fixes

.gitignore

@@ -12,6 +12,8 @@ ansible/inventory/hosts.yml
 ansible/group_vars/**/vault.yml
 wireguard/wg0.conf
 wireguard/peers/
+.aws/
+.env
 
 # OpenTofu / Terraform
 .terraform/
@@ -24,6 +26,7 @@ crash.log
 crash.*.log
 override.tf
 override.tf.json
+backend.hcl
 *_override.tf
 *_override.tf.json
 

tofu/backend.hcl.example

@@ -1,12 +0,0 @@
-# Initialize OpenTofu state in Cloudflare R2:
-#
-#   export AWS_ACCESS_KEY_ID=<R2_ACCESS_KEY>
-#   export AWS_SECRET_ACCESS_KEY=<R2_SECRET_KEY>
-#   tofu init -backend-config=backend.hcl
-#
-# Replace <ACCOUNT_ID> with your Cloudflare account ID.
-# Create the R2 bucket "watchtower-tofu-state" in Cloudflare dashboard first.
-
-endpoints = {
-  s3 = "https://<ACCOUNT_ID>.r2.cloudflarestorage.com"
-}

tofu/server.tf

@@ -31,17 +31,17 @@ resource "hcloud_firewall" "watchtower" {
 }
 
 resource "hcloud_primary_ip" "ipv4" {
-  name        = "${var.server_name}-ipv4"
-  type        = "ipv4"
-  datacenter  = "${var.location}-dc3"
-  auto_delete = false
+  name            = "${var.server_name}-ipv4"
+  type            = "ipv4"
+  assignee_type   = "server"
+  auto_delete     = false
 }
 
 resource "hcloud_primary_ip" "ipv6" {
-  name        = "${var.server_name}-ipv6"
-  type        = "ipv6"
-  datacenter  = "${var.location}-dc3"
-  auto_delete = false
+  name            = "${var.server_name}-ipv6"
+  type            = "ipv6"
+  assignee_type   = "server"
+  auto_delete     = false
 }
 
 resource "hcloud_server" "watchtower" {

tofu/versions.tf

@@ -27,7 +27,7 @@ terraform {
   # use_lockfile = true requires OpenTofu >= 1.10 and provides native S3-based
   # state locking via conditional PutObject (no DynamoDB needed; R2-compatible).
   backend "s3" {
-    bucket = "watchtower-tofu-state"
+    bucket = "watchtower-observability-opentofu-state"
     key    = "watchtower/terraform.tfstate"
     region = "auto"