diff --git a/.github/workflows/terraform-apply-production.yml b/.github/workflows/terraform-apply-production.yml
new file mode 100644
index 0000000..415670e
--- /dev/null
+++ b/.github/workflows/terraform-apply-production.yml
@@ -0,0 +1,152 @@
+---
+# infra — gated Terraform apply for the PRODUCTION Cloudflare workspace.
+#
+# APPROVAL MODEL: workflow_dispatch + GitHub Environment "production"
+# with required reviewers. No push trigger. No "promote from staging"
+# trigger. Every production apply is a separate, deliberate decision
+# made by a human reviewer on a human-triggered run.
+#
+# Confirm phrase is stricter than staging — operator must type a
+# matching staging RUN_ID so they cannot apply prod without having
+# first applied + observed the same change in staging.
+#
+# Security note: every GHA expression consumed in a run: block is
+# wrapped through env: to prevent script injection.
+
+name: terraform-apply-production
+
+on:
+ workflow_dispatch:
+ inputs:
+ confirm:
+ description: 'Type APPLY-PRODUCTION to confirm'
+ required: true
+ type: string
+ staging_run_id:
+ description: 'GH Actions run_id of the matching staging apply (must be a numeric id)'
+ required: true
+ type: string
+
+permissions:
+ contents: read
+
+concurrency:
+ group: terraform-apply-production
+ cancel-in-progress: false # never cancel an in-flight apply
+
+env:
+ TF_VERSION: '1.9.8'
+ TF_IN_AUTOMATION: 'true'
+ TF_ENV: 'production'
+ CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
+ AWS_ACCESS_KEY_ID: ${{ secrets.TF_STATE_R2_ACCESS_KEY_ID }}
+ AWS_SECRET_ACCESS_KEY: ${{ secrets.TF_STATE_R2_SECRET_ACCESS_KEY }}
+ AWS_REGION: 'auto'
+ CF_ACCOUNT_ID: ${{ secrets.CF_ACCOUNT_ID }}
+
+jobs:
+ guard:
+ name: confirm-input + staging-precedent guard
+ runs-on: ubuntu-latest
+ env:
+ CONFIRM_INPUT: ${{ inputs.confirm }}
+ STAGING_RUN_ID: ${{ inputs.staging_run_id }}
+ steps:
+ - name: Reject if confirm phrase wrong
+ run: |
+ if [ "${CONFIRM_INPUT}" != "APPLY-PRODUCTION" ]; then
+ echo "::error::confirm input must be exactly 'APPLY-PRODUCTION'"
+ exit 1
+ fi
+
+ - name: Reject if staging_run_id is not numeric
+ run: |
+ # ref-injection mitigation: validate strictly before any use.
+ case "${STAGING_RUN_ID}" in
+ ''|*[!0-9]*)
+ echo "::error::staging_run_id must be a numeric GH Actions run id (got '${STAGING_RUN_ID}')"
+ exit 1
+ ;;
+ esac
+
+ - name: Verify staging run exists + succeeded
+ env:
+ GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+ # STAGING_RUN_ID already validated as numeric above; safe to use.
+ run: |
+ conclusion=$(gh run view "${STAGING_RUN_ID}" --repo "${GITHUB_REPOSITORY}" --json conclusion --jq '.conclusion')
+ name=$(gh run view "${STAGING_RUN_ID}" --repo "${GITHUB_REPOSITORY}" --json name --jq '.name')
+ if [ "${name}" != "terraform-apply-staging" ]; then
+ echo "::error::staging_run_id ${STAGING_RUN_ID} is not a terraform-apply-staging run (got: ${name})"
+ exit 1
+ fi
+ if [ "${conclusion}" != "success" ]; then
+ echo "::error::staging_run_id ${STAGING_RUN_ID} did not succeed (conclusion: ${conclusion})"
+ exit 1
+ fi
+ echo "staging precedent ✓ (run ${STAGING_RUN_ID} = success)"
+
+ apply:
+ name: apply production
+ needs: guard
+ runs-on: ubuntu-latest
+ # GitHub Environment "production" must be configured with Required
+ # Reviewers — operator sets this up at repo Settings → Environments →
+ # production → Deployment protection rules. This is the second gate
+ # on top of the confirm input + staging-precedent checks above.
