Skip to main content
Keep one desired-state object, reject stale edits, and let the IaC platform own state and locking.
deployment.json is the input to tofu-proxmox. It is not state and it is not an Ansible inventory. A versioned object in the homelab S3-compatible store is authoritative; local files are temporary.

​
Stores and ownership

​
ACID guarantees

​
Rules

  • Never commit the live object or create terraform.tfvars beside it.
  • Never fall back to {} when the object cannot be read.
  • Compare the object version when writing so concurrent edits fail cleanly.
  • Run tofu state list before adopting an existing resource; its key must match the desired-state key.
  • Never use a targeted apply. It can publish inventory that describes only a subset of the estate.
  • Provider and object-store credentials come from OpenBao through native, short-lived Terrakube paths. They are not workspace secret variables.
Independent Terrakube workspaces have independent locks. Cross-workspace production changes use an explicit reviewed sequence, not a universal mutex.