# 🤖 infra/ — the Eleven Cloud IaC skeleton

OpenTofu for the AWS side of the planet-scale plan (issue #550). This layer
manages the **static skeleton only** — buckets, IAM, and (later) VPC/NLB/ASG.
All intelligence lives in the `lchat` binary; the boundary test from the plan
holds for every change here: **if the IaC needs to know an instance hostname,
the design is wrong.**

## Environments

- `dev/` — the proof-of-concept environment in the dev account
  (`427880590669`, eu-west-1, AWS profile `eleven-dev`). Test data only:
  nothing in this account is production, and the production fleet stays on
  the router box until #550's build triggers fire.

## Running

```sh
cd infra/dev
AWS_PROFILE=eleven-dev tofu init
AWS_PROFILE=eleven-dev tofu plan
AWS_PROFILE=eleven-dev tofu apply
```

State lives in S3 (`eleven-tofu-state-427880590669`, versioned, private) with
native lockfile locking — no DynamoDB lock table needed. That bucket is the
one imperatively-created resource (chicken and egg); everything else is
declared here. Being hand-managed, its hardening is hand-applied too: full
Block Public Access, and a `DenyInsecureTransport` bucket policy (deny on
`aws:SecureTransport=false`, applied 2026-07-15) matching the TLS-only
policy every declared bucket carries — reapply both if the bucket is ever
recreated.

## What exists (dev)

- `eleven-dev-instances-…` — the instance-state bucket: Litestream replication
  targets, one prefix per instance. Versioning on, lifecycle keeps the last 5
  noncurrent versions, Block Public Access. Instance DBs are opaque ciphertext
  plus routing metadata the server already sees, so replicating them here is
  threat-model-free (the E2EE rule did the hard part).
- `eleven-dev-home-…` — the home vault bucket for the `s3Store` backend work
  (#550 Part 1): same posture.
- A scoped `litestream-canary` IAM user/policy confined to the canary's prefix
  — the shape per-instance credentials will take; the admin `dev-agent` and
  `dev-agent-james` users (one per operator; James's key is sealed in the
  secrets vault) are console-made and not managed here.