You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: src/content/docs/terraform/tutorial/track-history.mdx
+74-99Lines changed: 74 additions & 99 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -10,131 +10,106 @@ head:
10
10
11
11
import { Render } from"~/components";
12
12
13
-
In the [Initialize Terraform](/terraform/tutorial/initialize-terraform/) tutorial, you created and applied some basic Cloudflare configuration. Terraform applied this configuration to your zone because you provided your API token at the top of the `cloudflare.tf` file that has access to this zone.
14
-
15
-
```sh
16
-
head -n13 cloudflare.tf | tail -n3
17
-
provider "cloudflare" {
18
-
api_token = "your-api-token"
19
-
}
20
-
```
21
-
22
-
In this tutorial, you will store your configuration in GitHub where it can be tracked, peer-reviewed, and rolled back to as needed. First, you will remove your credentials from the Terraform config file to prevent committing them to a repository.
In the [Initialize Terraform](/terraform/tutorial/initialize-terraform/) tutorial, you created and applied basic Cloudflare configuration. Now you'll store this configuration in version control for tracking, peer review, and rollback capabilities.
25
14
26
15
## 1. Use environment variables for authentication
27
16
28
-
As a good security practice, remove your Cloudflare credentials from anything that will be committed to a repository. The Cloudflare Terraform provider supports reading the credentials (and other configuration) [from environment variables](https://registry.terraform.io/providers/cloudflare/cloudflare/latest/docs#schema), as in the following example:
29
-
30
-
```bash
31
-
sed -ie 's/^.*api_token =.*$/ # token pulled from $CLOUDFLARE_API_TOKEN/' cloudflare.tf
17
+
Remove credentials from your Terraform files before committing to version control. The Cloudflare provider v5 reads authentication from environment variables automatically.
18
+
Update your `main.tf` file to remove the hardcoded API token:
19
+
20
+
```hcl
21
+
terraform {
22
+
required_providers {
23
+
cloudflare = {
24
+
source = "cloudflare/cloudflare"
25
+
version = "~> 5"
26
+
}
27
+
}
28
+
}
32
29
33
-
head -n13 cloudflare.tf | tail -n3
34
30
provider "cloudflare" {
35
-
# token pulled from $CLOUDFLARE_API_TOKEN
31
+
# API token will be read from CLOUDFLARE_API_TOKEN environment variable
36
32
}
37
33
38
-
export CLOUDFLARE_API_TOKEN=your-api-token
39
-
```
34
+
variable "zone_id" {
35
+
description = "Cloudflare Zone ID"
36
+
type = string
37
+
sensitive = true
38
+
}
40
39
41
-
You must still include the empty provider definition in the file, so that Terraform knows to install the Cloudflare plugin. For more information about advanced options you can use to customize the Cloudflare provider, refer to [Provider customization](/terraform/advanced-topics/provider-customization/).
40
+
variable "account_id" {
41
+
description = "Cloudflare Account ID"
42
+
type = string
43
+
sensitive = true
44
+
}
42
45
43
-
After running the commands above, ensure that you can still authenticate to Cloudflare by running `terraform plan`. Terraform will pull the current state which requires a valid email and API token.
46
+
variable "domain" {
47
+
description = "Domain name"
48
+
type = string
49
+
default = "example.com"
50
+
}
44
51
45
-
```sh
46
-
terraform plan
52
+
resource "cloudflare_dns_record" "www" {
53
+
zone_id = var.zone_id
54
+
name = "www"
55
+
content = "203.0.113.10"
56
+
type = "A"
57
+
ttl = 1
58
+
proxied = true
59
+
comment = "Domain verification record"
60
+
}
47
61
```
62
+
:::note
63
+
You must still include the empty provider definition in the file, so that Terraform knows to install the Cloudflare plugin. For more information about advanced options you can use to customize the Cloudflare provider, refer to [Provider customization](/terraform/advanced-topics/provider-customization/).
Next, initialize a Git repository and make the first commit.
79
-
80
-
:::note[Note]
81
-
82
-
You might need to [add your SSH key to your GitHub account](https://docs.github.com/en/authentication/connecting-to-github-with-ssh/adding-a-new-ssh-key-to-your-github-account).
83
-
84
-
:::
78
+
Verify authentication works:
85
79
86
80
```sh
87
-
git init
81
+
terraform plan
88
82
```
89
-
83
+
You may see changes detected as Terraform compares your new variable-based configuration with the existing resources. This is normal when migrating from hardcoded values to variables:
90
84
```sh output
91
-
Initialized empty Git repository in /Users/username/cf-config/.git/
Notice that the `.terraform` directory and `terraform.tfstate` file were not committed. The `.terraform` directory was not committed because the repository may be used on a different architecture, and the plugins contained in the directory are built for the system on which `terraform init` was run. The `terraform.tfstate` file was not committed because it may eventually contain sensitive strings, and it is not a good way to keep state in sync, as explained in HashiCorp's documentation on [Remote State](https://developer.hashicorp.com/terraform/language/state/remote).
108
-
109
-
To prevent Git from notifying you about the two files, add them to a new `.gitignore` file, commit it, and push everything to GitHub.
110
-
111
-
```bash
112
-
cat > .gitignore <<'EOF'
95
+
## 2. Store configuration in GitHub
96
+
Create a `.gitignore` file with these contents:
97
+
```text
113
98
.terraform/
114
-
terraform.tfstate*
115
-
EOF
116
-
117
-
git add .gitignore
118
-
119
-
git commit -m "Step 2 - Ignore terraform plugin directory and state file."
120
-
```
121
-
122
-
```sh output
123
-
[master 494c6d6] Step 2 - Ignore terraform plugin directory and state file.
Your Terraform configuration is now version controlled and ready for team collaboration. The sensitive data (API tokens, zone IDs) remains secure and separate from your code.
0 commit comments