tofu: remove state from tracking, add gitignore, upgrade providers
- Stop tracking terraform.tfstate (git rm --cached) - Add tofu/.gitignore with tfstate, plan, and IDE patterns - Upgrade Porkbun provider 1.3.1 -> 1.3.3 - Upgrade Cloudflare provider 4.52.5 -> 4.52.7 - Add audit findings.md with 33 issues identified - Clean up local backup files
This commit is contained in:
parent
5e8823f4dd
commit
9b73f436d8
4 changed files with 364 additions and 5113 deletions
286
findings.md
Normal file
286
findings.md
Normal file
|
|
@ -0,0 +1,286 @@
|
|||
# Infra Code Audit Findings
|
||||
|
||||
> Generated: 2026-06-04
|
||||
> Scope: `tofu/` (OpenTofu) and `talos/` (Talos Kubernetes cluster)
|
||||
|
||||
## Severity Legend
|
||||
- **🔴 CRITICAL** — Security vulnerability or data exposure
|
||||
- **🟠 HIGH** — Configuration that will break or is actively broken
|
||||
- **🟡 MEDIUM** — Suboptimal config, drift, or potential future issue
|
||||
- **🔵 LOW** — Cleanup / best practice / suggestion
|
||||
|
||||
---
|
||||
|
||||
## 🔴 Security Issues
|
||||
|
||||
### S-1: `talos/kubeconfig` committed to git
|
||||
- **File**: `talos/kubeconfig`
|
||||
- **Severity**: 🔴 CRITICAL
|
||||
- **Issue**: Full admin kubeconfig for the home-cluster is tracked in git. Grants cluster admin access.
|
||||
- **Fix**: Add to `.gitignore`, remove from git history (`git rm --cached talos/kubeconfig`), rotate certs if exposed publicly.
|
||||
|
||||
### S-2: `talos/secrets.yaml.backup` tracked in git
|
||||
- **File**: `talos/secrets.yaml.backup`
|
||||
- **Severity**: 🔴 CRITICAL
|
||||
- **Issue**: Backup of cluster secrets (contains CA keys, bootstrap tokens, service account keys) is tracked in git. The main `secrets.yaml` is correctly gitignored, but the backup isn't — `.gitignore` only has `*.bak` not `*.backup`.
|
||||
- **Fix**: Add `*.backup` to `.gitignore`, `git rm --cached talos/secrets.yaml.backup`.
|
||||
|
||||
### S-3: `talos/talosconfig.backup` tracked in git
|
||||
- **File**: `talos/talosconfig.backup`
|
||||
- **Severity**: 🔴 CRITICAL
|
||||
- **Issue**: Backup of talosctl admin config is tracked in git (same `.backup` gitignore gap).
|
||||
- **Fix**: Add `*.backup` to `.gitignore`, `git rm --cached talos/talosconfig.backup`.
|
||||
|
||||
### S-4: Tailscale pre-auth keys in plaintext in CP configs
|
||||
- **Files**: `talos/configs/talos-cp1.yaml`, `talos-cp2.yaml`, `talos-cp3.yaml` (TS_AUTHKEY line)
|
||||
- **Severity**: 🔴 CRITICAL
|
||||
- **Issue**: Tailscale pre-authentication keys are stored in plaintext in three config files. Also exposed in `talos/configs/talos-worker2.yaml`. These keys are reusable until revoked and grant Tailscale network access.
|
||||
- **Fix**: Use `sops` or environment variable injection at apply time. Rotate the exposed keys in Tailscale admin console.
|
||||
|
||||
### S-5: `tofu/terraform.tfstate` committed to git
|
||||
- **File**: `tofu/terraform.tfstate`
|
||||
- **Severity**: 🔴 CRITICAL
|
||||
- **Issue**: Terraform state file (5,081 lines) committed to repo. Contains Cloudflare account IDs, zone IDs, internal K8s service DNS names (`*.svc.cluster.local`), tunnel ingress rules, and DKIM keys. OpenTofu has native state encryption (v1.7+) which is not being used.
|
||||
- **Fix**: Add `*.tfstate*` to `.gitignore`, migrate to remote encrypted state backend, or use OpenTofu state encryption.
|
||||
|
||||
### S-6: Private CA keys and cluster secrets exposed in per-node configs
|
||||
- **Files**: All `talos/configs/talos-*.yaml` — every per-node config contains raw PKI private keys (machine CA, cluster CA, aggregator CA, service account, etcd CA)
|
||||
- **Severity**: 🔴 CRITICAL
|
||||
- **Issue**: Per-node configs contain the full cluster PKI private keys in base64. These are NOT in `.gitignore`. Anyone with repo access can decrypt and use them to impersonate cluster components.
