# 🤖 The dev mesh — the AWS (Dublin, ie) half of the two-node staging fleet
# (docs/dev-mesh.md). Its own state key so it tears down independently of the
# #550 activator-proof box in infra/dev. The Helsinki (fi) node is Hetzner,
# hand-provisioned (like prod's Hetzner boxes) — only its scoped S3 credential
# lives here.
#
# Boundary rule (infra/README.md) still holds: this manages the static
# skeleton — box, bucket, IAM, DNS wildcards — never an instance hostname.

terraform {
  required_version = ">= 1.10"

  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 6.0"
    }
    dnsimple = {
      source  = "dnsimple/dnsimple"
      version = "~> 1.0"
    }
  }

  backend "s3" {
    bucket       = "eleven-tofu-state-427880590669"
    key          = "dev-mesh/terraform.tfstate"
    region       = "eu-west-1"
    use_lockfile = true
  }
}

provider "aws" {
  region = "eu-west-1"

  default_tags {
    tags = {
      project = "eleven"
      env     = "dev-mesh"
      managed = "opentofu"
    }
  }
}

# 11ch.at lives in the Eleven DNSimple account (176940), not Paul's personal
# one — DNSIMPLE_TOKEN + DNSIMPLE_ACCOUNT come from the operator's dev agent
# item in Bitwarden at run time (`ops dev` pulls them itself), never committed.
provider "dnsimple" {}

data "aws_caller_identity" "current" {}

locals {
  account_id = data.aws_caller_identity.current.account_id
}