WIP: STACKIT Git as Terraform Backend with State Locking and Versioning

tim.reibe commented

2026-06-26 12:20:52 +00:00

Owner

Description

This repository demonstrates how to configure STACKIT Git as a Terraform backend to enable remote state storage with native state locking and state versioning.

Currently waiting for forgejo/pulls/7748 to get merged (and until our STACKIT Git gets updated).
Forgejo Discussion: forgejo/issues/3606

Checklist

The CI pipeline passed successfully.

## Description This repository demonstrates how to configure STACKIT Git as a Terraform backend to enable remote state storage with native state locking and state versioning. Currently waiting for [forgejo/pulls/7748](https://codeberg.org/forgejo/forgejo/pulls/7748) to get merged (and until our STACKIT Git gets updated). Forgejo Discussion: [forgejo/issues/3606](https://codeberg.org/forgejo/forgejo/issues/3606) ## Checklist - [ ] The CI pipeline passed successfully.

tim.reibe added 2 commits

2026-06-26 12:20:53 +00:00

WIP: waiting for forgejo PR fb28c48fed

updated readme

Default CI / Check for Open TODOs (pull_request) Successful in 33s

Details

Default CI / Secret Scanner (TruffleHog) (pull_request) Successful in 1m5s

Details

Default CI / Pre-Commit Hooks (pull_request) Failing after 2m0s

Details

4ab900ab54

tim.reibe changed title from ~~WIP: waiting for forgejo PR~~ to WIP: STACKIT Git as Terraform Backend with State Locking and Versioning

2026-06-26 12:21:27 +00:00

mauritz.uphoff force-pushed examples/terraform-git-backend from 4ab900ab54 to f9fdbe935e

2026-07-27 14:30:02 +00:00

Compare

mauritz.uphoff force-pushed examples/terraform-git-backend from f9fdbe935e to e7517ff42d

2026-08-03 11:34:49 +00:00

Compare

forgejo-actions commented

2026-08-03 11:36:34 +00:00

🤖 AI PR Review

Reviewing changes up to e7517ff4

📝 Spelling & Grammar

✅ No spelling or grammar issues found.

🏗️ Infrastructure Changes

Creates new Terraform variables for STACKIT service account, organization, project, region, and zone in both bootstrap and example project directories.
Initializes STACKIT provider with beta resources enabled and region/service account key configured.
Creates a new STACKIT project resource under the specified organization.
Provisions a Git instance named "tf-states" with open ACL (⚠️ security risk) and flavor "git-10".
Exposes Git instance URL as output for downstream use.
Sets up HTTP backend for Terraform state in the example project (⚠️ no state locking or remote backend configured — potential for state corruption).

# Safer alternative for git ACL — restrict to known IP ranges
resource "stackit_git" "this" {
  project_id = stackit_resourcemanager_project.this.project_id
  name       = "tf-states"
  acl = [
    "192.168.1.0/24",  # Example: restrict to internal network
    "2001:db8::/32",   # Example: IPv6 range
  ]
  flavor = "git-10"
}

# Safer alternative for backend — use Git backend with state locking
terraform {
  backend "http" {
    address = "https://<git-instance-url>/state"
    lock_address = "https://<git-instance-url>/lock"
    unlock_address = "https://<git-instance-url>/unlock"
    username = "your-username"
    password = "your-password"
  }
}

🔒 Security Review

🔴 High: The Git instance is configured with an open ACL (0.0.0.0/0), which allows unrestricted public access. This poses a significant security risk as it exposes the Git repository to potential unauthorized access or attacks.

resource "stackit_git" "this" {
  project_id = stackit_resourcemanager_project.this.project_id
  name       = "tf-states"
  acl = [
    # Restrict to specific IP ranges or use VPC peering in production
    "192.168.1.0/24"  # Example: Replace with your trusted CIDR ranges
  ]
  flavor = "git-10"
}

🟡 Medium: The Terraform backend is configured as http without any authentication or encryption, which may expose state data over unsecured connections. This could lead to state file exposure if not properly secured externally.

terraform {
  backend "http" {
    address = "https://your-secure-git-instance-url.com/state"
    lock_address = "https://your-secure-git-instance-url.com/lock"
    unlock_address = "https://your-secure-git-instance-url.com/unlock"
    username = "your-username"
    password = "your-password"
    skip_cert_verification = false  # Should be false in production
  }
}

🟢 Low: The enable_beta_resources = true setting in the provider configuration may introduce instability or untested features into production environments. Consider disabling it unless actively testing beta features.

provider "stackit" {
  default_region           = var.stackit_region
  service_account_key_path = var.stackit_service_account_key_path
  enable_beta_resources    = false  # Set to false for production stability
}

📐 Example Consistency

✅ Example follows repository conventions.