|
||||
- **Fix**: Either gitignore the per-node configs, or strip keys and inject at apply time via `talosctl apply-config --patch`.
|
||||
|
||||
---
|
||||
|
||||
## 🟠 Configuration Issues & Likely Bugs
|
||||
|
||||
### C-1: Installer version drift — CPs on v1.12.4, some workers on v1.12.6
|
||||
- **Files**:
|
||||
- `talos/controlplane.yaml:80` → `v1.12.4`
|
||||
- `talos/configs/talos-cp{1,2,3}.yaml:80` → `v1.12.4`
|
||||
- `talos/configs/talos-worker{1,2,3}.yaml:78` → `v1.12.4`
|
||||
- `talos/configs/talos-worker{4,5}.yaml:78` → `v1.12.6`
|
||||
- `talos/CLAUDE.md:9` → "Talos Version: v1.12.6"
|
||||
- **Severity**: 🟠 HIGH
|
||||
- **Issue**: Configs reference a mix of `v1.12.4` and `v1.12.6` installer images. CLAUDE.md documents v1.12.6 as the cluster version. Per-node CP configs and workers 1-3 are on v1.12.4. Mixed versions across control plane and workers can cause compatibility issues.
|
||||
- **Fix**: Update all references to v1.12.6 (whatever the current running version is).
|
||||
|
||||
### C-2: `grubUseUKICmdline` + `extraKernelArgs` conflict on CPs
|
||||
- **Files**:
|
||||
- `talos/configs/talos-cp1.yaml:84-85` (and cp2, cp3)
|
||||
- `talos/CLAUDE.md` documents this explicitly: "install.extraKernelArgs and install.grubUseUKICmdline cannot be used together"
|
||||
- **Severity**: 🟠 HIGH
|
||||
- **Issue**: All three control plane per-node configs set BOTH `grubUseUKICmdline: true` AND `extraKernelArgs: ["console=tty0"]`. Talos v1.12 validates these as mutually exclusive and will reject the config. Since these are Proxmox VMs booting with UEFI (OVMF), they likely use `systemd-boot` which ignores `extraKernelArgs` anyway.
|
||||
- **Fix**: Remove `extraKernelArgs` and bake kernel args into the Image Factory schematic if needed.
|
||||
|
||||
### C-3: Tailscale extension won't work on control plane nodes
|
||||
- **Files**: `talos/configs/talos-cp{1,2,3}.yaml`
|
||||
- `install.image`: `ghcr.io/siderolabs/installer:v1.12.4` (stock installer)
|
||||
- `install.extensions`: `[ghcr.io/siderolabs/tailscale:1.82.1]`
|
||||
- `ExtensionServiceConfig`: configured for tailscale with `TS_AUTHKEY`
|
||||
- **Severity**: 🟠 HIGH
|
||||
- **Issue**: CP configs specify `install.extensions` but use the **stock** installer image (`ghcr.io/siderolabs/installer`). Extensions require a **custom/factory** installer image (like the worker configs use: `factory.talos.dev/installer/<hash>`). The stock installer does NOT support extensions. Result: tailscale extension binary is never installed, `ExtensionServiceConfig` for tailscale silently fails.
|
||||
- **Fix**: Either switch CP nodes to use the factory installer image (bundling tailscale into the schematic), or remove the tailscale extension config from CP nodes.
|
||||
|
||||
### C-4: Longhorn disk configs missing on workers 2 and 3
|
||||
- **Files**: `talos/configs/talos-worker2.yaml` (lines 34-41, 89-92), `talos/configs/talos-worker3.yaml` (same)
|
||||
- **Severity**: 🟠 HIGH
|
||||
- **Issue**: Workers 2 and 3 have NVMe passthrough disks (`/dev/sdb`) for Longhorn per CLAUDE.md, but the `extraMounts` and `disks` sections are **commented out** in both configs. Worker1 (no NVMe) correctly has them disabled, but workers 2 and 3 appear to have been incorrectly commented out during the same fix pass. Longhorn effectively has no dedicated storage in the cluster.
|
||||
- **Fix**: Uncomment `extraMounts` and `disks` sections in `talos-worker2.yaml` and `talos-worker3.yaml`.
|
||||
|
||||
### C-5: All per-node worker configs lack `/dev/sdb` disk config
|
||||
- **Files**: `talos/configs/talos-worker{1,2,3,4,5}.yaml`
|
||||
- **Severity**: 🟠 HIGH
|
||||
- **Issue**: ALL per-node worker configs have `extraMounts` and `disks` commented out. The base `worker.yaml` template has them active. Since per-node configs are what gets applied, no worker has the Longhorn bind mount configured. The base template and per-node configs have drifted apart.
