@gambi97/keel-cli 0.1.1 → 0.2.1

package/templates/README.md

@@ -17,12 +17,14 @@ here.
 | Container namespace + Serverless Container | Runs the app, scales to zero when idle |
 | Serverless SQL Database (Postgres) | One independent database per environment |
 | IAM application + API key | Dedicated least-privilege database credential for the app |
+| Object Storage bucket (optional) | Per-environment file store, with its own least-privilege credential |
 
-Two environments, **staging** and **prod**, isolated via Terraform
-workspaces: same code, two separate states, differences confined to
-`staging.tfvars` / `prod.tfvars`. Staging expects the app to enforce Basic
-Auth (see below). State lives in the `__PROJECT_NAME__-tfstate` bucket on
-Scaleway Object Storage.
+Each environment is isolated via a Terraform **workspace**: same code, one
+independent state per environment, differences confined to the committed
+`<env>.tfvars` files (one per environment — look at the `*.tfvars` in this
+repo to see which ones your project has). Non-production environments expect
+the app to enforce Basic Auth (see below). State lives in the
+`__PROJECT_NAME__-tfstate` bucket on Scaleway Object Storage.
 
 **There are no secrets in this repository**, and none should ever be added.
 Credentials live in GitHub Actions encrypted secrets (CI) and in Infisical
@@ -31,21 +33,24 @@ Credentials live in GitHub Actions encrypted secrets (CI) and in Infisical
 > Naming heads-up: `backend.tf` configures the Terraform **state backend**,
 > the bucket where Terraform records what it has created. It has nothing to
 > do with your application's backend, which is just the Docker image you
-> deploy.
+> deploy. The optional Object Storage bucket above is a separate,
+> application-facing file store.
 
 ## How deploys work
 
 ```
-PR to main        -> terraform fmt + validate + plan (staging & prod), shown as PR checks
-merge/push main   -> apply staging -> manual approval (production gate) -> apply prod
+PR to main        -> terraform fmt + validate + plan (every environment), shown as PR checks
+merge/push main   -> apply each environment in order; any gated environment (production) waits for manual approval
 ```
 
 - `main` is protected: PRs need a green plan, force pushes are blocked.
-- The prod apply waits for approval on the `production` GitHub Environment.
-- After each apply, the pipeline writes a ready-to-use Postgres connection
-  string to Infisical as `DATABASE_URL` for that environment. The credential
-  inside it is a dedicated IAM application that can only read/write the
-  database (least privilege), not your main API key.
+- Environments apply in order, each `needs:` the previous one; a gated
+  environment (production) waits for approval on its GitHub Environment.
+- After each apply, the pipeline syncs the secrets Terraform produced to
+  Infisical for that environment: a ready-to-use Postgres `DATABASE_URL`
+  (whose credential is a dedicated IAM application that can only read/write
+  the database, not your main API key) and, when Object Storage is enabled,
+  the `S3_*` coordinates.
 - State is locked during applies (S3-native locking, `use_lockfile`), so
   concurrent runs cannot corrupt it.
 - A scheduled **drift detection** workflow (Monday 06:00 UTC, or manual via
@@ -55,43 +60,45 @@ merge/push main   -> apply staging -> manual approval (production gate) -> apply
 ## First deploy
 
 1. **Merge or push to `main`.** The first pipeline run creates registry and
-   databases. The Serverless Container is intentionally skipped until an
-   image exists (`container_image` is empty), so the first apply is green.
+   databases (and the Object Storage bucket, if enabled). The Serverless
+   Container is intentionally skipped until an image exists (`container_image`
+   is empty), so the first apply is green.
 
