# OpenTofu state encryption — opt-in.
#
# Encrypts `terraform.tfstate` and any saved plan files at rest using
# AES-GCM with a key derived from `var.tfstate_passphrase` via PBKDF2.
#
# To enable:
#   1. cp encryption.tofu.example encryption.tofu     (in the working dir)
#   2. export TF_VAR_tfstate_passphrase='at-least-16-characters'
#   3. tofu init -reconfigure
#
# Notes:
#   - This file uses the `.tofu` extension so Terraform does NOT load it.
#     Only OpenTofu engages encryption. Terraform users skip this block.
#   - GKE state contains the cluster CA bundle and project number — keep
#     it encrypted for anything beyond throwaway staging.

terraform {
  encryption {
    key_provider "pbkdf2" "default" {
      passphrase = var.tfstate_passphrase
    }

    method "aes_gcm" "default" {
      keys = key_provider.pbkdf2.default
    }

    state {
      method = method.aes_gcm.default
    }

    plan {
      method = method.aes_gcm.default
    }
  }
}