What problem does it solve?
Terraform/OpenTofu workflows become risky and slow when provider versions, state backends, imports, and secret handling are inconsistent, leading to drift, broken plans, or accidental destroys.
Core Features & Use Cases
- Provider- and state-safe IaC patterns: Prefer OpenTofu (
tofu), pin provider majors, and use plan-before-apply so changes are predictable.
- Blast-radius-friendly structure: Use a dir-per-environment layout with separate state per logical unit rather than workspaces.
- Adopting and migrating real infrastructure: Import existing resources, handle refactors safely, and migrate Cloudflare provider v4→v5 with a careful state/plan workflow.
- Security by default: Keep secrets out of
.tf/.tfvars using SOPS + age and use native OpenTofu state encryption when applicable.
Quick Start
Ask the skill to generate an OpenTofu repo layout (dir-per-environment) with pinned provider versions, an appropriate backend configuration (R2/S3/local/native encryption), and an import workflow for adopting existing Cloudflare resources without drifting.