@gambi97/keel-cli 0.1.1 → 0.2.0

package/dist/index.js

@@ -3,7 +3,7 @@ import { readFileSync } from 'node:fs';
 import { spawnSync } from 'node:child_process';
 import { parseArgs } from 'node:util';
 import { fileURLToPath } from 'node:url';
-import { ConfigError, finalizeAnswers, fromEnv, mergeAnswers, missingRequired, } from './config.js';
+import { ConfigError, finalizeAnswers, fromEnv, mergeAnswers, missingRequired, parseEnvironments, } from './config.js';
 import { generateProject, GenerateError } from './generate.js';
 import { confirmSummary, fillMissing } from './prompts.js';
 import { isDone, loadState, markDone, STATE_FILE, stepData } from './state.js';
@@ -31,7 +31,13 @@ Options:
   --github-token <token>         GitHub token, repo+workflow (env GITHUB_TOKEN)
   --repo-name <name>             GitHub repository name (default: project name)
   --private / --public           GitHub repository visibility (default: public)
-  --no-basic-auth                Disable Basic Auth on staging
+  --environments <preset>        prod | staging+prod | dev+staging+prod
+                                 (or a list like "dev,staging,prod"; default staging+prod)
+  --no-basic-auth                Disable Basic Auth on non-production environments
+  --object-storage               Provision a per-environment Object Storage bucket
+  --no-object-storage            Do not provision Object Storage (default)
+  --dev-min-scale <n>            Dev min instances (default 0)
+  --dev-max-scale <n>            Dev max instances (default 1)
   --staging-min-scale <n>        Staging min instances (default 0)
   --staging-max-scale <n>        Staging max instances (default 1)
   --prod-min-scale <n>           Prod min instances (default 0)
@@ -61,8 +67,13 @@ function parseCli(argv) {
             'repo-name': { type: 'string' },
             private: { type: 'boolean' },
             public: { type: 'boolean' },
+            environments: { type: 'string' },
             'basic-auth': { type: 'boolean' },
             'no-basic-auth': { type: 'boolean' },
+            'object-storage': { type: 'boolean' },
+            'no-object-storage': { type: 'boolean' },
+            'dev-min-scale': { type: 'string' },
+            'dev-max-scale': { type: 'string' },
             'staging-min-scale': { type: 'string' },
             'staging-max-scale': { type: 'string' },
             'prod-min-scale': { type: 'string' },
@@ -108,12 +119,16 @@ function parseCli(argv) {
             repoName: values['repo-name'],
             repoPrivate: values.private ? true : values.public ? false : undefined,
         },
-        basicAuthStaging: values['no-basic-auth'] ? false : values['basic-auth'],
+        environments: values.environments ? parseEnvironments(values.environments) : undefined,
+        basicAuth: values['no-basic-auth'] ? false : values['basic-auth'],
+        objectStorage: values['no-object-storage'] ? false : values['object-storage'],
         scaling: {
-            stagingMinScale: num(values['staging-min-scale']),
-            stagingMaxScale: num(values['staging-max-scale']),
-            prodMinScale: num(values['prod-min-scale']),
-            prodMaxScale: num(values['prod-max-scale']),
+            dev: { minScale: num(values['dev-min-scale']), maxScale: num(values['dev-max-scale']) },
+            staging: {
+                minScale: num(values['staging-min-scale']),
+                maxScale: num(values['staging-max-scale']),
+            },
+            prod: { minScale: num(values['prod-min-scale']), maxScale: num(values['prod-max-scale']) },
         },
     };
     return {
@@ -128,11 +143,21 @@ function parseCli(argv) {
 /** Config files use the same nested shape as PartialAnswers. */
 function normalizeConfigFile(raw) {
     const obj = (raw ?? {});
+    let environments;
+    if (typeof obj.environments === 'string') {
+        environments = parseEnvironments(obj.environments);
+    }
+    else if (Array.isArray(obj.environments)) {
+        environments = obj.environments;
+    }
     return mergeAnswers({
         projectName: obj.projectName,
         region: obj.region,
         targetDir: obj.targetDir,
-        basicAuthStaging: obj.basicAuthStaging,
+        // `basicAuthStaging` is accepted as a legacy alias for `basicAuth`.
+        basicAuth: (obj.basicAuth ?? obj.basicAuthStaging),
+        objectStorage: obj.objectStorage,
+        environments,
         scaleway: (obj.scaleway ?? {}),
         infisical: (obj.infisical ?? {}),
         github: (obj.github ?? {}),
@@ -158,13 +183,16 @@ function checkEnvironment() {
     }
 }
 function printDryRunPlan(answers) {
+    const envList = answers.environments.map((e) => e.slug).join(', ');
+    const ghEnvs = answers.environments.map((e) => e.githubEnvironment).join('/');
     log.info([
         'Dry run: generated the repository locally. A real run would additionally:',
-        `  - Scaleway: create Object Storage bucket "${answers.stateBucket}" (${answers.region})`,
-        `  - Infisical: create/reuse project "${answers.infisical.projectName}", environments staging/prod,`,
-        '    seed BASIC_AUTH_USER/BASIC_AUTH_PASSWORD (staging) and DATABASE_URL placeholders',
+        `  - Scaleway: create the Terraform state bucket "${answers.stateBucket}" (${answers.region})`,
+        `  - Infisical: create/reuse project "${answers.infisical.projectName}", environments ${envList},`,
+        '    seed BASIC_AUTH_USER/BASIC_AUTH_PASSWORD (non-prod) and DATABASE_URL placeholders' +
+            (answers.objectStorage ? ' and S3_* placeholders' : ''),
         `  - GitHub: create ${answers.github.repoPrivate ? 'private' : 'public'} repo "${answers.github.repoName}", push, set 6 encrypted secrets,`,
-        '    4 variables, staging/production environments and main branch protection',
+        `    4 variables, ${ghEnvs} environments and main branch protection`,
     ].join('\n'));
 }
 async function runBootstrap(answers, state) {
@@ -278,7 +306,7 @@ async function main() {
         return;
     }
     const repoUrl = await runBootstrap(answers, state);
-    outro(renderNextSteps(answers, repoUrl, `rg.${answers.region}.scw.cloud/${answers.projectName}-staging`));
+    outro(renderNextSteps(answers, repoUrl, `rg.${answers.region}.scw.cloud/${answers.projectName}-${answers.environments[0].slug}`));
 }
 main().catch((error) => {
     if (error instanceof ConfigError || error instanceof GenerateError) {