+ environment: production
+ defaults:
+ run:
+ working-directory: terraform/cloudflare
+ steps:
+ - uses: actions/checkout@v6
+
+ - uses: hashicorp/setup-terraform@v3
+ with:
+ terraform_version: ${{ env.TF_VERSION }}
+
+ - name: Verify operator secrets are set
+ run: |
+ missing=""
+ [ -z "${CLOUDFLARE_API_TOKEN}" ] && missing="${missing} CLOUDFLARE_API_TOKEN"
+ [ -z "${AWS_ACCESS_KEY_ID}" ] && missing="${missing} TF_STATE_R2_ACCESS_KEY_ID"
+ [ -z "${AWS_SECRET_ACCESS_KEY}" ] && missing="${missing} TF_STATE_R2_SECRET_ACCESS_KEY"
+ [ -z "${CF_ACCOUNT_ID}" ] && missing="${missing} CF_ACCOUNT_ID"
+ if [ -n "${missing}" ]; then
+ echo "::error::Operator action required — these repo secrets are not set:${missing}"
+ echo "::error::See https://github.com/InstaNode-dev/infra/blob/master/terraform/cloudflare/README.md#bootstrap-one-time"
+ exit 1
+ fi
+
+ - name: terraform init
+ run: |
+ terraform init \
+ -backend-config="endpoints={s3=\"https://${CF_ACCOUNT_ID}.r2.cloudflarestorage.com\"}" \
+ -backend-config="workspace_key_prefix=${TF_ENV}"
+
+ - name: terraform workspace select
+ run: terraform workspace select "${TF_ENV}"
+
+ - name: terraform plan
+ run: |
+ terraform plan \
+ -var-file="${TF_ENV}.auto.tfvars" \
+ -no-color \
+ -out=tfplan.bin
+
+ - name: terraform apply
+ run: terraform apply -no-color tfplan.bin
+
+ - name: Surface non-sensitive outputs (ids only, NO token values)
+ run: |
+ terraform output -no-color account_id || true
+ terraform output -no-color zone_id || true
+ terraform output -no-color deploy_token_id || true
+ terraform output -no-color admin_tunnel_token_id || true
+
+ - name: Reminder
+ run: |
+ echo "::notice::PRODUCTION APPLY COMPLETE."
+ echo "::notice::If tokens were created or rotated, run on an operator workstation:"
+ echo "::notice:: make install-secrets ENV=production"
+ echo "::notice::Confirm the CF dashboard audit log shows the change before revoking the prior token."
diff --git a/.github/workflows/terraform-apply-staging.yml b/.github/workflows/terraform-apply-staging.yml
new file mode 100644
index 0000000..2e8ef76
--- /dev/null
+++ b/.github/workflows/terraform-apply-staging.yml
@@ -0,0 +1,116 @@
+---
+# infra — gated Terraform apply for the STAGING Cloudflare workspace.
+#
+# APPROVAL MODEL: workflow_dispatch ONLY. Never on push, never on merge,
+# never auto-promoted from a previous apply. Operator deliberately
+# triggers this from the Actions tab.
+#
+# Why split per env: staging and production must not share an apply
+# trigger. Splitting prevents a "promote-on-success" pipeline from
+# ever existing for production — every prod apply is a separate human
+# decision (see terraform-apply-production.yml).
+#
+# Security note: every GHA expression consumed in a run: block is
+# wrapped through env: to prevent script injection.
+
+name: terraform-apply-staging
+
+on:
+ workflow_dispatch:
+ inputs:
+ confirm:
+ description: 'Type APPLY-STAGING to confirm'
+ required: true
+ type: string
+
+permissions:
+ contents: read
+
+concurrency:
+ group: terraform-apply-staging
+ cancel-in-progress: false # never cancel an in-flight apply
+
+env:
+ TF_VERSION: '1.9.8'
+ TF_IN_AUTOMATION: 'true'
+ TF_ENV: 'staging'
+ CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
+ AWS_ACCESS_KEY_ID: ${{ secrets.TF_STATE_R2_ACCESS_KEY_ID }}
+ AWS_SECRET_ACCESS_KEY: ${{ secrets.TF_STATE_R2_SECRET_ACCESS_KEY }}
+ AWS_REGION: 'auto'
+ CF_ACCOUNT_ID: ${{ secrets.CF_ACCOUNT_ID }}
+
+jobs:
+ guard:
+ name: confirm-input guard
+ runs-on: ubuntu-latest
+ env:
+ CONFIRM_INPUT: ${{ inputs.confirm }}
+ steps:
+ - name: Reject if confirm phrase wrong
+ run: |
+ if [ "${CONFIRM_INPUT}" != "APPLY-STAGING" ]; then
+ echo "::error::confirm input must be exactly 'APPLY-STAGING'"
+ exit 1
+ fi
+
+ apply:
+ name: apply staging
+ needs: guard
+ runs-on: ubuntu-latest
+ environment: staging
+ defaults:
+ run:
+ working-directory: terraform/cloudflare
+ steps:
+ - uses: actions/checkout@v6
+
+ - uses: hashicorp/setup-terraform@v3
+ with:
+ terraform_version: ${{ env.TF_VERSION }}
+
+ - name: Verify operator secrets are set
+ run: |
+ missing=""
+ [ -z "${CLOUDFLARE_API_TOKEN}" ] && missing="${missing} CLOUDFLARE_API_TOKEN"
+ [ -z "${AWS_ACCESS_KEY_ID}" ] && missing="${missing} TF_STATE_R2_ACCESS_KEY_ID"
+ [ -z "${AWS_SECRET_ACCESS_KEY}" ] && missing="${missing} TF_STATE_R2_SECRET_ACCESS_KEY"
+ [ -z "${CF_ACCOUNT_ID}" ] && missing="${missing} CF_ACCOUNT_ID"
+ if [ -n "${missing}" ]; then
+ echo "::error::Operator action required — these repo secrets are not set:${missing}"
+ echo "::error::See https://github.com/InstaNode-dev/infra/blob/master/terraform/cloudflare/README.md#bootstrap-one-time"
+ exit 1
+ fi
+
+ - name: terraform init
+ run: |
+ terraform init \
+ -backend-config="endpoints={s3=\"https://${CF_ACCOUNT_ID}.r2.cloudflarestorage.com\"}" \
+ -backend-config="workspace_key_prefix=${TF_ENV}"
+
+ - name: terraform workspace select
+ run: terraform workspace select "${TF_ENV}"
+
+ - name: terraform plan
+ run: |
+ terraform plan \
+ -var-file="${TF_ENV}.auto.tfvars" \
+ -no-color \
+ -out=tfplan.bin
+
+ - name: terraform apply
+ run: terraform apply -no-color tfplan.bin
+
+ - name: Surface non-sensitive outputs (ids only, NO token values)
+ run: |
+ terraform output -no-color account_id || true
+ terraform output -no-color zone_id || true
+ terraform output -no-color deploy_token_id || true
+ terraform output -no-color admin_tunnel_token_id || true
+
+ - name: Reminder
+ run: |
+ echo "::notice::STAGING APPLY COMPLETE."
+ echo "::notice::If tokens were created or rotated, run on an operator workstation:"
+ echo "::notice:: make install-secrets ENV=staging"
+ echo "::notice::Promoting to production is a SEPARATE manual decision via terraform-apply-production.yml."
diff --git a/.github/workflows/terraform.yml b/.github/workflows/terraform.yml
new file mode 100644
index 0000000..fe9cc2c
--- /dev/null
+++ b/.github/workflows/terraform.yml
@@ -0,0 +1,170 @@
+---
+# infra — Terraform fmt + validate + plan for CF resources.
+#
+# Runs on every push to master and on PRs touching terraform/**.
+# Plan is read-only. Apply is split into per-env manual workflows
+# (terraform-apply-staging.yml, terraform-apply-production.yml).
+# This file NEVER applies — see those workflows for the apply path.
+#
+# Posts the plan diff as a PR comment so reviewers see what apply
+# would do without granting CI apply rights.
+#
+# Security note: all GHA expressions consumed in run: blocks are
+# referenced through env vars to prevent script injection.
+
+name: terraform
+
+on:
+ push:
+ branches: [master]
+ paths:
+ - 'terraform/**'
+ - '.github/workflows/terraform*.yml'
+ pull_request:
+ paths:
+ - 'terraform/**'
+ - '.github/workflows/terraform*.yml'
+ workflow_dispatch:
+
+permissions:
+ contents: read
+ pull-requests: write # for the plan comment
+
+concurrency:
+ group: terraform-plan-${{ github.ref }}
+ cancel-in-progress: true
+
+env:
+ TF_VERSION: '1.9.8'
+ TF_IN_AUTOMATION: 'true'
+
+jobs:
+ fmt-validate:
+ name: fmt + validate
+ runs-on: ubuntu-latest
+ defaults:
+ run:
+ working-directory: terraform/cloudflare
+ steps:
+ - uses: actions/checkout@v6
+
+ - uses: hashicorp/setup-terraform@v3
+ with:
+ terraform_version: ${{ env.TF_VERSION }}
+
+ - name: terraform fmt -check
+ run: terraform fmt -check -recursive
+
+ - name: terraform init (backend-bypassed)
+ run: terraform init -backend=false
+
+ - name: terraform validate
+ run: terraform validate -no-color
+
+ plan:
+ name: plan (${{ matrix.env }})
+ needs: fmt-validate
+ runs-on: ubuntu-latest
+ strategy:
+ fail-fast: false
+ matrix:
+ env: [staging, production]
+ defaults:
+ run:
+ working-directory: terraform/cloudflare
+ # CF creds + state-backend creds passed in via env, not inlined in run:.
