apply tfplan

4. Format

Keep code clean.

tofu fmt -recursive

Best Practices

• State: Never commit .tfstate files. Use remote state (S3/Consul) or local state in .gitignore.
• Secrets: Never hardcode secrets. Use variable "token" {} and pass via TF_VAR_token environment variable.
• Locking: Ensure state locking works to prevent race conditions.

Common Providers

Hetzner Cloud (hcloud)

provider "hcloud" {
  token = var.hcloud_token
}
resource "hcloud_server" "web" { ... }

Hetzner DNS

Note: Use hcloud_zone and hcloud_zone_rrset resources within the hcloud provider for DNS management.

Troubleshooting

• Lock Error: tofu force-unlock <LOCK_ID> (Use with extreme caution!)
• State Drift: tofu refresh