package/dist/prompts.js

@@ -1,5 +1,5 @@
 import * as p from '@clack/prompts';
-import { ConfigError, DEFAULT_INFISICAL_HOST, DEFAULT_REGION, REGIONS, validateProjectName, validateScale, } from './config.js';
+import { ConfigError, DEFAULT_ENV_PRESET, DEFAULT_INFISICAL_HOST, DEFAULT_REGION, ENV_PRESETS, envDefaultScale, REGIONS, validateProjectName, validateScale, } from './config.js';
 function bail() {
     p.cancel('Cancelled. Nothing was created.');
     process.exit(1);
@@ -84,9 +84,33 @@ export async function fillMissing(partial, options) {
             ],
         }));
     }
-    if (out.basicAuthStaging === undefined) {
-        out.basicAuthStaging = await ask(p.confirm({
-            message: 'Protect staging with Basic Auth (enforced by your app)?',
+    if (!out.environments || out.environments.length === 0) {
+        const preset = await ask(p.select({
+            message: 'Which environments do you want?',
+            initialValue: DEFAULT_ENV_PRESET,
+            options: [
+                { value: 'prod', label: 'Production only', hint: 'single environment' },
+                {
+                    value: 'staging+prod',
+                    label: 'Staging + Production',
+                    hint: 'recommended',
+                },
+                { value: 'dev+staging+prod', label: 'Dev + Staging + Production' },
+            ],
+        }));
+        out.environments = ENV_PRESETS[preset];
+    }
+    const slugs = out.environments;
+    const hasNonProd = slugs.some((s) => s !== 'prod');
+    if (out.objectStorage === undefined) {
+        out.objectStorage = await ask(p.confirm({
+            message: 'Provision an Object Storage bucket for application files (in addition to the database)?',
+            initialValue: false,
+        }));
+    }
+    if (hasNonProd && out.basicAuth === undefined) {
+        out.basicAuth = await ask(p.confirm({
+            message: 'Protect non-production environments with Basic Auth (enforced by your app)?',
             initialValue: true,
         }));
     }
@@ -96,10 +120,13 @@ export async function fillMissing(partial, options) {
             initialValue: String(initial),
             validate: validate((v) => validateScale(v, 'scale')),
         })));
-        out.scaling.stagingMinScale = await scale('Staging min scale', out.scaling.stagingMinScale ?? 0);
-        out.scaling.stagingMaxScale = await scale('Staging max scale', out.scaling.stagingMaxScale ?? 1);
-        out.scaling.prodMinScale = await scale('Prod min scale', out.scaling.prodMinScale ?? 0);
-        out.scaling.prodMaxScale = await scale('Prod max scale', out.scaling.prodMaxScale ?? 2);
+        for (const slug of slugs) {
+            const def = envDefaultScale(slug);
+            const current = out.scaling[slug] ?? {};
+            current.minScale = await scale(`${slug} min scale`, current.minScale ?? def.minScale);
+            current.maxScale = await scale(`${slug} max scale`, current.maxScale ?? def.maxScale);
+            out.scaling[slug] = current;
+        }
     }
     return out;
 }