 2. **Build and push the app image** (any Dockerfile, listening on port 8080
-   by default):
+   by default), replacing `<env>` with your target environment (e.g. staging):
 
    ```sh
-   docker login rg.__REGION__.scw.cloud/__PROJECT_NAME__-staging -u nologin --password-stdin <<< "$SCW_SECRET_KEY"
-   docker build -t rg.__REGION__.scw.cloud/__PROJECT_NAME__-staging/app:latest .
-   docker push rg.__REGION__.scw.cloud/__PROJECT_NAME__-staging/app:latest
+   docker login rg.__REGION__.scw.cloud/__PROJECT_NAME__-<env> -u nologin --password-stdin <<< "$SCW_SECRET_KEY"
+   docker build -t rg.__REGION__.scw.cloud/__PROJECT_NAME__-<env>/app:latest .
+   docker push rg.__REGION__.scw.cloud/__PROJECT_NAME__-<env>/app:latest
    ```
 
-3. **Point the container at the image**: set `container_image` in
-   `staging.tfvars` (and later in `prod.tfvars`, using the prod registry),
-   open a PR, review the plan, merge. The apply creates the container and
-   prints its URL (`terraform output container_url`).
+3. **Point the container at the image**: set `container_image` in the target
+   `<env>.tfvars`, open a PR, review the plan, merge. The apply creates the
+   container and prints its URL (`terraform output container_url`).
 
 4. **Fill in the real secrets in Infisical.** The bootstrap seeded
-   placeholders; replace them with production values. The app reads
-   everything from its environment:
+   placeholders; replace them with real values. The app reads everything from
+   its environment:
 
-   | Variable | Environment | Notes |
+   | Variable | Where | Notes |
    |---|---|---|
-   | `DATABASE_URL` | staging + prod | Complete connection string, auto-updated by the pipeline after each apply. No action needed |
-   | `BASIC_AUTH_USER` / `BASIC_AUTH_PASSWORD` | staging | The app must enforce these when `BASIC_AUTH_ENABLED=true` |
+   | `DATABASE_URL` | every environment | Complete connection string, auto-updated by the pipeline after each apply. No action needed |
+   | `BASIC_AUTH_USER` / `BASIC_AUTH_PASSWORD` | non-production | The app must enforce these when `BASIC_AUTH_ENABLED=true` |
+   | `S3_BUCKET` / `S3_ENDPOINT` / `S3_REGION` / `S3_ACCESS_KEY` / `S3_SECRET_KEY` | every environment (if Object Storage enabled) | Auto-updated by the pipeline after each apply |
 
    Every secret in the Infisical environment is injected into the container
    as a secret environment variable, so adding an app secret is: add it in
    Infisical, re-run the apply (any merge to `main`).
 
-## Basic Auth on staging
+## Basic Auth on non-production environments
 
 Scaleway Serverless Containers expose public endpoints with no built-in auth,
-so staging protection is enforced **by the application**: the container
+so non-production protection is enforced **by the application**: the container
 receives `BASIC_AUTH_ENABLED=true` plus the credentials from Infisical, and
 the app is expected to respond `401` without them (a few lines of middleware
-in any framework). Prod does not set `BASIC_AUTH_ENABLED`.
+in any framework). Production does not set `BASIC_AUTH_ENABLED`. Whether an
+environment enables it is the `enable_basic_auth` flag in its `<env>.tfvars`.
 
 ## Day-2 operations
 
@@ -107,15 +114,21 @@ in any framework). Prod does not set `BASIC_AUTH_ENABLED`.
   secrets (repo Settings > Secrets and variables > Actions).
 - **Add a custom domain**: add a `scaleway_container_domain` resource in
   `modules/app_stack` pointing at the container, plus your DNS record.
-- **Add an environment**: add a workspace, an `<env>.tfvars`, an Infisical
-  environment with the same slug, and mirror one job in each workflow.
+- **Add an environment**: add a `<env>.tfvars` at the repo root (the plan and
+  drift workflows discover environments from the tfvars files automatically),
+  create an Infisical environment with the same slug, and add a job in
+  `.github/workflows/terraform-apply.yml` (mirror an existing one and set its
+  `needs:` to chain after the previous environment). Note: the new `plan
+  (<env>)` check becomes required on `main` only after you add it in the
+  branch-protection settings.
 - **Pin provider versions**: after any local `terraform init`, commit the
   generated `.terraform.lock.hcl` so CI resolves the exact same provider
   builds on every run.
 
