Terraform

This repository is the source of truth for all jae-labs infrastructure as code. It manages GitHub organization config, Cloudflare DNS and Pages, Doppler secrets infrastructure, Honeycomb datasets, Grafana monitoring, OCI infrastructure, Sentry organization/project config, and Tailscale preferences/ACLs. Changes are split by provider root, validated in CI, and auto-applied on merge to main.

GitHub	Cloudflare	Doppler
OCI	Sentry	Tailscale
Grafana	Honeycomb	Supabase

What this repo manages

Path	Purpose
github/	Org settings, members, teams, repositories, environments, branch protection
cloudflare/	Zones, DNS records, account members, Workers KV, Pages projects/domains
doppler/	Projects, environments, groups, access grants
oci/	OCI resource-shaped config: VCNs, subnets, security lists, NSGs, instances, object storage
sentry/	Sentry organization, teams, projects, client keys
tailscale/	Tailscale MagicDNS, nameservers, search paths, global preferences, and ACL policies
grafana/	Grafana Git Sync configurations, SLOs, and Synthetic Monitoring checks
honeycomb/	Honeycomb datasets, derived columns, queries, annotations, and boards

How it works

• Each provider root has isolated remote state in a PostgreSQL database (hosted on Supabase) with its own backend schema.
• All domains (github/, cloudflare/, doppler/, grafana/, honeycomb/, oci/, sentry/, and tailscale/) are flat and self-contained Terraform roots.
• GitHub Actions runs format, lint, and validation checks on pull requests.
• Merges to main trigger path-filtered applies for only the affected provider root.

Architecture, state layout, and repo structure live in docs/architecture.md. Provider-root conventions live in docs/providers.md.

Quick Start

Prerequisites

• mise for managing tool versions (terraform, tflint, lefthook, ratchet)
• Doppler CLI for secrets injection
• PG_CONN_STR pointing to the Terraform PostgreSQL backend (hosted on Supabase)
• Provider credentials (injected via Doppler for local development):
  • GitHub: GITHUB_TOKEN
  • Cloudflare: CLOUDFLARE_API_TOKEN
  • Doppler: DOPPLER_TOKEN
  • OCI: OCI_TENANCY_OCID, OCI_USER_OCID, OCI_FINGERPRINT, OCI_REGION, OCI_PRIVATE_KEY_PATH
  • Sentry: SENTRY_AUTH_TOKEN
  • Tailscale: TAILSCALE_API_KEY
  • Grafana: GRAFANA_AUTH, GRAFANA_SM_ACCESS_TOKEN, GRAFANA_SM_URL, GRAFANA_K6_ACCESS_TOKEN
  • Honeycomb: HONEYCOMB_API_KEY
• OCI stack inputs: TF_VAR_compartment_id, TF_VAR_availability_domain, TF_VAR_ssh_authorized_keys, TF_VAR_ssh_ingress_cidr

Install local Git hooks:

lefthook install

Run any provider root locally:

cd github
doppler run -- terraform init
doppler run -- terraform plan
doppler run -- terraform apply

Swap github for cloudflare, doppler, grafana, honeycomb, oci, tailscale, or sentry as needed.

Validation

terraform fmt -check -recursive .
tflint --recursive --config=.tflint.hcl
for root in github cloudflare doppler honeycomb oci tailscale sentry grafana; do
  (
    cd "${root}" && \
    terraform init -backend=false && \
    terraform validate
  )
done

Documentation

Document	Description
docs/architecture.md	Repository layout, state model, apply flow
docs/providers.md	Generic provider-root model, locals.tf
docs/ci-cd.md	GitHub Actions workflows and secrets

Contributing

See CONTRIBUTING.md.

Agent Notes

See AGENTS.md.

License

See LICENSE.

Stars

Star History