package/dist/ui.js

@@ -30,6 +30,7 @@ export async function withSpinner(label, fn) {
     }
 }
 export function renderSummary(answers, dryRun) {
+    const envSlugs = answers.environments.map((e) => e.slug).join(', ');
     const lines = [
         `Project          ${answers.projectName}`,
         `Directory        ./${answers.targetDir}`,
@@ -48,12 +49,21 @@ export function renderSummary(answers, dryRun) {
         'Infisical',
         `  host           ${answers.infisical.host}`,
         `  project        ${answers.infisical.projectName} (created or reused)`,
-        `  environments   staging, prod (+ placeholder secrets)`,
+        `  environments   ${envSlugs} (+ placeholder secrets)`,
         '',
-        `Basic Auth on staging   ${answers.basicAuthStaging ? 'enabled' : 'disabled'}`,
-        `Scaling staging         ${answers.scaling.stagingMinScale}-${answers.scaling.stagingMaxScale} instances`,
-        `Scaling prod            ${answers.scaling.prodMinScale}-${answers.scaling.prodMaxScale} instances`,
+        `Object Storage   ${answers.objectStorage ? 'enabled (per-environment bucket + S3_* secrets)' : 'disabled'}`,
+        'Environments',
     ];
+    for (const env of answers.environments) {
+        const flags = [
+            `scale ${env.minScale}-${env.maxScale}`,
+            env.gated ? 'manual approval' : 'auto-deploy',
+            env.basicAuth ? 'basic auth' : null,
+        ]
+            .filter(Boolean)
+            .join(', ');
+        lines.push(`  ${env.slug.padEnd(8)} ${flags}`);
+    }
     if (dryRun) {
         lines.push('', 'DRY RUN: files will be generated locally, no account will be touched.');
     }
@@ -69,7 +79,7 @@ export function renderNextSteps(answers, repoUrl, containerUrlHint) {
         `     project "${answers.infisical.projectName}" with real values.`,
         `  3. Push to main (or merge a PR) to trigger the first terraform apply:`,
         `     ${repoUrl}/actions`,
-        `  4. Set container_image in staging.tfvars / prod.tfvars once an image exists.`,
+        `  4. Set container_image in ${answers.environments.map((e) => `${e.slug}.tfvars`).join(' / ')} once an image exists.`,
         '',
         `Repository: ${repoUrl}`,
     ].join('\n');