 ## Running Terraform locally (optional)
 
-CI is the source of truth, but plans can be run locally:
+CI is the source of truth, but plans can be run locally (replace `<env>` with
+one of your environments):
 
 ```sh
 cp backend.hcl.example backend.hcl
@@ -131,34 +144,35 @@ export TF_VAR_infisical_project_id=<infisical-project-id>
 export TF_VAR_infisical_host=https://app.infisical.com
 
 terraform init -backend-config=backend.hcl
-terraform workspace select -or-create staging
-terraform plan -var-file=staging.tfvars
+terraform workspace select -or-create <env>
+terraform plan -var-file=<env>.tfvars
 ```
 
 Avoid local applies: they race against CI on the same state.
 
 ## Configuration reference
 
-- **Committed tfvars** (`staging.tfvars`, `prod.tfvars`): non-sensitive knobs
-  only (name, region, scaling, image).
+- **Committed tfvars** (`<env>.tfvars`, one per environment): non-sensitive
+  knobs only (name, region, scaling, image, `enable_basic_auth`,
+  `enable_object_storage`).
 - **GitHub Actions secrets**: `SCW_ACCESS_KEY`, `SCW_SECRET_KEY`,
   `SCW_DEFAULT_PROJECT_ID`, `SCW_DEFAULT_ORGANIZATION_ID`,
   `INFISICAL_CLIENT_ID`, `INFISICAL_CLIENT_SECRET`. The workflows reuse the
   Scaleway keys as `AWS_*` for the state backend.
 - **GitHub Actions variables**: `TF_STATE_BUCKET`, `SCW_REGION`,
   `INFISICAL_PROJECT_ID`, `INFISICAL_HOST`.
-- **Infisical**: one environment per workspace (`staging`, `prod`), all
-  application secrets.
+- **Infisical**: one environment per workspace, all application secrets.
 
 ## Troubleshooting
 
 - **Plan fails with 403 on the state bucket**: the `SCW_*` secrets don't
   match a Scaleway key with Object Storage access.
 - **Plan fails reading Infisical secrets**: check `INFISICAL_PROJECT_ID` and
-  that the machine identity has access to the project and both environments.
+  that the machine identity has access to the project and every environment.
 - **Apply green but no container**: expected until `container_image` is set.
 - **App can't reach the database**: `DATABASE_URL` is only synced after an
   apply; check the value in Infisical for that environment. It must contain
   a username and password (the dedicated IAM credential), not placeholders.
 - **Apply fails creating IAM resources**: the CI Scaleway key needs IAM
-  permissions (IAMManager) to create the app's database credential.
+  permissions (IAMManager) to create the app's database (and Object Storage)
+  credential.

package/templates/_partials/apply-header.yml

@@ -0,0 +1,33 @@
+name: Terraform apply
+
+on:
+  push:
+    branches: [main]
+
+permissions:
+  contents: read
+
+concurrency:
+  group: terraform-apply
+  cancel-in-progress: false
+
+env:
+  # The Scaleway keys double as S3 credentials for the state backend, so the
+  # same secret feeds both variables: one credential, one place to rotate.
+  AWS_ACCESS_KEY_ID: ${{ secrets.SCW_ACCESS_KEY }}
+  AWS_SECRET_ACCESS_KEY: ${{ secrets.SCW_SECRET_KEY }}
+  SCW_ACCESS_KEY: ${{ secrets.SCW_ACCESS_KEY }}
+  SCW_SECRET_KEY: ${{ secrets.SCW_SECRET_KEY }}
+  SCW_DEFAULT_PROJECT_ID: ${{ secrets.SCW_DEFAULT_PROJECT_ID }}
+  SCW_DEFAULT_ORGANIZATION_ID: ${{ secrets.SCW_DEFAULT_ORGANIZATION_ID }}
+  INFISICAL_CLIENT_ID: ${{ secrets.INFISICAL_CLIENT_ID }}
+  INFISICAL_CLIENT_SECRET: ${{ secrets.INFISICAL_CLIENT_SECRET }}
+  INFISICAL_PROJECT_ID: ${{ vars.INFISICAL_PROJECT_ID }}
+  INFISICAL_HOST: ${{ vars.INFISICAL_HOST }}
+  TF_VAR_infisical_client_id: ${{ secrets.INFISICAL_CLIENT_ID }}
+  TF_VAR_infisical_client_secret: ${{ secrets.INFISICAL_CLIENT_SECRET }}
+  TF_VAR_infisical_project_id: ${{ vars.INFISICAL_PROJECT_ID }}
+  TF_VAR_infisical_host: ${{ vars.INFISICAL_HOST }}
+  TF_IN_AUTOMATION: "true"
+
+jobs:

