# Opentofu

> OpenTofu Skill 🥚

- Skill: `yesterday-ai/opentofu` (Agent Skill)
- Install (CLI): `npx skillmds@latest add yesterday-ai/opentofu`
- Raw SKILL.md: https://api.skillmd.com/api/skills/yesterday-ai/opentofu/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Coding & Dev Tools
- Author: Yesterday-AI (https://skillmd.com/u/yesterday-ai)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/yesterday-ai/opentofu

---


# OpenTofu Skill 🥚

Infrastructure as Code using OpenTofu.

## When to Use

✅ **USE this skill when:**
- Creating/modifying cloud resources (Servers, DNS, S3)
- Managing stateful infrastructure
- Reviewing `.tf` files

❌ **DON'T use this skill when:**
- Configuring OS internals (use `ssh` or `ansible`)
- Running one-off scripts
- Managing Kubernetes resources inside a cluster (use `kubectl` / `helm`)

## Workflow

### 1. Init
Always run init first to download providers/modules.
```bash
tofu init
```

### 2. Plan (Dry Run)
Check what will happen. **Mandatory** before apply.
```bash
tofu plan -out=tfplan
```

### 3. Apply
Execute the changes.
```bash
tofu apply tfplan
```

### 4. Format
Keep code clean.
```bash
tofu fmt -recursive
```

## Best Practices

- **State:** Never commit `.tfstate` files. Use remote state (S3/Consul) or local state in `.gitignore`.
- **Secrets:** Never hardcode secrets. Use `variable "token" {}` and pass via `TF_VAR_token` environment variable.
- **Locking:** Ensure state locking works to prevent race conditions.

## Common Providers

### Hetzner Cloud (`hcloud`)
```hcl
provider "hcloud" {
  token = var.hcloud_token
}
resource "hcloud_server" "web" { ... }
```

### Hetzner DNS
Note: Use `hcloud_zone` and `hcloud_zone_rrset` resources within the `hcloud` provider for DNS management.

## Troubleshooting

- **Lock Error:** `tofu force-unlock <LOCK_ID>` (Use with extreme caution!)
- **State Drift:** `tofu refresh`