feat(infra): opt-in Cloudflare R2 remote-state backend

[agjs]

Context

Follow-up to #166. That PR hardened the VPS against deletion (OpenTofu prevent_destroy + Hetzner delete_protection/rebuild_protection). The remaining single point of failure was state itself: infra/bootstrap/ had no backend block, so OpenTofu kept a local terraform.tfstate on the operator's machine. Lose that file and you can no longer plan, reconcile, or safely destroy the stack — made worse now that the server is API-locked and must be reconciled against state to unlock.

Approach

infra/bootstrap/ is a template others clone, so remote state is opt-in and fully pre-wired — a default clone stays on local state and works unchanged; enabling R2 is a documented ~2-minute step. Backend: Cloudflare R2 (S3-compatible, no egress fees, an account already in use), with native lockfile locking (S3 conditional writes — no DynamoDB).

Changes

• main.tf — commented backend "s3" block pre-filled with the R2-specific flags (region = "auto", use_path_style, the skip_* preflight toggles, skip_s3_checksum) and use_lockfile = true. Deployment-specific values (bucket, key, endpoints.s3) come from backend.hcl via partial config.
• backend.hcl.example — template for the per-deployment values. Credentials stay in AWS_ACCESS_KEY_ID/AWS_SECRET_ACCESS_KEY env vars, never on disk.
• .gitignore — ignore backend.hcl, keep the example.
• README.md — "Remote state (optional)" section with the init -migrate-state steps.

Enabling (documented in README)

cp backend.hcl.example backend.hcl      # fill in bucket + account id
export AWS_ACCESS_KEY_ID=<r2 access key id>
export AWS_SECRET_ACCESS_KEY=<r2 secret access key>
# uncomment the backend "s3" block in main.tf, then:
tofu init -backend-config=backend.hcl -migrate-state

Hetzner Object Storage or AWS S3 work the same way — only endpoints.s3 (and the skip_*/use_path_style flags, for true AWS) differ.

Verification

On a freshly installed OpenTofu 1.12.0:

• ✅ tofu fmt -check -recursive — clean (and the commented block is fmt-stable when uncommented)
• ✅ tofu init -backend=false + tofu validate — valid
• ✅ s3 backend schema check — a scratch tofu init with the full backend block parsed every argument (use_lockfile, endpoints.s3, skip_s3_checksum, etc.) and only failed at the network layer against a deliberately-invalid endpoint — i.e. no "Unsupported argument".

Not exercised here (needs real R2 creds + bucket): an end-to-end init -migrate-state and a live lock acquire/release. Worth a one-time manual run when you create the bucket.

🤖 Generated with Claude Code