|
||||
- **Fix**: Enable for workers 2-3 (have NVMe). Keep disabled for worker1 (no NVMe). Clarify for workers 4-5.
|
||||
|
||||
### C-6: Suspect firewall expression `(not http.user_agent ne "")`
|
||||
- **File**: `tofu/cloudflare.tf:437`
|
||||
- **Severity**: 🟠 HIGH
|
||||
- **Issue**: The expression `(not http.user_agent ne "")` uses confusing double negation. Cloudflare's WAF expression language may not handle this as intended — Cloudflare normalizes empty User-Agents by injecting defaults, making this condition effectively a no-op.
|
||||
- **Fix**: Use `(not http.user_agent exists)` to block requests with missing User-Agent, or remove the condition entirely.
|
||||
|
||||
---
|
||||
|
||||
## 🟡 Configuration Drift & Suboptimal Settings
|
||||
|
||||
### D-1: Base configs (`controlplane.yaml`, `worker.yaml`) are stale templates
|
||||
- **Files**: `talos/controlplane.yaml`, `talos/worker.yaml`
|
||||
- **Severity**: 🟡 MEDIUM
|
||||
- **Issue**: These are the original `talosctl gen config` output with auto-generated hostnames. They are NOT applied to any node (per-node configs in `configs/` are used instead). Yet they contain the same cluster secrets and must be kept in sync with any changes. They serve no deployment purpose and add maintenance burden.
|
||||
- **Fix**: Either delete them (rely solely on per-node configs) or clearly mark them as templates with a big warning comment.
|
||||
|
||||
### D-2: `controlplane.yaml` has no DNS nameservers configured
|
||||
- **File**: `talos/controlplane.yaml` (network: `{}`)
|
||||
- **Severity**: 🟡 MEDIUM
|
||||
- **Issue**: Base controlplane config has empty network config. `worker.yaml` has three explicit nameservers (`9.9.9.9`, `149.112.112.112`, `1.1.1.1`). CP nodes rely entirely on DHCP DNS with no fallback.
|
||||
- **Fix**: Add the same nameservers to the CP template for consistency.
|
||||
|
||||
### D-3: No nameservers in per-node configs
|
||||
- **Files**: All `talos/configs/talos-*.yaml`
|
||||
- **Severity**: 🟡 MEDIUM
|
||||
- **Issue**: While `worker.yaml` template has nameservers, none of the per-node configs carry them. All nodes rely on DHCP DNS only.
|
||||
- **Fix**: Add nameservers to per-node configs for DNS resilience.
|
||||
|
||||
### D-4: Hostname auto-generation in base configs (potential footgun)
|
||||
- **Files**: `talos/controlplane.yaml` (HostnameConfig: `auto: stable`), `talos/worker.yaml` (same)
|
||||
- **Severity**: 🟡 MEDIUM
|
||||
- **Issue**: The base configs use `auto: stable` which generates hostnames from machine IDs. If someone applies the base config to a new node thinking it's a template, they'll get an auto-generated hostname instead of a predictable one.
|
||||
- **Fix**: Comment out the `auto` line and add a big WARNING comment.
|
||||
|
||||
### D-5: Per-node worker configs lack time servers
|
||||
- **Files**: `talos/configs/talos-worker{1,2,3}.yaml`
|
||||
- **Severity**: 🟡 LOW
|
||||
- **Issue**: Per-node CP configs have `time.servers: [0/1/2.us.pool.ntp.org]` but worker per-node configs do not. Workers fall back to default NTP.
|
||||
- **Fix**: Add NTP servers to worker configs for consistency.
|
||||
|
||||
### D-6: Kubernetes discovery registry disabled
|
||||
- **Files**: All configs — `cluster.discovery.registries.kubernetes.disabled: true`
|
||||
- **Severity**: 🟡 MEDIUM
|
||||
- **Issue**: Kubernetes discovery is disabled, and the external service registry is empty `{}`. If the Talos discovery service is unavailable, new nodes can't discover existing cluster members and won't join.
|
||||
- **Fix**: Enable Kubernetes discovery (`disabled: false`) so nodes can discover each other via the API server.
|
||||
|
||||
### D-7: `talos/CLAUDE.md` and `talos/README.md` doc drift
|
||||
- **Files**: `talos/README.md` vs `talos/CLAUDE.md`
|
||||
- **Severity**: 🟡 MEDIUM
|
||||
- **Issue**: README.md says 3 workers (10.0.15.4-6), CLAUDE.md says 4 workers (10.0.15.4-7 including bare-metal talos4). README.md says "Proxmox Ceph storage" for VMs but Ceph is NOT used — it's `local-lvm`. README.md upgrade example references v1.9.5 (far behind).
