OpenTofu check placement

Keep fast, credential-free checks close to the edit. Keep live infrastructure access inside the homelab control plane.

​

Placement matrix

​

Rules

• Hooks and CI validation must work without OpenBao, AWS, Proxmox, UniFi, or a keychain.
• Use tofu init -backend=false for validation.
• Do not hide required static checks behind a manual stage.
• Do not use continue-on-error on format, validation, or tests.
• Never upload a binary plan or tofu show -json artifact to public CI.
• Never enable debug or trace logging around live credentials.
• Terrakube obtains workspace credentials from OpenBao through native dynamic credentials or ephemeral resources. Do not copy secrets into CI or workspace variables.

​

Why plans stay out of public CI

​

Anti-patterns

# Wrong: a live plan in a public workflow
- run: tofu plan -no-color

# Wrong: a credential-requiring hook
- id: tofu-plan
  entry: tofu plan

# Wrong: hiding a required static check
- id: tofu-test
  stages: [manual]

​

Related pages

• IaC tooling
• CI/CD
• Golden laws