# 🤖 Production-facing resources in the AWS account: the fleet-backup bucket
# the router box replicates instance DBs into (all ciphertext — the E2EE rule
# is what makes off-box replication threat-model-free), plus account
# hardening (CloudTrail). Separate state from dev/ so a dev teardown can
# never touch prod backups.

terraform {
  required_version = ">= 1.10"

  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 6.0"
    }
    dnsimple = {
      source  = "dnsimple/dnsimple"
      version = "~> 1.0"
    }
  }

  backend "s3" {
    bucket       = "eleven-tofu-state-427880590669"
    key          = "prod/terraform.tfstate"
    region       = "eu-west-1"
    use_lockfile = true
  }
}

provider "aws" {
  region = "eu-west-1"

  default_tags {
    tags = {
      project = "eleven"
      env     = "prod"
      managed = "opentofu"
    }
  }
}

data "aws_caller_identity" "current" {}

locals {
  account_id = data.aws_caller_identity.current.account_id
}