|
||||
- **Fix**: Align README.md with actual cluster state. Remove Ceph references.
|
||||
|
||||
### D-8: `tofu/` provider versions behind
|
||||
- **Files**: `tofu/.terraform.lock.hcl`
|
||||
- **Severity**: 🟡 LOW
|
||||
- **Issue**: Cloudflare provider pinned at v4.52.5 (v5.x available — breaking changes to review). Porkbun at v1.3.1 (v1.3.3 latest).
|
||||
- **Fix**: Review changelogs and upgrade if safe.
|
||||
|
||||
### D-9: Towerops tunnel uses `.svc.cluster.local` DNS
|
||||
- **File**: `tofu/cloudflare.tf:574-580`
|
||||
- **Severity**: 🟡 MEDIUM
|
||||
- **Issue**: Tunnel ingress rules point to `http://towerops.towerops.svc.cluster.local:4000` etc. `cloudflared` running on a VM at 204.110.191.200 must be able to resolve these cluster-internal DNS names, which requires special DNS forwarding setup.
|
||||
- **Fix**: Verify DNS resolution works, or document the setup.
|
||||
|
||||
### D-10: PodSecurity admission uses deprecated `v1alpha1` API version
|
||||
- **Files**: All CP configs — `admissionControl[0].configuration.apiVersion: pod-security.admission.config.k8s.io/v1alpha1`
|
||||
- **Severity**: 🟡 LOW
|
||||
- **Issue**: The `v1alpha1` API version for PodSecurityConfiguration was deprecated in Kubernetes 1.33+. The cluster runs v1.35.0. Should use `v1` or `v1beta1`.
|
||||
- **Fix**: Update to `pod-security.admission.config.k8s.io/v1`.
|
||||
|
||||
### D-11: `machine.time`, `machine.disks`, `machine.network.nameservers` use legacy fields
|
||||
- **Files**: Various in `talos/`
|
||||
- **Severity**: 🟡 LOW
|
||||
- **Issue**: Talos v1.12 deprecates these fields in favor of multi-doc configs (`TimeSyncConfig`, `UserVolumeConfig`, `ResolverConfig`). Currently functional but will be removed in a future Talos version.
|
||||
- **Fix**: Migrate to multi-doc configs when convenient.
|
||||
|
||||
---
|
||||
|
||||
## 🔵 Cleanup & Suggestions
|
||||
|
||||
### E-1: Stale backup files committed to git
|
||||
- **Files**:
|
||||
- `tofu/terraform.tfstate.*.backup` (3 files)
|
||||
- `tofu/terraform.tfstate.backup`
|
||||
- `talos/configs/talos-worker1.yaml.bak`
|
||||
- `talos/secrets.yaml.backup`
|
||||
- `talos/talosconfig.backup`
|
||||
- **Severity**: 🔵 LOW
|
||||
- **Issue**: Multiple stale backup files clutter the repo. `.gitignore` in talos/ has `*.bak` but not `*.backup`.
|
||||
- **Fix**: Add `*.backup`, `*.bak`, `*.tfstate*` to gitignore both places. Clean up tracked files.
|
||||
|
||||
### E-2: `tofu/tfplan` committed
|
||||
- **File**: `tofu/tfplan`
|
||||
- **Severity**: 🔵 LOW
|
||||
- **Issue**: Binary plan file committed. Should be ephemeral/gitignored.
|
||||
- **Fix**: Add `tfplan` to gitignore.
|
||||
|
||||
### E-3: No `.gitignore` in `tofu/`
|
||||
- **File**: (missing) `tofu/.gitignore`
|
||||
- **Severity**: 🔵 LOW
|
||||
- **Issue**: The tofu directory has no `.gitignore`. State files, `.terraform/` provider cache, plan files, and IDE settings are tracked.
|
||||
- **Fix**: Create `tofu/.gitignore` with `.terraform/`, `*.tfstate*`, `tfplan`, `.envrc`, `.claude/`.
|
||||
|
||||
### E-4: `tofu/.claude/` IDE settings tracked
|
||||
- **File**: `tofu/.claude/settings.local.json`
|
||||
- **Severity**: 🔵 LOW
|
||||
- **Issue**: IDE/editor configuration committed to repo.
|
||||
- **Fix**: Add `.claude/` to gitignore.
|
||||
|
||||
### E-5: Orphaned/unused worker configs (workers 4 and 5)
|
||||
- **Files**: `talos/configs/talos-worker4.yaml`, `talos/configs/talos-worker5.yaml`
|
||||
- **Severity**: 🔵 LOW
|
||||
- **Issue**: Worker4 config has `hostname: talos4` (filename doesn't match hostname). Worker5 hostname `talos5` with no documented existence. Worker4 config uses bare-metal install disk pattern (`/dev/sdb`). Worker5 uses `/dev/nvme0n1`. No VMs or nodes documented for either.