📚 Example README

✅ Example READMEs are complete.

📚 Module Variable & Output Coverage

No relevant changes to review.

💬 Commit Messages

"updated readme" → Suggest: "Update README with installation instructions and usage examples"
"WIP: waiting for forgejo PR" → Suggest: "WIP: Await Forgejo PR #123 for API compatibility before merging"

Generated automatically — treat as a hint, not a gate.

## 🤖 AI PR Review > Reviewing changes up to [`e7517ff4`](https://professional-service.git.onstackit.cloud/professional-service-best-practices/professional-service/commit/e7517ff42d0a17d4dbfe4a474417b4b79c2c5e63) <details> <summary>📝 Spelling & Grammar</summary> ✅ No spelling or grammar issues found. </details> <details> <summary>🏗️ Infrastructure Changes</summary> - Creates new Terraform variables for STACKIT service account, organization, project, region, and zone in both bootstrap and example project directories. - Initializes STACKIT provider with beta resources enabled and region/service account key configured. - Creates a new STACKIT project resource under the specified organization. - Provisions a Git instance named "tf-states" with open ACL (⚠️ security risk) and flavor "git-10". - Exposes Git instance URL as output for downstream use. - Sets up HTTP backend for Terraform state in the example project (⚠️ no state locking or remote backend configured — potential for state corruption). ```hcl # Safer alternative for git ACL — restrict to known IP ranges resource "stackit_git" "this" { project_id = stackit_resourcemanager_project.this.project_id name = "tf-states" acl = [ "192.168.1.0/24", # Example: restrict to internal network "2001:db8::/32", # Example: IPv6 range ] flavor = "git-10" } ``` ```hcl # Safer alternative for backend — use Git backend with state locking terraform { backend "http" { address = "https://<git-instance-url>/state" lock_address = "https://<git-instance-url>/lock" unlock_address = "https://<git-instance-url>/unlock" username = "your-username" password = "your-password" } } ``` </details> <details> <summary>🔒 Security Review</summary> - 🔴 High: The Git instance is configured with an open ACL (`0.0.0.0/0`), which allows unrestricted public access. This poses a significant security risk as it exposes the Git repository to potential unauthorized access or attacks. ```hcl resource "stackit_git" "this" { project_id = stackit_resourcemanager_project.this.project_id name = "tf-states" acl = [ # Restrict to specific IP ranges or use VPC peering in production "192.168.1.0/24" # Example: Replace with your trusted CIDR ranges ] flavor = "git-10" } ``` - 🟡 Medium: The Terraform backend is configured as `http` without any authentication or encryption, which may expose state data over unsecured connections. This could lead to state file exposure if not properly secured externally. ```hcl terraform { backend "http" { address = "https://your-secure-git-instance-url.com/state" lock_address = "https://your-secure-git-instance-url.com/lock" unlock_address = "https://your-secure-git-instance-url.com/unlock" username = "your-username" password = "your-password" skip_cert_verification = false # Should be false in production } } ``` - 🟢 Low: The `enable_beta_resources = true` setting in the provider configuration may introduce instability or untested features into production environments. Consider disabling it unless actively testing beta features. ```hcl provider "stackit" { default_region = var.stackit_region service_account_key_path = var.stackit_service_account_key_path enable_beta_resources = false # Set to false for production stability } ``` </details> <details> <summary>📐 Example Consistency</summary> ✅ Example follows repository conventions. </details> <details> <summary>📚 Example README</summary> ✅ Example READMEs are complete. </details> <details> <summary>📚 Module Variable & Output Coverage</summary> _No relevant changes to review._ </details> <details> <summary>💬 Commit Messages</summary> - "updated readme" → Suggest: "Update README with installation instructions and usage examples" - "WIP: waiting for forgejo PR" → Suggest: "WIP: Await Forgejo PR #123 for API compatibility before merging" </details> --- _Generated automatically — treat as a hint, not a gate._

mauritz.uphoff force-pushed examples/terraform-git-backend from e7517ff42d to acc815c90a

2026-08-03 12:41:08 +00:00

Compare

forgejo-actions commented

2026-08-03 12:44:30 +00:00

🤖 AI PR Review

Reviewing changes up to acc815c9

📝 Spelling & Grammar

✅ No spelling or grammar issues found.