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@gambi97/keel-cli",
-  "version": "0.1.1",
+  "version": "0.2.0",
   "description": "One command from zero to a production-shaped serverless infrastructure on Scaleway (Terraform + GitHub Actions + Infisical). Only Node required.",
   "keywords": [
     "keel",

package/templates/.github/scripts/sync-secrets.sh

@@ -0,0 +1,65 @@
+#!/usr/bin/env bash
+# Pushes the secrets Terraform produced to Infisical, so the application reads
+# them at runtime: always DATABASE_URL (dedicated IAM credential included), plus
+# the S3_* Object Storage coordinates when that feature is enabled.
+# Usage: sync-secrets.sh <environment>
+# Expects: INFISICAL_HOST, INFISICAL_CLIENT_ID, INFISICAL_CLIENT_SECRET,
+#          INFISICAL_PROJECT_ID in the environment; terraform init already run.
+set -euo pipefail
+
+ENVIRONMENT="${1:?usage: sync-secrets.sh <environment>}"
+
+SECRETS_JSON="$(terraform output -json infisical_secrets)"
+if [ -z "$SECRETS_JSON" ] || [ "$SECRETS_JSON" = "null" ] || [ "$SECRETS_JSON" = "{}" ]; then
+  echo "No secrets to sync."
+  exit 0
+fi
+
+ACCESS_TOKEN="$(curl -sS --fail-with-body -X POST \
+  "$INFISICAL_HOST/api/v1/auth/universal-auth/login" \
+  -H "Content-Type: application/json" \
+  -d "{\"clientId\":\"$INFISICAL_CLIENT_ID\",\"clientSecret\":\"$INFISICAL_CLIENT_SECRET\"}" \
+  | jq -r .accessToken)"
+echo "::add-mask::$ACCESS_TOKEN"
+
+sync_secret() {
+  local name="$1" value="$2"
+  echo "::add-mask::$value"
+  local payload
+  payload="$(jq -n \
+    --arg workspaceId "$INFISICAL_PROJECT_ID" \
+    --arg environment "$ENVIRONMENT" \
+    --arg value "$value" \
+    '{workspaceId: $workspaceId, environment: $environment, secretPath: "/", secretValue: $value, type: "shared"}')"
+  local status
+  status="$(curl -sS -o /dev/null -w "%{http_code}" -X PATCH \
+    "$INFISICAL_HOST/api/v3/secrets/raw/$name" \
+    -H "Authorization: Bearer $ACCESS_TOKEN" \
+    -H "Content-Type: application/json" \
+    -d "$payload")"
+  # PATCH updates the placeholder seeded at bootstrap; create the secret if missing.
+  if [ "$status" = "404" ]; then
+    curl -sS --fail-with-body -o /dev/null -X POST \
+      "$INFISICAL_HOST/api/v3/secrets/raw/$name" \
+      -H "Authorization: Bearer $ACCESS_TOKEN" \
+      -H "Content-Type: application/json" \
+      -d "$payload"
+  elif [ "$status" -ge 300 ]; then
+    echo "Failed to update $name in Infisical (HTTP $status)" >&2
+    exit 1
+  fi
+  echo "Synced $name to Infisical ($ENVIRONMENT)."
+}
+
+# Iterate the output map as base64-encoded {key,value} rows to survive any
+# special characters in the values.
+while IFS= read -r row; do
+  entry="$(echo "$row" | base64 --decode)"
+  name="$(echo "$entry" | jq -r '.key')"
+  value="$(echo "$entry" | jq -r '.value')"
+  if [ -z "$value" ] || [ "$value" = "null" ]; then
+    echo "Skipping $name (no value yet)."
+    continue
+  fi
+  sync_secret "$name" "$value"
+done < <(echo "$SECRETS_JSON" | jq -r 'to_entries[] | @base64')

package/templates/.github/workflows/terraform-drift.yml

@@ -35,7 +35,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        environment: [staging, prod]
+        environment: __ENV_MATRIX__
     steps:
       - uses: actions/checkout@v4
 

package/templates/.github/workflows/terraform-plan.yml

@@ -29,7 +29,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        environment: [staging, prod]
+        environment: __ENV_MATRIX__
     steps:
       - uses: actions/checkout@v4
 

package/templates/README.md

@@ -17,12 +17,14 @@ here.
 | Container namespace + Serverless Container | Runs the app, scales to zero when idle |
 | Serverless SQL Database (Postgres) | One independent database per environment |
 | IAM application + API key | Dedicated least-privilege database credential for the app |
+| Object Storage bucket (optional) | Per-environment file store, with its own least-privilege credential |
 
