Terraform Infra

The terraform/digital\_ocean/} directory manages the external-facing web presence for bitsmasher.net.

Provisioned Resources

• <strong>Droplet:</strong> 512MB Debian 12 in lon1 region (www.bitsmasher.net)
• <strong>Domain:</strong> bitsmasher.net with full DNS management
• <strong>DNS Records:</strong> A, MX, TXT (54F/DMARC/DKIM), NS, and ACME challenge records

Key DNS Records

center}

tabular}{lll}

---

---

www.bitsmasher.net & A & Web server host (178.62.60.55) \\

@ & MX & mail.protonmail.ch 10 (ProtonMail routing) \\

@ & TXT & 54F and DMARC policies \\

protonmail.\_domainkey & CNAME & DKIM email verification \\

---

tabular}

center}

Configuration Notes

The droplet includes:

• Automated backups enabled (immutable against accidental deletion)
• SSH key injection via terraform data source
• No external monitoring (consider enabling DO agent for uptime tracking)

Provider authentication uses a DigitalOcean API token managed through pass/direnv integration. The token is passed at runtime, never committed to the repository.

The terraform/google/} directory manages GCP resources for Stash House free-tier operations.

Resources Managed

• <strong>VPC Network:</strong> \texttt{stash-house-vpc} dedicated network
• <strong>Compute Instance:</strong> e2-micro Debian 12 (Always Free Tier eligible) in us-central1-a
• <strong>Firewall Rule:</strong> \texttt{allow-ssh} opening port 22 to the VPC
• <strong>Billing Budget Alert:</strong> Tripwire alert at \$0.01 threshold for free-tier monitoring

The GCP configuration is intentionally minimal, designed around Google's Always Free Tier limits to maintain zero-cost infrastructure.

All Terraform configurations are automatically scanned by two GitHub Actions workflows:

• \texttt{tfsec-sarif.yml} — IaC security scanning (generates SARIF reports)
• \texttt{tfsec-comment.yml} — Posts security findings as PR comments

Additionally, the DigitalOcean directory includes existing README.md} with doctl and pass integration instructions for manual operations.

Terraform configurations are validated through:

• Go-based integration tests (\texttt{terraform/test/main\_test.go})
• Plan dry-run validation via GitHub Actions (markdown.yml workflow)
• Manual state reconciliation checks (compare terraform state against live infrastructure)

State drift detection is recommended as a regular maintenance task — compare terraform state list} output against actual cloud resource inventories quarterly.