feat: disaster-recovery experimental feature

sunbeam-python/sunbeam/core/juju.py

@@ -857,6 +857,23 @@ def run_action(
             raise ActionFailedException(str(task))
         return task.results
 
+    def get_application_actions(self, application: str, model: str) -> list[str]:
+        """Return action names available for an application in a model."""
+        with self._model(model) as juju:
+            try:
+                actions = self.cli(
+                    "actions",
+                    application,
+                    include_controller=False,
+                    juju=juju,
+                )
+            except jubilant.CLIError as e:
+                raise JujuException(str(e)) from e
+
+        if not isinstance(actions, dict):
+            return []
+        return sorted(actions.keys())
+
     def add_secret(self, model: str, name: str, data: dict, info: str) -> str:
         """Add secret to the model.
 

sunbeam-python/sunbeam/features/disaster_recovery/__init__.py

@@ -0,0 +1,2 @@
+# SPDX-FileCopyrightText: 2026 - Canonical Ltd
+# SPDX-License-Identifier: Apache-2.0

sunbeam-python/sunbeam/features/disaster_recovery/etc/deploy-disaster-recovery/main.tf

@@ -0,0 +1,67 @@
+# SPDX-FileCopyrightText: 2026 - Canonical Ltd
+# SPDX-License-Identifier: Apache-2.0
+
+terraform {
+  required_providers {
+    juju = {
+      source  = "juju/juju"
+      version = "= 1.3.1"
+    }
+  }
+}
+
+provider "juju" {}
+
+data "juju_model" "openstack_model" {
+  uuid = var.openstack-model-uuid
+}
+
+resource "juju_application" "s3_integrator" {
+  for_each   = var.enable-disaster-recovery ? toset(var.s3-integrator-apps) : []
+  name       = each.value
+  model_uuid = data.juju_model.openstack_model.uuid
+
+  charm {
+    name     = "s3-integrator"
+    channel  = var.s3-integrator-channel
+    revision = var.s3-integrator-revision
+  }
+
+  config = contains(keys(var.s3-integrator-secret-data), each.value) ? merge(
+    lookup(var.s3-integrator-config, each.value, {}),
+    { credentials = juju_secret.s3_credentials[each.value].secret_uri }
+  ) : lookup(var.s3-integrator-config, each.value, {})
+}
+
+resource "juju_secret" "s3_credentials" {
+  for_each   = var.enable-disaster-recovery ? var.s3-integrator-secret-data : {}
+  model_uuid = data.juju_model.openstack_model.uuid
+  name       = "${each.key}-credentials"
+  value      = each.value
+}
+
+resource "juju_access_secret" "s3_credentials_access" {
+  for_each     = var.enable-disaster-recovery ? var.s3-integrator-secret-data : {}
+  model_uuid   = data.juju_model.openstack_model.uuid
+  secret_id    = juju_secret.s3_credentials[each.key].secret_id
+  applications = [each.key]
+
+  depends_on = [juju_application.s3_integrator]
+}
+
+resource "juju_integration" "s3_integrations" {
+  for_each   = var.enable-disaster-recovery ? var.s3-integrations : {}
+  model_uuid = data.juju_model.openstack_model.uuid
+
+  application {
+    name     = each.value.integrator_app
+    endpoint = "s3-credentials"
+  }
+
+  application {
+    name     = each.key
+    endpoint = each.value.target_endpoint
+  }
+
+  depends_on = [juju_access_secret.s3_credentials_access]
+}

sunbeam-python/sunbeam/features/disaster_recovery/etc/deploy-disaster-recovery/variables.tf

@@ -0,0 +1,52 @@
+# SPDX-FileCopyrightText: 2026 - Canonical Ltd
+# SPDX-License-Identifier: Apache-2.0
+
+variable "openstack-model-uuid" {
+  description = "UUID of the OpenStack Juju model"
+  type        = string
+}
+
+variable "enable-disaster-recovery" {
+  description = "Enable disaster recovery resources"
+  type        = bool
+  default     = false
+}
+
+variable "s3-integrator-channel" {
+  description = "Channel to use for deployment of s3-integrator charm"
+  type        = string
+  default     = "2/stable"
+}
+
+variable "s3-integrator-revision" {
+  description = "Charm revision for s3-integrator deployment"
+  type        = number
+  default     = null
+}
+
+variable "s3-integrator-config" {
+  description = "Operator config for s3-integrator deployment"
+  type        = map(map(string))
+  default     = {}
+}
+
+variable "s3-integrator-secret-data" {
+  description = "Per-app secret payload for s3-integrator credentials"
+  type        = map(map(string))
+  default     = {}
+}
+
+variable "s3-integrator-apps" {
+  description = "Per-application s3-integrator app names to deploy"
+  type        = list(string)
+  default     = []
+}
+
+variable "s3-integrations" {
+  description = "Map of target app -> per-app s3-integrator app for relation wiring"
+  type = map(object({
+    integrator_app = string
+    target_endpoint = string
+  }))
+  default     = {}
+}