-Two environments, **staging** and **prod**, isolated via Terraform
-workspaces: same code, two separate states, differences confined to
-`staging.tfvars` / `prod.tfvars`. Staging expects the app to enforce Basic
-Auth (see below). State lives in the `__PROJECT_NAME__-tfstate` bucket on
-Scaleway Object Storage.
+Each environment is isolated via a Terraform **workspace**: same code, one
+independent state per environment, differences confined to the committed
+`<env>.tfvars` files (one per environment — look at the `*.tfvars` in this
+repo to see which ones your project has). Non-production environments expect
+the app to enforce Basic Auth (see below). State lives in the
+`__PROJECT_NAME__-tfstate` bucket on Scaleway Object Storage.
 
 **There are no secrets in this repository**, and none should ever be added.
 Credentials live in GitHub Actions encrypted secrets (CI) and in Infisical
@@ -31,21 +33,24 @@ Credentials live in GitHub Actions encrypted secrets (CI) and in Infisical
 > Naming heads-up: `backend.tf` configures the Terraform **state backend**,
 > the bucket where Terraform records what it has created. It has nothing to
 > do with your application's backend, which is just the Docker image you
-> deploy.
+> deploy. The optional Object Storage bucket above is a separate,
+> application-facing file store.
 
 ## How deploys work
 
 ```
-PR to main        -> terraform fmt + validate + plan (staging & prod), shown as PR checks
-merge/push main   -> apply staging -> manual approval (production gate) -> apply prod
+PR to main        -> terraform fmt + validate + plan (every environment), shown as PR checks
+merge/push main   -> apply each environment in order; any gated environment (production) waits for manual approval
 ```
 
 - `main` is protected: PRs need a green plan, force pushes are blocked.
-- The prod apply waits for approval on the `production` GitHub Environment.
-- After each apply, the pipeline writes a ready-to-use Postgres connection
-  string to Infisical as `DATABASE_URL` for that environment. The credential
-  inside it is a dedicated IAM application that can only read/write the
-  database (least privilege), not your main API key.
+- Environments apply in order, each `needs:` the previous one; a gated
+  environment (production) waits for approval on its GitHub Environment.
+- After each apply, the pipeline syncs the secrets Terraform produced to
+  Infisical for that environment: a ready-to-use Postgres `DATABASE_URL`
+  (whose credential is a dedicated IAM application that can only read/write
+  the database, not your main API key) and, when Object Storage is enabled,
+  the `S3_*` coordinates.
 - State is locked during applies (S3-native locking, `use_lockfile`), so
   concurrent runs cannot corrupt it.
 - A scheduled **drift detection** workflow (Monday 06:00 UTC, or manual via
@@ -55,43 +60,45 @@ merge/push main   -> apply staging -> manual approval (production gate) -> apply
 ## First deploy
 
 1. **Merge or push to `main`.** The first pipeline run creates registry and
-   databases. The Serverless Container is intentionally skipped until an
-   image exists (`container_image` is empty), so the first apply is green.
+   databases (and the Object Storage bucket, if enabled). The Serverless
+   Container is intentionally skipped until an image exists (`container_image`
+   is empty), so the first apply is green.
 
 2. **Build and push the app image** (any Dockerfile, listening on port 8080
-   by default):
+   by default), replacing `<env>` with your target environment (e.g. staging):
 
    ```sh
-   docker login rg.__REGION__.scw.cloud/__PROJECT_NAME__-staging -u nologin --password-stdin <<< "$SCW_SECRET_KEY"
-   docker build -t rg.__REGION__.scw.cloud/__PROJECT_NAME__-staging/app:latest .
-   docker push rg.__REGION__.scw.cloud/__PROJECT_NAME__-staging/app:latest
+   docker login rg.__REGION__.scw.cloud/__PROJECT_NAME__-<env> -u nologin --password-stdin <<< "$SCW_SECRET_KEY"
+   docker build -t rg.__REGION__.scw.cloud/__PROJECT_NAME__-<env>/app:latest .
+   docker push rg.__REGION__.scw.cloud/__PROJECT_NAME__-<env>/app:latest
    ```
 
