Adds initial terraform bazel targets

WORKSPACE

@@ -65,3 +65,18 @@ file_init()
 load("@rules_file//rules:workspace.bzl", "file_repositories")
 
 file_repositories()
+
+# rules_terraform
+
+http_archive(
+    name = "tf_modules",
+    urls = ["https://github.com/theothertomelliott/bazel-terraform-rules/releases/download/0.1.5/bazel-terraform-rules-0.1.5.tar.gz"],
+    sha256 = "b5e4428bbed26e78fc60ff2b76fda910cb13ddb50900b3879dd0916f04dab107",
+)
+load("@tf_modules//toolchains/terraform:toolchain.bzl", "register_terraform_toolchain")
+
+load("@tf_modules//:deps.bzl", "bazel_terraform_rules_deps")
+bazel_terraform_rules_deps()
+
+# Register required Terraform versions
+register_terraform_toolchain("1.7.3", default=True)

terraform/talos/k8s/BUILD

@@ -0,0 +1,10 @@
+load("@tf_modules//:def.bzl", "terraform_module")
+
+terraform_module(
+    name = "k8s",
+    srcs = glob(["*.tf"]),
+    terraform_executable = "@terraform_toolchain-1.7.3//:terraform_executable",
+    module_deps = [
+        "//terraform/talos/nodes",
+    ],
+)

terraform/talos/nodes/BUILD

@@ -0,0 +1,20 @@
+load("@tf_modules//:def.bzl", "terraform_module")
+
+genrule(
+    name = "secrets_file",
+    outs = ["secrets.auto.tfvars"],
+    srcs = ["secrets.auto.tfvars.age"],
+    tools = [
+      "@age//:bin"
+    ],
+    cmd = """
+set -euo pipefail
+./$(location @age//:bin) -d -i $$AGE_IDENTITY_KEY $(location :secrets.auto.tfvars.age) > $@
+""",
+)
+
+terraform_module(
+    name = "nodes",
+    srcs = [":secrets_file"] + glob(["*.tf"]),
+    terraform_executable = "@terraform_toolchain-1.7.3//:terraform_executable",
+)