🏗️ Infrastructure Changes

Creates new Terraform variables for STACKIT service account, organization, project, region, and zone (both bootstrap and example project directories)
Configures STACKIT provider with service account key and beta resources enabled (both directories)
Creates a new STACKIT project under specified organization (both directories)
⚠️ Creates a Git instance with open ACL (0.0.0.0/0) — this is a security risk in production

# Safer alternative: restrict ACL to specific IP ranges
resource "stackit_git" "this" {
  project_id = stackit_resourcemanager_project.this.project_id
  name       = "tf-states"
  acl = [
    "192.168.1.0/24",  # Example: restrict to your corporate network
    "2001:db8::/32"    # Example: IPv6 range if needed
  ]
  flavor = "git-10"
}

Exposes Git instance URL as output in bootstrap module
Sets up HTTP backend configuration in example project (incomplete — requires additional configuration for actual state locking)

🔒 Security Review

🔴 High: The stackit_git resource in 030-git.tf uses an overly permissive ACL ("0.0.0.0/0"), exposing the Git instance to the entire internet. This is explicitly flagged as unsafe in the comment but still deployed.

resource "stackit_git" "this" {
  project_id = stackit_resourcemanager_project.this.project_id
  name       = "tf-states"
  acl = [
    "192.168.1.0/24"  # Example: restrict to your trusted IP range
  ]
  flavor = "git-10"
}

🟡 Medium: The Terraform backend configuration in 010-backend.tf is incomplete — it declares backend "http" {} without specifying any URL, username, password, or lock endpoint. This will cause Terraform to fail or behave unpredictably during state operations.

terraform {
  backend "http" {
    address        = "https://your-git-instance-url/terraform-state"
    lock_address   = "https://your-git-instance-url/terraform-state/lock"
    unlock_address = "https://your-git-instance-url/terraform-state/unlock"
    username       = "your-username"
    password       = "your-password"
  }
}

🟢 Low: The stackit_service_account_key_path variable is used to load credentials from a file, which is acceptable if the file is kept out of version control — but this should be enforced via .gitignore or CI/CD secrets management. No code fix needed, but operational safeguarding is advised.

✅ No security issues found.

📐 Example Consistency

✅ Example follows repository conventions.

📚 Example README

The example directory terraform-git-backend-state-locking is appropriately named in kebab-case and clearly describes the use-case (Terraform Git backend with state locking).
The top-level README.md provides a clear overview and explains the two-phase deployment structure.
The 00-bootstrap/README.md describes the purpose of the bootstrap phase and includes usage steps (terraform init, apply, and output extraction).
The 01-example-project/README.md explains the purpose of the example infrastructure, includes setup steps (creating backend.conf, initializing with config, running validation script), and shows expected log output for lock validation.
Both subdirectories (00-bootstrap and 01-example-project) include README.md files with sufficient detail for users to understand and run the example.
The MAINTAINERS.md file is present and provides contact information and maintenance expectations.
No branding errors: “STACKIT” is correctly capitalized throughout.

✅ Example READMEs are complete.

📚 Module Variable & Output Coverage

No relevant changes to review.

💬 Commit Messages

"updated readme" → Suggest: "Update README with installation instructions and usage examples"
"WIP: waiting for forgejo PR" → Suggest: "WIP: Await Forgejo PR #123 to resolve dependency before finalizing feature X"

Generated automatically — treat as a hint, not a gate.