package/templates/_partials/apply-job.yml

@@ -0,0 +1,34 @@
+  apply-__ENV_SLUG__:
+    name: apply (__ENV_SLUG__)
+    runs-on: ubuntu-latest
+__NEEDS_LINE__    # The GitHub environment may carry a required-reviewer rule, gating this job.
+    environment: __GH_ENVIRONMENT__
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: hashicorp/setup-terraform@v3
+        with:
+          terraform_version: "~1.12"
+          terraform_wrapper: false
+
+      - name: Write backend config
+        run: |
+          cat > backend.hcl <<EOF
+          bucket = "${{ vars.TF_STATE_BUCKET }}"
+          region = "${{ vars.SCW_REGION }}"
+          endpoints = {
+            s3 = "https://s3.${{ vars.SCW_REGION }}.scw.cloud"
+          }
+          EOF
+
+      - name: Terraform init
+        run: terraform init -input=false -backend-config=backend.hcl
+
+      - name: Select workspace
+        run: terraform workspace select -or-create __ENV_SLUG__
+
+      - name: Terraform apply
+        run: terraform apply -input=false -auto-approve -var-file=__ENV_SLUG__.tfvars
+
+      - name: Sync secrets to Infisical
+        run: ./.github/scripts/sync-secrets.sh __ENV_SLUG__

package/templates/env.tfvars

@@ -0,0 +1,8 @@
+# Non-sensitive __ENVIRONMENT__ configuration. Safe to commit.
+project_name          = "__PROJECT_NAME__"
+region                = "__REGION__"
+environment           = "__ENVIRONMENT__"
+enable_basic_auth     = __ENABLE_BASIC_AUTH__
+enable_object_storage = __ENABLE_OBJECT_STORAGE__
+min_scale             = __MIN_SCALE__
+max_scale             = __MAX_SCALE__

package/templates/main.tf

@@ -3,6 +3,16 @@ data "infisical_secrets" "app" {
   env_slug     = var.environment
   workspace_id = var.infisical_project_id
   folder_path  = "/"
+
+  lifecycle {
+    # Guards against applying one environment's tfvars into another
+    # environment's state (e.g. prod.tfvars while the staging workspace is
+    # selected), which would create prod-named resources in staging state.
+    precondition {
+      condition     = terraform.workspace == var.environment
+      error_message = "The selected Terraform workspace must match var.environment: run `terraform workspace select <env>` before plan/apply with <env>.tfvars."
+    }
+  }
 }
 
 module "app_stack" {
@@ -20,7 +30,8 @@ module "app_stack" {
   db_min_cpu      = var.db_min_cpu
   db_max_cpu      = var.db_max_cpu
 
-  enable_basic_auth = var.enable_basic_auth
+  enable_basic_auth     = var.enable_basic_auth
+  enable_object_storage = var.enable_object_storage
 
   secret_environment_variables = {
     for name, secret in data.infisical_secrets.app.secrets : name => secret.value

package/templates/modules/app_stack/main.tf

@@ -44,6 +44,40 @@ resource "scaleway_iam_api_key" "db" {
   description    = "Database credential for ${local.name} (managed by Terraform)"
 }
 
