# OpenTofu state encryption — opt-in.
#
# Encrypts both `terraform.tfstate` and any saved plan files at rest using
# AES-GCM with a key derived from `var.tfstate_passphrase` via PBKDF2.
#
# To enable:
#   1. cp encryption.tofu.example encryption.tofu     (in the working dir)
#   2. export TF_VAR_tfstate_passphrase='at-least-16-characters'
#   3. tofu init -reconfigure
#
# Notes:
#   - This file uses the `.tofu` extension so Terraform does NOT load it.
#     Only OpenTofu engages encryption. Terraform users skip this block.
#   - If you lose the passphrase, the state is unrecoverable — keep it in
#     a password manager / Secrets Manager / etc.
#   - To rotate the passphrase: add a second `key_provider` block with
#     the old passphrase, set it as `fallback`, then `tofu apply` to
#     re-encrypt with the new key. Drop the fallback once migrated.

terraform {
  encryption {
    key_provider "pbkdf2" "default" {
      passphrase = var.tfstate_passphrase
    }

    method "aes_gcm" "default" {
      keys = key_provider.pbkdf2.default
    }

    state {
      method = method.aes_gcm.default
    }

    plan {
      method = method.aes_gcm.default
    }
  }
}