## 🤖 AI PR Review > Reviewing changes up to [`acc815c9`](https://professional-service.git.onstackit.cloud/professional-service-best-practices/professional-service/commit/acc815c90acb6f66a12aa30a730d3337d77f678a) <details> <summary>📝 Spelling & Grammar</summary> ✅ No spelling or grammar issues found. </details> <details> <summary>🏗️ Infrastructure Changes</summary> - Creates new Terraform variables for STACKIT service account, organization, project, region, and zone (both bootstrap and example project directories) - Configures STACKIT provider with service account key and beta resources enabled (both directories) - Creates a new STACKIT project under specified organization (both directories) - ⚠️ Creates a Git instance with open ACL (0.0.0.0/0) — this is a security risk in production ```hcl # Safer alternative: restrict ACL to specific IP ranges resource "stackit_git" "this" { project_id = stackit_resourcemanager_project.this.project_id name = "tf-states" acl = [ "192.168.1.0/24", # Example: restrict to your corporate network "2001:db8::/32" # Example: IPv6 range if needed ] flavor = "git-10" } ``` - Exposes Git instance URL as output in bootstrap module - Sets up HTTP backend configuration in example project (incomplete — requires additional configuration for actual state locking) </details> <details> <summary>🔒 Security Review</summary> - 🔴 High: The `stackit_git` resource in `030-git.tf` uses an overly permissive ACL (`"0.0.0.0/0"`), exposing the Git instance to the entire internet. This is explicitly flagged as unsafe in the comment but still deployed. ```hcl resource "stackit_git" "this" { project_id = stackit_resourcemanager_project.this.project_id name = "tf-states" acl = [ "192.168.1.0/24" # Example: restrict to your trusted IP range ] flavor = "git-10" } ``` - 🟡 Medium: The Terraform backend configuration in `010-backend.tf` is incomplete — it declares `backend "http" {}` without specifying any URL, username, password, or lock endpoint. This will cause Terraform to fail or behave unpredictably during state operations. ```hcl terraform { backend "http" { address = "https://your-git-instance-url/terraform-state" lock_address = "https://your-git-instance-url/terraform-state/lock" unlock_address = "https://your-git-instance-url/terraform-state/unlock" username = "your-username" password = "your-password" } } ``` - 🟢 Low: The `stackit_service_account_key_path` variable is used to load credentials from a file, which is acceptable if the file is kept out of version control — but this should be enforced via `.gitignore` or CI/CD secrets management. No code fix needed, but operational safeguarding is advised. ✅ No security issues found. </details> <details> <summary>📐 Example Consistency</summary> ✅ Example follows repository conventions. </details> <details> <summary>📚 Example README</summary> - The example directory `terraform-git-backend-state-locking` is appropriately named in kebab-case and clearly describes the use-case (Terraform Git backend with state locking). - The top-level `README.md` provides a clear overview and explains the two-phase deployment structure. - The `00-bootstrap/README.md` describes the purpose of the bootstrap phase and includes usage steps (`terraform init`, `apply`, and output extraction). - The `01-example-project/README.md` explains the purpose of the example infrastructure, includes setup steps (creating `backend.conf`, initializing with config, running validation script), and shows expected log output for lock validation. - Both subdirectories (`00-bootstrap` and `01-example-project`) include `README.md` files with sufficient detail for users to understand and run the example. - The `MAINTAINERS.md` file is present and provides contact information and maintenance expectations. - No branding errors: “STACKIT” is correctly capitalized throughout. ✅ Example READMEs are complete. </details> <details> <summary>📚 Module Variable & Output Coverage</summary> _No relevant changes to review._ </details> <details> <summary>💬 Commit Messages</summary> - "updated readme" → Suggest: "Update README with installation instructions and usage examples" - "WIP: waiting for forgejo PR" → Suggest: "WIP: Await Forgejo PR #123 to resolve dependency before finalizing feature X" </details> --- _Generated automatically — treat as a hint, not a gate._

Default CI / Check for Open TODOs (pull_request) Successful in 1m56s

Details

AI PR Review / AI PR Review (pull_request) Successful in 3m17s

Details

Default CI / Pre-Commit Hooks (pull_request) Failing after 10m56s

Details

This pull request is marked as a work in progress.

This branch is out-of-date with the base branch

View command line instructions

Checkout

From your project repository, check out a new branch and test the changes.

git fetch -u origin examples/terraform-git-backend:examples/terraform-git-backend

git switch examples/terraform-git-backend

Merge

Merge the changes and update on STACKIT Git.

Warning: The "Autodetect manual merge" setting is not enabled for this repository, you will have to mark this pull request as manually merged afterwards.

git switch main

git merge --no-ff examples/terraform-git-backend

git switch examples/terraform-git-backend

git rebase main

git switch main

git merge --ff-only examples/terraform-git-backend

git switch examples/terraform-git-backend

git rebase main

git switch main

git merge --no-ff examples/terraform-git-backend

git switch main

git merge --squash examples/terraform-git-backend

git switch main

git merge --ff-only examples/terraform-git-backend

git switch main

git merge examples/terraform-git-backend

git push origin main

Rows
Columns

WIP: STACKIT Git as Terraform Backend with State Locking and Versioning #45

Description

Checklist

🤖 AI PR Review

🤖 AI PR Review

Checkout

Merge