+# Optional Object Storage bucket for application files (uploads, assets, …),
+# with a dedicated least-privilege credential just like the database: this
+# application can reach Object Storage and nothing else. Its access/secret key
+# and the bucket coordinates are synced to Infisical after each apply.
+resource "scaleway_object_bucket" "files" {
+  count  = var.enable_object_storage ? 1 : 0
+  name   = "${local.name}-files"
+  region = var.region
+}
+
+resource "scaleway_iam_application" "storage" {
+  count       = var.enable_object_storage ? 1 : 0
+  name        = "${local.name}-storage"
+  description = "Object Storage access for ${local.name} (managed by Terraform)"
+}
+
+resource "scaleway_iam_policy" "storage_access" {
+  count          = var.enable_object_storage ? 1 : 0
+  name           = "${local.name}-storage-access"
+  description    = "Object Storage access for ${local.name}"
+  application_id = scaleway_iam_application.storage[0].id
+
+  rule {
+    project_ids          = [scaleway_sdb_sql_database.this.project_id]
+    permission_set_names = ["ObjectStorageFullAccess"]
+  }
+}
+
+resource "scaleway_iam_api_key" "storage" {
+  count          = var.enable_object_storage ? 1 : 0
+  application_id = scaleway_iam_application.storage[0].id
+  description    = "Object Storage credential for ${local.name} (managed by Terraform)"
+}
+
 # The container is gated on an image being available: registry and database
 # are provisioned first, the container appears once an image has been pushed
 # and container_image is set.

package/templates/modules/app_stack/outputs.tf

@@ -21,3 +21,21 @@ output "database_url" {
 output "container_namespace_id" {
   value = scaleway_container_namespace.this.id
 }
+
+output "object_bucket_name" {
+  value = var.enable_object_storage ? scaleway_object_bucket.files[0].name : null
+}
+
+output "object_bucket_endpoint" {
+  value = var.enable_object_storage ? "https://s3.${var.region}.scw.cloud" : null
+}
+
+output "object_storage_access_key" {
+  value     = var.enable_object_storage ? scaleway_iam_api_key.storage[0].access_key : null
+  sensitive = true
+}
+
+output "object_storage_secret_key" {
+  value     = var.enable_object_storage ? scaleway_iam_api_key.storage[0].secret_key : null
+  sensitive = true
+}

package/templates/modules/app_stack/variables.tf

@@ -47,6 +47,11 @@ variable "enable_basic_auth" {
   type = bool
 }
 
+variable "enable_object_storage" {
+  type    = bool
+  default = false
+}
+
 variable "secret_environment_variables" {
   description = "Secrets injected into the container, sourced from Infisical."
   type        = map(string)

package/templates/outputs.tf

@@ -18,3 +18,25 @@ output "container_namespace_id" {
   description = "Scaleway Containers namespace ID."
   value       = module.app_stack.container_namespace_id
 }
+
+output "object_bucket_name" {
+  description = "Object Storage bucket for application files (null unless enabled)."
+  value       = module.app_stack.object_bucket_name
+}
+
+# The complete set of secrets the pipeline pushes to Infisical after each apply:
+# always DATABASE_URL, plus the S3_* coordinates when Object Storage is enabled.
+output "infisical_secrets" {
+  description = "Secrets synced to Infisical after each apply."
+  sensitive   = true
+  value = merge(
+    { DATABASE_URL = module.app_stack.database_url },
+    var.enable_object_storage ? {
+      S3_BUCKET     = module.app_stack.object_bucket_name
+      S3_ENDPOINT   = module.app_stack.object_bucket_endpoint
+      S3_REGION     = var.region
+      S3_ACCESS_KEY = module.app_stack.object_storage_access_key
+      S3_SECRET_KEY = module.app_stack.object_storage_secret_key
+    } : {}
+  )
+}

package/templates/variables.tf

@@ -13,8 +13,8 @@ variable "environment" {
   type        = string
 
   validation {
-    condition     = contains(["staging", "prod"], var.environment)
-    error_message = "environment must be either \"staging\" or \"prod\"."
+    condition     = contains(__ENV_SLUGS_TF__, var.environment)
+    error_message = "environment must be one of the configured environments."
   }
 }
 