-3. **Point the container at the image**: set `container_image` in
-   `staging.tfvars` (and later in `prod.tfvars`, using the prod registry),
-   open a PR, review the plan, merge. The apply creates the container and
-   prints its URL (`terraform output container_url`).
+3. **Point the container at the image**: set `container_image` in the target
+   `<env>.tfvars`, open a PR, review the plan, merge. The apply creates the
+   container and prints its URL (`terraform output container_url`).
 
 4. **Fill in the real secrets in Infisical.** The bootstrap seeded
-   placeholders; replace them with production values. The app reads
-   everything from its environment:
+   placeholders; replace them with real values. The app reads everything from
+   its environment:
 
-   | Variable | Environment | Notes |
+   | Variable | Where | Notes |
    |---|---|---|
-   | `DATABASE_URL` | staging + prod | Complete connection string, auto-updated by the pipeline after each apply. No action needed |
-   | `BASIC_AUTH_USER` / `BASIC_AUTH_PASSWORD` | staging | The app must enforce these when `BASIC_AUTH_ENABLED=true` |
+   | `DATABASE_URL` | every environment | Complete connection string, auto-updated by the pipeline after each apply. No action needed |
+   | `BASIC_AUTH_USER` / `BASIC_AUTH_PASSWORD` | non-production | The app must enforce these when `BASIC_AUTH_ENABLED=true` |
+   | `S3_BUCKET` / `S3_ENDPOINT` / `S3_REGION` / `S3_ACCESS_KEY` / `S3_SECRET_KEY` | every environment (if Object Storage enabled) | Auto-updated by the pipeline after each apply |
 
    Every secret in the Infisical environment is injected into the container
    as a secret environment variable, so adding an app secret is: add it in
    Infisical, re-run the apply (any merge to `main`).
 
-## Basic Auth on staging
+## Basic Auth on non-production environments
 
 Scaleway Serverless Containers expose public endpoints with no built-in auth,
-so staging protection is enforced **by the application**: the container
+so non-production protection is enforced **by the application**: the container
 receives `BASIC_AUTH_ENABLED=true` plus the credentials from Infisical, and
 the app is expected to respond `401` without them (a few lines of middleware
-in any framework). Prod does not set `BASIC_AUTH_ENABLED`.
+in any framework). Production does not set `BASIC_AUTH_ENABLED`. Whether an
+environment enables it is the `enable_basic_auth` flag in its `<env>.tfvars`.
 
 ## Day-2 operations
 
@@ -107,15 +114,18 @@ in any framework). Prod does not set `BASIC_AUTH_ENABLED`.
   secrets (repo Settings > Secrets and variables > Actions).
 - **Add a custom domain**: add a `scaleway_container_domain` resource in
   `modules/app_stack` pointing at the container, plus your DNS record.
-- **Add an environment**: add a workspace, an `<env>.tfvars`, an Infisical
-  environment with the same slug, and mirror one job in each workflow.
+- **Add an environment**: add a `<env>.tfvars`, an Infisical environment with
+  the same slug, an entry in the plan/drift matrix and a job in
+  `.github/workflows/terraform-apply.yml` (mirror an existing one and set its
+  `needs:` to chain after the previous environment).
 - **Pin provider versions**: after any local `terraform init`, commit the
   generated `.terraform.lock.hcl` so CI resolves the exact same provider
   builds on every run.
 
 ## Running Terraform locally (optional)
 
-CI is the source of truth, but plans can be run locally:
+CI is the source of truth, but plans can be run locally (replace `<env>` with
+one of your environments):
 
 ```sh
 cp backend.hcl.example backend.hcl
@@ -131,34 +141,35 @@ export TF_VAR_infisical_project_id=<infisical-project-id>
 export TF_VAR_infisical_host=https://app.infisical.com
 
 terraform init -backend-config=backend.hcl
-terraform workspace select -or-create staging
-terraform plan -var-file=staging.tfvars
+terraform workspace select -or-create <env>
+terraform plan -var-file=<env>.tfvars
 ```
 
 Avoid local applies: they race against CI on the same state.
 