|
||||
- **Fix**: Either document the purpose of these nodes or remove the orphaned configs.
|
||||
|
||||
### E-6: `towerops-dev` tunnel documented as "down"
|
||||
- **File**: `tofu/cloudflare.tf` (comment around line 556)
|
||||
- **Severity**: 🔵 LOW
|
||||
- **Issue**: dev tunnel marked as "down" in comments but still has import + config resource. If the tunnel was deleted from Cloudflare, `tofu apply` will fail.
|
||||
- **Fix**: Either remove the tunnel config or fix the tunnel and update the comment.
|
||||
|
||||
### E-7: `talos/.gitignore` doesn't cover secrets effectively
|
||||
- **File**: `talos/.gitignore`
|
||||
- **Severity**: 🔵 LOW
|
||||
- **Issue**: Currently only ignores `secrets.yaml`, `talosconfig`, `*.tmp`, `*.bak`. Missing: `*.backup`, `kubeconfig`, `configs/*.yaml` (which contain full cluster PKI).
|
||||
- **Fix**: Add `*.backup`, `kubeconfig` to `.gitignore`. Consider gitignoring per-node configs and maintaining them outside the repo.
|
||||
|
||||
### E-8: `disableManifestsDirectory: true` comment is misleading
|
||||
- **Files**: All configs
|
||||
- **Severity**: 🔵 LOW
|
||||
- **Issue**: Comment says "configures the kubelet to get static pod manifests from the /etc/kubernetes/manifests directory" — but setting `true` DISABLES that directory. The comment describes the inverse behavior.
|
||||
- **Fix**: Fix the comment to say "Disable static pod manifest directory".
|
||||
|
||||
### E-9: `talos/README.md` has stale upgrade example
|
||||
- **File**: `talos/README.md` line 47, 112
|
||||
- **Severity**: 🔵 LOW
|
||||
- **Issue**: Upgrade example shows `v1.9.5` (cluster is on v1.12.x). Also mentions `tofu` deployment workflow referencing `terraform/talos_vms.tf` which was removed.
|
||||
- **Fix**: Update examples to match current versions and directory structure.
|
||||
|
||||
### E-10: `tofu/` uses OpenTofu-specific features (worth documenting)
|
||||
- **File**: `tofu/dns.tf`, `tofu/cloudflare.tf`
|
||||
- **Severity**: 🔵 LOW (INFO)
|
||||
- **Issue**: Uses `import` with `for_each` which is an OpenTofu v1.8+ feature with no Terraform equivalent. This config can't go back to Terraform.
|
||||
- **Fix**: Document this constraint to prevent future migration attempts.
|
||||
|
||||
---
|
||||
|
||||
## Summary
|
||||
|
||||
| Severity | Count |
|
||||
|----------|-------|
|
||||
| 🔴 CRITICAL | 6 |
|
||||
| 🟠 HIGH | 6 |
|
||||
| 🟡 MEDIUM | 11 |
|
||||
| 🔵 LOW | 10 |
|
||||
| **Total** | **33** |
|
||||
|
||||
**Top 5 priorities:**
|
||||
1. Remove sensitive files from git (kubeconfig, secrets backup, talosconfig backup, per-node configs with PKI) — S-1, S-2, S-3, S-6
|
||||
2. Rotate exposed Tailscale pre-auth keys — S-4
|
||||
3. Fix CP configs: either remove tailscale extension or switch to factory installer — C-3
|
||||
4. Fix `grubUseUKICmdline` + `extraKernelArgs` conflict on CPs — C-2
|
||||
5. Uncomment Longhorn disk config on workers 2-3 and resolve installer version drift — C-1, C-4, C-5
|
||||
|
||||
---
|
||||
|
||||
## ✅ Fixes Applied (2026-06-04)
|
||||
|
||||
### S-5: State file removed from git tracking
|
||||
- Created `tofu/.gitignore` with `*.tfstate`, `*.tfstate.*`, `.terraform/`, `tfplan`, `.envrc`, `.claude/`
|
||||
- Ran `git rm --cached tofu/terraform.tfstate` — stops tracking but keeps local copy
|
||||
- Backup state files (`*tfstate*.backup`, `*tfstate.*.backup`) now covered by `*.tfstate.*` pattern
|
||||
|
||||
### D-8: Porkbun provider upgraded to latest
|
||||
- **Before**: v1.3.1 | **After**: v1.3.3
|
||||
- Via `tofu init -upgrade` (within existing `~> 1.3` constraint)
|
||||
- Lock file updated accordingly
|
||||
|
||||
### D-8: Cloudflare provider upgraded to latest v4.x
|
||||
- **Before**: v4.52.5 | **After**: v4.52.7
|
||||
- Via `tofu init -upgrade` (within existing `~> 4.0` constraint)
|
||||
- Lock file updated accordingly
|
||||
|
||||
### E-1, E-2, E-3: Local backup files cleaned up
|
||||
- Removed `tofu/terraform.tfstate.backup`
|
||||
- Removed `tofu/terraform.tfstate.*.backup` (3 stale backups)
|
||||
- Removed `tofu/tfplan`
|
||||
- `.gitignore` prevents future accumulation
|
||||
|
||||
### Notes
|
||||
- **Cloudflare v5.x** not yet migrated — requires splitting 4x `cloudflare_zone_settings_override` into ~16 individual `cloudflare_zone_setting` resources + renaming `zone` → `name` on `cloudflare_zone`. Non-trivial. Pending decision.