@@ -72,6 +72,12 @@ variable "enable_basic_auth" {
   default     = false
 }
 
+variable "enable_object_storage" {
+  description = "When true, provision an Object Storage bucket for the app plus a dedicated least-privilege credential; its coordinates are synced to Infisical as S3_*."
+  type        = bool
+  default     = false
+}
+
 variable "infisical_host" {
   description = "Infisical instance URL."
   type        = string

package/templates/.github/scripts/sync-database-url.sh

@@ -1,49 +0,0 @@
-#!/usr/bin/env bash
-# Pushes the ready-to-use database connection string (dedicated IAM
-# credential included) to Infisical as DATABASE_URL.
-# Usage: sync-database-url.sh <staging|prod>
-# Expects: INFISICAL_HOST, INFISICAL_CLIENT_ID, INFISICAL_CLIENT_SECRET,
-#          INFISICAL_PROJECT_ID in the environment; terraform init already run.
-set -euo pipefail
-
-ENVIRONMENT="${1:?usage: sync-database-url.sh <staging|prod>}"
-
-DB_URL="$(terraform output -raw database_url)"
-if [ -z "$DB_URL" ]; then
-  echo "No database_url in outputs, skipping Infisical sync."
-  exit 0
-fi
-echo "::add-mask::$DB_URL"
-
-ACCESS_TOKEN="$(curl -sS --fail-with-body -X POST \
-  "$INFISICAL_HOST/api/v1/auth/universal-auth/login" \
-  -H "Content-Type: application/json" \
-  -d "{\"clientId\":\"$INFISICAL_CLIENT_ID\",\"clientSecret\":\"$INFISICAL_CLIENT_SECRET\"}" \
-  | jq -r .accessToken)"
-echo "::add-mask::$ACCESS_TOKEN"
-
-payload="$(jq -n \
-  --arg workspaceId "$INFISICAL_PROJECT_ID" \
-  --arg environment "$ENVIRONMENT" \
-  --arg value "$DB_URL" \
-  '{workspaceId: $workspaceId, environment: $environment, secretPath: "/", secretValue: $value, type: "shared"}')"
-
-# Update the placeholder seeded at bootstrap; create the secret if missing.
-status="$(curl -sS -o /dev/null -w "%{http_code}" -X PATCH \
-  "$INFISICAL_HOST/api/v3/secrets/raw/DATABASE_URL" \
-  -H "Authorization: Bearer $ACCESS_TOKEN" \
-  -H "Content-Type: application/json" \
-  -d "$payload")"
-
-if [ "$status" = "404" ]; then
-  curl -sS --fail-with-body -o /dev/null -X POST \
-    "$INFISICAL_HOST/api/v3/secrets/raw/DATABASE_URL" \
-    -H "Authorization: Bearer $ACCESS_TOKEN" \
-    -H "Content-Type: application/json" \
-    -d "$payload"
-elif [ "$status" -ge 300 ]; then
-  echo "Failed to update DATABASE_URL in Infisical (HTTP $status)" >&2
-  exit 1
-fi
-
-echo "DATABASE_URL synced to Infisical ($ENVIRONMENT)."