 ## Configuration reference
 
-- **Committed tfvars** (`staging.tfvars`, `prod.tfvars`): non-sensitive knobs
-  only (name, region, scaling, image).
+- **Committed tfvars** (`<env>.tfvars`, one per environment): non-sensitive
+  knobs only (name, region, scaling, image, `enable_basic_auth`,
+  `enable_object_storage`).
 - **GitHub Actions secrets**: `SCW_ACCESS_KEY`, `SCW_SECRET_KEY`,
   `SCW_DEFAULT_PROJECT_ID`, `SCW_DEFAULT_ORGANIZATION_ID`,
   `INFISICAL_CLIENT_ID`, `INFISICAL_CLIENT_SECRET`. The workflows reuse the
   Scaleway keys as `AWS_*` for the state backend.
 - **GitHub Actions variables**: `TF_STATE_BUCKET`, `SCW_REGION`,
   `INFISICAL_PROJECT_ID`, `INFISICAL_HOST`.
-- **Infisical**: one environment per workspace (`staging`, `prod`), all
-  application secrets.
+- **Infisical**: one environment per workspace, all application secrets.
 
 ## Troubleshooting
 
 - **Plan fails with 403 on the state bucket**: the `SCW_*` secrets don't
   match a Scaleway key with Object Storage access.
 - **Plan fails reading Infisical secrets**: check `INFISICAL_PROJECT_ID` and
-  that the machine identity has access to the project and both environments.
+  that the machine identity has access to the project and every environment.
 - **Apply green but no container**: expected until `container_image` is set.
 - **App can't reach the database**: `DATABASE_URL` is only synced after an
   apply; check the value in Infisical for that environment. It must contain
   a username and password (the dedicated IAM credential), not placeholders.
 - **Apply fails creating IAM resources**: the CI Scaleway key needs IAM
-  permissions (IAMManager) to create the app's database credential.
+  permissions (IAMManager) to create the app's database (and Object Storage)
+  credential.

package/templates/_partials/apply-header.yml

@@ -0,0 +1,33 @@
+name: Terraform apply
+
+on:
+  push:
+    branches: [main]
+
+permissions:
+  contents: read
+
+concurrency:
+  group: terraform-apply
+  cancel-in-progress: false
+
+env:
+  # The Scaleway keys double as S3 credentials for the state backend, so the
+  # same secret feeds both variables: one credential, one place to rotate.
+  AWS_ACCESS_KEY_ID: ${{ secrets.SCW_ACCESS_KEY }}
+  AWS_SECRET_ACCESS_KEY: ${{ secrets.SCW_SECRET_KEY }}
+  SCW_ACCESS_KEY: ${{ secrets.SCW_ACCESS_KEY }}
+  SCW_SECRET_KEY: ${{ secrets.SCW_SECRET_KEY }}
+  SCW_DEFAULT_PROJECT_ID: ${{ secrets.SCW_DEFAULT_PROJECT_ID }}
+  SCW_DEFAULT_ORGANIZATION_ID: ${{ secrets.SCW_DEFAULT_ORGANIZATION_ID }}
+  INFISICAL_CLIENT_ID: ${{ secrets.INFISICAL_CLIENT_ID }}
+  INFISICAL_CLIENT_SECRET: ${{ secrets.INFISICAL_CLIENT_SECRET }}
+  INFISICAL_PROJECT_ID: ${{ vars.INFISICAL_PROJECT_ID }}
+  INFISICAL_HOST: ${{ vars.INFISICAL_HOST }}
+  TF_VAR_infisical_client_id: ${{ secrets.INFISICAL_CLIENT_ID }}
+  TF_VAR_infisical_client_secret: ${{ secrets.INFISICAL_CLIENT_SECRET }}
+  TF_VAR_infisical_project_id: ${{ vars.INFISICAL_PROJECT_ID }}
+  TF_VAR_infisical_host: ${{ vars.INFISICAL_HOST }}
+  TF_IN_AUTOMATION: "true"
+
+jobs:

