terraform

Apply plan-before-apply workflows to OpenTofu infrastructure changes.

1|Updated Mar 18, 2024
One-click install
npx skills add https://github.com/erfianugrah/dotfiles --skill terraform-erfianugrah
Or copy as Structured Prompt for Agent
Please help me install this Agent Skill.
Skill: terraform
Source: https://github.com/erfianugrah/dotfiles/tree/main/.pi/agent/skills/terraform
Command: npx skills add https://github.com/erfianugrah/dotfiles --skill terraform-erfianugrah

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Terraform/OpenTofu workflows become risky and slow when provider versions, state backends, imports, and secret handling are inconsistent, leading to drift, broken plans, or accidental destroys.

Core Features & Use Cases

  • Provider- and state-safe IaC patterns: Prefer OpenTofu (tofu), pin provider majors, and use plan-before-apply so changes are predictable.
  • Blast-radius-friendly structure: Use a dir-per-environment layout with separate state per logical unit rather than workspaces.
  • Adopting and migrating real infrastructure: Import existing resources, handle refactors safely, and migrate Cloudflare provider v4→v5 with a careful state/plan workflow.
  • Security by default: Keep secrets out of .tf/.tfvars using SOPS + age and use native OpenTofu state encryption when applicable.

Quick Start

Ask the skill to generate an OpenTofu repo layout (dir-per-environment) with pinned provider versions, an appropriate backend configuration (R2/S3/local/native encryption), and an import workflow for adopting existing Cloudflare resources without drifting.

Frequently Asked Questions about terraform

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I safely migrate Cloudflare provider v4 to v5 in OpenTofu without breaking state?

Migrate Cloudflare provider v4 to v5 in OpenTofu using a careful state and plan workflow, pinning provider majors and validating changes with plan-before-apply to prevent drift and broken plans.

What's the best way to structure OpenTofu configurations for multiple environments?

Structure OpenTofu configurations using a directory-per-environment layout with separate state per logical unit instead of workspaces, creating blast-radius-friendly boundaries that keep infrastructure changes predictable and isolated.

How do I import existing cloud resources into OpenTofu without causing configuration drift?

Import existing cloud resources into OpenTofu by generating an import workflow that adopts real infrastructure safely, requiring plan-before-apply guardrails to ensure configurations match actual cloud state.

How do I manage secrets in HCL files without exposing them in .tfvars?

Manage secrets in HCL files by using SOPS with age encryption to keep sensitive values out of .tf and .tfvars files, and apply native OpenTofu state encryption when applicable for security by default.

Can I use OpenTofu as a Terraform replacement for writing and refactoring HCL modules?

Use OpenTofu as a Terraform-compatible alternative for writing and refactoring HCL modules, configuring state backends like R2, S3, or local storage, and applying guardrailed workflows for safe infrastructure changes.

Why do my infrastructure plans break when provider versions are inconsistent across environments?

Infrastructure plans break due to inconsistent provider versions causing state drift, which you prevent by pinning provider majors and enforcing per-environment state isolation with predictable plan-before-apply workflows.