package/templates/.github/workflows/terraform-apply.yml

@@ -1,103 +0,0 @@
-name: Terraform apply
-
-on:
-  push:
-    branches: [main]
-
-permissions:
-  contents: read
-
-concurrency:
-  group: terraform-apply
-  cancel-in-progress: false
-
-env:
-  # The Scaleway keys double as S3 credentials for the state backend, so the
-  # same secret feeds both variables: one credential, one place to rotate.
-  AWS_ACCESS_KEY_ID: ${{ secrets.SCW_ACCESS_KEY }}
-  AWS_SECRET_ACCESS_KEY: ${{ secrets.SCW_SECRET_KEY }}
-  SCW_ACCESS_KEY: ${{ secrets.SCW_ACCESS_KEY }}
-  SCW_SECRET_KEY: ${{ secrets.SCW_SECRET_KEY }}
-  SCW_DEFAULT_PROJECT_ID: ${{ secrets.SCW_DEFAULT_PROJECT_ID }}
-  SCW_DEFAULT_ORGANIZATION_ID: ${{ secrets.SCW_DEFAULT_ORGANIZATION_ID }}
-  INFISICAL_CLIENT_ID: ${{ secrets.INFISICAL_CLIENT_ID }}
-  INFISICAL_CLIENT_SECRET: ${{ secrets.INFISICAL_CLIENT_SECRET }}
-  INFISICAL_PROJECT_ID: ${{ vars.INFISICAL_PROJECT_ID }}
-  INFISICAL_HOST: ${{ vars.INFISICAL_HOST }}
-  TF_VAR_infisical_client_id: ${{ secrets.INFISICAL_CLIENT_ID }}
-  TF_VAR_infisical_client_secret: ${{ secrets.INFISICAL_CLIENT_SECRET }}
-  TF_VAR_infisical_project_id: ${{ vars.INFISICAL_PROJECT_ID }}
-  TF_VAR_infisical_host: ${{ vars.INFISICAL_HOST }}
-  TF_IN_AUTOMATION: "true"
-
-jobs:
-  apply-staging:
-    name: apply (staging)
-    runs-on: ubuntu-latest
-    environment: staging
-    steps:
-      - uses: actions/checkout@v4
-
-      - uses: hashicorp/setup-terraform@v3
-        with:
-          terraform_version: "~1.12"
-          terraform_wrapper: false
-
-      - name: Write backend config
-        run: |
-          cat > backend.hcl <<EOF
-          bucket = "${{ vars.TF_STATE_BUCKET }}"
-          region = "${{ vars.SCW_REGION }}"
-          endpoints = {
-            s3 = "https://s3.${{ vars.SCW_REGION }}.scw.cloud"
-          }
-          EOF
-
-      - name: Terraform init
-        run: terraform init -input=false -backend-config=backend.hcl
-
-      - name: Select workspace
-        run: terraform workspace select -or-create staging
-
-      - name: Terraform apply
-        run: terraform apply -input=false -auto-approve -var-file=staging.tfvars
-
-      - name: Sync DATABASE_URL to Infisical
-        run: ./.github/scripts/sync-database-url.sh staging
-
-  apply-prod:
-    name: apply (prod)
-    runs-on: ubuntu-latest
-    needs: apply-staging
-    # The "production" GitHub Environment carries a required-reviewer rule,
-    # so this job waits for manual approval.
-    environment: production
-    steps:
-      - uses: actions/checkout@v4
-
-      - uses: hashicorp/setup-terraform@v3
-        with:
-          terraform_version: "~1.12"
-          terraform_wrapper: false
-
-      - name: Write backend config
-        run: |
-          cat > backend.hcl <<EOF
-          bucket = "${{ vars.TF_STATE_BUCKET }}"
-          region = "${{ vars.SCW_REGION }}"
-          endpoints = {
-            s3 = "https://s3.${{ vars.SCW_REGION }}.scw.cloud"
-          }
-          EOF
-
-      - name: Terraform init
-        run: terraform init -input=false -backend-config=backend.hcl
-
-      - name: Select workspace
-        run: terraform workspace select -or-create prod
-
-      - name: Terraform apply
-        run: terraform apply -input=false -auto-approve -var-file=prod.tfvars
-
-      - name: Sync DATABASE_URL to Infisical
-        run: ./.github/scripts/sync-database-url.sh prod

package/templates/prod.tfvars

@@ -1,7 +0,0 @@
-# Non-sensitive production configuration. Safe to commit.
-project_name      = "__PROJECT_NAME__"
-region            = "__REGION__"
-environment       = "prod"
-enable_basic_auth = false
-min_scale         = __PROD_MIN_SCALE__
-max_scale         = __PROD_MAX_SCALE__

package/templates/staging.tfvars

@@ -1,7 +0,0 @@
-# Non-sensitive staging configuration. Safe to commit.
-project_name      = "__PROJECT_NAME__"
-region            = "__REGION__"
-environment       = "staging"
-enable_basic_auth = true
-min_scale         = __STAGING_MIN_SCALE__
-max_scale         = __STAGING_MAX_SCALE__