+ env:
+ CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
+ AWS_ACCESS_KEY_ID: ${{ secrets.TF_STATE_R2_ACCESS_KEY_ID }}
+ AWS_SECRET_ACCESS_KEY: ${{ secrets.TF_STATE_R2_SECRET_ACCESS_KEY }}
+ AWS_REGION: 'auto'
+ CF_ACCOUNT_ID: ${{ secrets.CF_ACCOUNT_ID }}
+ TF_ENV: ${{ matrix.env }}
+ steps:
+ - uses: actions/checkout@v6
+
+ - uses: hashicorp/setup-terraform@v3
+ with:
+ terraform_version: ${{ env.TF_VERSION }}
+
+ - name: Verify operator secrets are set
+ # Bootstrap chicken-and-egg: plan needs CF + R2-HMAC creds, but
+ # those are operator-only one-time setup (see README §Bootstrap).
+ # Without this guard the failure mode is a cryptic AWS-IAM stack
+ # trace from `terraform init`. With it, the error is one line
+ # pointing at the README and the exact missing variable names.
+ run: |
+ missing=""
+ [ -z "${CLOUDFLARE_API_TOKEN}" ] && missing="${missing} CLOUDFLARE_API_TOKEN"
+ [ -z "${AWS_ACCESS_KEY_ID}" ] && missing="${missing} TF_STATE_R2_ACCESS_KEY_ID"
+ [ -z "${AWS_SECRET_ACCESS_KEY}" ] && missing="${missing} TF_STATE_R2_SECRET_ACCESS_KEY"
+ [ -z "${CF_ACCOUNT_ID}" ] && missing="${missing} CF_ACCOUNT_ID"
+ if [ -n "${missing}" ]; then
+ echo "::error::Operator action required — these repo secrets are not set:${missing}"
+ echo "::error::See https://github.com/InstaNode-dev/infra/blob/master/terraform/cloudflare/README.md#bootstrap-one-time"
+ exit 1
+ fi
+ echo "all 4 operator secrets present"
+
+ - name: terraform init
+ run: |
+ terraform init \
+ -backend-config="endpoints={s3=\"https://${CF_ACCOUNT_ID}.r2.cloudflarestorage.com\"}" \
+ -backend-config="workspace_key_prefix=${TF_ENV}"
+
+ - name: terraform workspace select-or-create
+ run: terraform workspace select "${TF_ENV}" 2>/dev/null || terraform workspace new "${TF_ENV}"
+
+ - name: terraform plan
+ id: plan
+ run: |
+ set +e
+ terraform plan \
+ -var-file="${TF_ENV}.auto.tfvars" \
+ -no-color \
+ -out=tfplan.bin \
+ -detailed-exitcode 2>&1 | tee /tmp/plan.out
+ ec=${PIPESTATUS[0]}
+ echo "exitcode=${ec}" >> "$GITHUB_OUTPUT"
+ # 0 = no changes, 2 = changes, 1 = error
+ [ "${ec}" -eq 1 ] && exit 1 || exit 0
+
+ - name: Comment plan on PR
+ if: github.event_name == 'pull_request'
+ uses: actions/github-script@v7
+ env:
+ PLAN_ENV: ${{ matrix.env }}
+ PLAN_CODE: ${{ steps.plan.outputs.exitcode }}
+ RUN_ID: ${{ github.run_id }}
+ with:
+ script: |
+ const fs = require('fs');
+ let plan = fs.readFileSync('/tmp/plan.out', 'utf8');
+ if (plan.length > 60000) {
+ plan = plan.slice(0, 60000) + '\n\n... (truncated; full plan in job log)';
+ }
+ const env = process.env.PLAN_ENV;
+ const code = process.env.PLAN_CODE;
+ const verdict = code === '0' ? '✅ no changes'
+ : code === '2' ? '🟡 changes present — review before manual apply'
+ : '❌ plan failed';
+ const body = [
+ `### Terraform plan — \`${env}\``,
+ verdict,
+ '',
+ 'plan output
',
+ '',
+ '```hcl',
+ plan,
+ '```',
+ '',
+ '