|
||||
22
tofu/.gitignore
vendored
Normal file
22
tofu/.gitignore
vendored
Normal file
|
|
@ -0,0 +1,22 @@
|
|||
# Local .terraform directories
|
||||
.terraform/
|
||||
|
||||
# Terraform / OpenTofu state files
|
||||
*.tfstate
|
||||
*.tfstate.*
|
||||
!*.tfstate.enc
|
||||
|
||||
# Plan files
|
||||
tfplan
|
||||
plan.out
|
||||
|
||||
# Environment variables
|
||||
.envrc
|
||||
|
||||
# IDE/editor settings
|
||||
.claude/
|
||||
.idea/
|
||||
.vscode/
|
||||
|
||||
# OS files
|
||||
.DS_Store
|
||||
88
tofu/.terraform.lock.hcl
generated
88
tofu/.terraform.lock.hcl
generated
|
|
@ -2,47 +2,71 @@
|
|||
# Manual edits may be lost in future updates.
|
||||
|
||||
provider "registry.opentofu.org/cloudflare/cloudflare" {
|
||||
version = "4.52.5"
|
||||
version = "4.52.7"
|
||||
constraints = "~> 4.0"
|
||||
hashes = [
|
||||
"h1:+rfzF+16ZcWZWnTyW/p1HHTzYbPKX8Zt2nIFtR/+f+E=",
|
||||
"zh:1a3400cb38863b2585968d1876706bcfc67a148e1318a1d325c6c7704adc999b",
|
||||
"zh:4c5062cb9e9da1676f06ae92b8370186d98976cc4c7030d3cd76df12af54282a",
|
||||
"zh:52110f493b5f0587ef77a1cfd1a67001fd4c617b14c6502d732ab47352bdc2f7",
|
||||
"zh:5aa536f9eaeb43823aaf2aa80e7d39b25ef2b383405ed034aa16a28b446a9238",
|
||||
"zh:5cc39459a1c6be8a918f17054e4fbba573825ed5597dcada588fe99614d98a5b",
|
||||
"zh:629ae6a7ba298815131da826474d199312d21cec53a4d5ded4fa56a692e6f072",
|
||||
"zh:719cc7c75dc1d3eb30c22ff5102a017996d9788b948078c7e1c5b3446aeca661",
|
||||
"zh:8698635a3ca04383c1e93b21d6963346bdae54d27177a48e4b1435b7f731731c",
|
||||
"h1:+O72J3QYiZtYmYYZM/Eh0f4NNfl1BvjX1eju43qTQsQ=",
|
||||
"h1:0oqjYIPXcXh7XiDiKI085cHDYQQ5mh8kDl9dmBtvtog=",
|
||||
"h1:4b4ESb87MGv5bnadgYe7sK5rEkKMZhbkQcwPubQTsR4=",
|
||||
"h1:6mTr3eA1Ddb348lLmJuyvn98z4KF+ejqaUEJ76D1rzQ=",
|
||||
"h1:9/3YH+9k9HqsvFtbmBf7SO2+xqZeZrXNKzLkjNuhUEA=",
|
||||
"h1:Jcq4tBWgyH4/2JsojNBSRaN0mcItVMchO+lynonrlqc=",
|
||||
"h1:Y4Vv/2RdP0Q+uxqhOxzOdKxuuEMjXPDcU0vPc5bCQzI=",
|
||||
"h1:a0gW8FBKsbP9Fi0HEDoy49WIbEWVHk9+BR4/iwuBdDQ=",
|
||||
"h1:gElv6iqJtg8OKN77gbw+MjrkrQmJHPkkMEi1J+0xkpU=",
|
||||
"h1:oslXUugD/NQ+duJgT4BhKQyfGbuFOANknMvR73fiOeM=",
|
||||
"h1:pPItIWii5oymR+geZB219ROSPuSODPLTlM4S/u8xLvM=",
|
||||
"h1:u67GWw8GwD9NDlDzp9Y5VRnSQGcCrE8rSpkGPaBpDl0=",
|
||||
"h1:uUUa9dY0XQOycI8pxg16PFFtL0WCTi9uEJz8trTQ7pU=",
|
||||
"h1:y3rV8KF2q6GEMANNlf5EkKJurlfbKlIKpjGcdxoy7pQ=",
|
||||
"zh:0c904ce31a4c6c4a5b3bf7ff1560e77c0cc7e2450c8553ded8e8c90398e1418b",