package/templates/_partials/apply-job.yml

@@ -0,0 +1,34 @@
+  apply-__ENV_SLUG__:
+    name: apply (__ENV_SLUG__)
+    runs-on: ubuntu-latest
+__NEEDS_LINE__    # The GitHub environment may carry a required-reviewer rule, gating this job.
+    environment: __GH_ENVIRONMENT__
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: hashicorp/setup-terraform@v3
+        with:
+          terraform_version: "~1.12"
+          terraform_wrapper: false
+
+      - name: Write backend config
+        run: |
+          cat > backend.hcl <<EOF
+          bucket = "${{ vars.TF_STATE_BUCKET }}"
+          region = "${{ vars.SCW_REGION }}"
+          endpoints = {
+            s3 = "https://s3.${{ vars.SCW_REGION }}.scw.cloud"
+          }
+          EOF
+
+      - name: Terraform init
+        run: terraform init -input=false -backend-config=backend.hcl
+
+      - name: Select workspace
+        run: terraform workspace select -or-create __ENV_SLUG__
+
+      - name: Terraform apply
+        run: terraform apply -input=false -auto-approve -var-file=__ENV_SLUG__.tfvars
+
+      - name: Sync secrets to Infisical
+        run: ./.github/scripts/sync-secrets.sh __ENV_SLUG__

package/templates/env.tfvars

@@ -0,0 +1,8 @@
+# Non-sensitive __ENVIRONMENT__ configuration. Safe to commit.
+project_name          = "__PROJECT_NAME__"
+region                = "__REGION__"
+environment           = "__ENVIRONMENT__"
+enable_basic_auth     = __ENABLE_BASIC_AUTH__
+enable_object_storage = __ENABLE_OBJECT_STORAGE__
+min_scale             = __MIN_SCALE__
+max_scale             = __MAX_SCALE__

package/templates/main.tf

@@ -20,7 +20,8 @@ module "app_stack" {
   db_min_cpu      = var.db_min_cpu
   db_max_cpu      = var.db_max_cpu
 
-  enable_basic_auth = var.enable_basic_auth
+  enable_basic_auth     = var.enable_basic_auth
+  enable_object_storage = var.enable_object_storage
 
   secret_environment_variables = {
     for name, secret in data.infisical_secrets.app.secrets : name => secret.value

package/templates/modules/app_stack/main.tf

@@ -44,6 +44,40 @@ resource "scaleway_iam_api_key" "db" {
   description    = "Database credential for ${local.name} (managed by Terraform)"
 }
 
+# Optional Object Storage bucket for application files (uploads, assets, …),
+# with a dedicated least-privilege credential just like the database: this
+# application can reach Object Storage and nothing else. Its access/secret key
+# and the bucket coordinates are synced to Infisical after each apply.
+resource "scaleway_object_bucket" "files" {
+  count  = var.enable_object_storage ? 1 : 0
+  name   = "${local.name}-files"
+  region = var.region
+}
+
+resource "scaleway_iam_application" "storage" {
+  count       = var.enable_object_storage ? 1 : 0
+  name        = "${local.name}-storage"
+  description = "Object Storage access for ${local.name} (managed by Terraform)"
+}
+
+resource "scaleway_iam_policy" "storage_access" {
+  count          = var.enable_object_storage ? 1 : 0
+  name           = "${local.name}-storage-access"
+  description    = "Object Storage access for ${local.name}"
+  application_id = scaleway_iam_application.storage[0].id
+
+  rule {
+    project_ids          = [scaleway_sdb_sql_database.this.project_id]
+    permission_set_names = ["ObjectStorageFullAccess"]
+  }
+}
+
+resource "scaleway_iam_api_key" "storage" {
+  count          = var.enable_object_storage ? 1 : 0
+  application_id = scaleway_iam_application.storage[0].id
+  description    = "Object Storage credential for ${local.name} (managed by Terraform)"
+}
+
 # The container is gated on an image being available: registry and database
 # are provisioned first, the container appears once an image has been pushed
 # and container_image is set.