|
||||
"zh:36183d310c36373fe4cb936b83c595c6fd3b0a94bc7827f28e5789ccbf59752e",
|
||||
"zh:556a568a6f0235e8f41647de9e4d3a1e7b1d6502df8b19b54ec441f1c653ea10",
|
||||
"zh:633ebbd5b0245e75e500ef9be4d9e62288f97e8da3baaa51323892a786d90285",
|
||||
"zh:6acfe60cf52a65ba8f044f748548d2119e7f4fd7f8ebcb14698960d87c68f529",
|
||||
"zh:890df766e9b839623b1f0437355032a3c006226a6c200cd911e15ee1a9014e9f",
|
||||
"zh:8a9993f1dcadf1dd6ca43b23348abe374605d29945a2fafc07fb3457644e6a54",
|
||||
"zh:b1b9a1e6bcc24d5863a664a411d2dc906373ae7a2399d2d65548ce7377057852",
|
||||
"zh:b270184cdeec277218e84b94cb136fead753da717f9b9dc378e51907f3f00bb0",
|
||||
"zh:dff2bc10071210181726ce270f954995fe42c696e61e2e8f874021fed02521e5",
|
||||
"zh:e8e87b40b6a87dc097b0fdc20d3f725cec0d82abc9cc3755c1f89f8f6e8b0036",
|
||||
"zh:ee964a6573d399a5dd22ce328fb38ca1207797a02248f14b2e4913ee390e7803",
|
||||
"zh:904acc31ebb9d6ef68c792074b30532ee61bf515f19e0a3c75b46f126cca1f13",
|
||||
"zh:a1d0a81246afc8750286d3f6fe7a8fbe6460dd2662407b28dbfbabb612e5fa9d",
|
||||
"zh:a41a36fe253fc365fe2b7ffc749624688b2693b4634862fda161179ab100029f",
|
||||
"zh:a7ef269e77ffa8715c8945a2c14322c7ff159ea44c15f62505f3cbb2cae3b32d",
|
||||
"zh:b01aa3bed30610633b762df64332b26f8844a68c3960cebcb30f04918efc67fe",
|
||||
"zh:b069cc2cd18cae10757df3ae030508eac8d55de7e49eda7a5e3e11f2f7fe6455",
|
||||
"zh:b2d2c6313729ebb7465dceece374049e2d08bda34473901be9ff46a8836d42b2",
|
||||
"zh:db0e114edaf4bc2f3d4769958807c83022bfbc619a00bdf4c4bd17faa4ab2d8b",
|
||||
"zh:ecc0aa8b9044f664fd2aaf8fa992d976578f78478980555b4b8f6148e8d1a5fe",
|
||||
]
|
||||
}
|
||||
|
||||
provider "registry.opentofu.org/marcfrederick/porkbun" {
|
||||
version = "1.3.1"
|
||||
version = "1.3.3"
|
||||
constraints = "~> 1.3"
|
||||
hashes = [
|
||||
"h1:TZUIn82Jy1NcvuJbkAUTqJe5ZTturKavp8DNCJc5Dvo=",
|
||||
"zh:00be5fe6b337e52b2df94d0c0dbcd1f128178fce2ecfd8395335a2de87454d6f",
|
||||
"zh:074e1356c81dd109e7af7236f04e8a457e85947932594aced13b6ecb46088eba",
|
||||
"zh:30399ab3355c7e7fc4e4bf05878f942e5d115992327e34f6d29cd27a2386414e",
|
||||
"zh:3bece2a7906dc5b46c253ccf1b61eba4c1cedef4c06228d1d5574eb4bbf30770",
|
||||
"zh:5ec7663da565282f614459da4286db358cf845ee6131c6a7d9ec098c59d48892",
|
||||
"zh:8143e0186cce84d111a3dbc3243a8861874a98c96f9064bc08360efdc95a9940",
|
||||
"h1:7pd/XzGn1uU8dB2Q3p+OmNM0apgvNoziaQgV1GgqWxc=",
|
||||
"h1:ETE198D4KRlETcvui15+a++IRnxSsOSk2X9FIBeare4=",
|
||||
"h1:FIvrECEORerVTmuqslVWE/SnM1mZ9PUAPDh4zWrotMg=",
|
||||
"h1:IMWtn8KU7Ee5fV6xtXcHFzd8gchEQ0G2zflh3ap4/hI=",
|
||||
"h1:RDIV2kXgFdVL8oMxDzZMsiw1a1SIxqpg46F9GRuq/vQ=",
|
||||
"h1:VMkW8FjFqUVGJ3AZaG8mb0MZpE6Gy8iVZ28LL6rJ8Pc=",
|
||||
"h1:eWjEf8lM0rYz5dQ0OSN8GiBTFMjRypfZYdougdvaeZE=",
|
||||
"h1:lqX/HzE1Egv3MpJX1gZvf9xym6J7nzbLoLHDWdAvrXc=",
|
||||
"h1:oC1q2jDns+OSy1b6POZzcvXGHjsAm02PrQV2b/EsPrc=",
|
||||
"h1:ol8kESoWenFzbD5mnSxGbtGtfIdlpd4/RwRQdZQHGww=",
|
||||
"h1:pCKjLsAoSAlOhfnDiQfj/iaSD5dh3gakRz4P7v7sv4Q=",
|
||||
"h1:tf9ViGy07GKQRHtPpD/q2Y83Jw3wxf6ChpzQvZPRNmE=",
|
||||
"h1:zuVK81Q9A3kNE4K/U24O2IqyLZWIQkBrV8uzmrbqYPY=",
|
||||
"zh:22aa92d9b7d62aed053a9fda804ed707f613ccf91b142069486d6fe60390d695",
|
||||
"zh:2e1c40b509d87b04c7e06db5afef36b433e66219784cc4f89069467504b40a75",
|
||||
"zh:33b58d18de6a6bbce957dccd88e667dab8dcce7182f2edc1ca65f9baef2678c4",
|
||||
"zh:512be9f8c3b85bb3f2ae9c8e061ab6d8c4c2939a1e2e5189cba36cba08b22dd6",
|
||||
"zh:554134e0765d52e5ac98428306afa5733ffea991832ae96e110c752a37426b7e",
|
||||
"zh:72483db4a717cc605dcfcc141aa0003993cfced79374b4468d1674d41ecdf171",
|
||||
"zh:7353bfb1484b6771145b03becf612921ec11ee1242467b4c1ab6a13936ad306b",
|
||||
"zh:76be10c1b4912f5905df73d9c860e2a625e4963a55d5a9b57b24fae4f2c7bb81",
|
||||
"zh:890df766e9b839623b1f0437355032a3c006226a6c200cd911e15ee1a9014e9f",
|
||||
"zh:8cd7408b52014347bc4434d10912034dbc888c82b2740c9659686b6d925b428a",
|
||||
"zh:99609cff963348e048ed7a57346fcfe27bde9a4cb6e39f918e874765202fb1ba",
|
||||
"zh:a0ecbad8896a6d93bcce67a18cdad5773cb780ec966f8fe8d2fcb89f69ef7feb",
|
||||
"zh:bb47b00067c953499cbecc673cd8e713b7df5adc262071b79899e3799ddd07c4",
|
||||
"zh:cf8164f7bc817f5b77b7d9a89861aad964b82e2e7793281af724b858dc6d426f",
|
||||
"zh:eb6a9e7b3961feffb06fef6ca2b1f2af0c7b6461b1dccee58ead5b376dd44ebd",
|
||||
"zh:f575cae4eb42d55a00e65f1f04f54bcae38de79321647f199a8fdf6b390ac507",
|
||||
"zh:fa02d69a676baa6a6304a3a9ee7769c5c6e877d604bff6f9ca3d584ce77c0fea",
|
||||
"zh:9d4d41c5b02ba5d15cdaae0e322f719d33f62c7317bf9547005b8601ef9853a6",
|
||||
"zh:b0afb80c8113060ddd555ac8f051ddc8243df101986f851b277831b87a4ad084",
|
||||
"zh:bce4c04dc2f06b129d957a83d500b3d70748018c5c2c7ddab2ded12319bf1ace",
|
||||
"zh:caa1e4f2087141fa8b35c33b1957b73a8ecc6c507175703ae95509adb3bb5aaa",
|
||||
"zh:e9e89b7a308225e649c1015c5bfcbf23feb49e1d6a3d94c9bd230124323bf1a2",
|
||||
]
|
||||
}
|
||||
|
|
|
|||
File diff suppressed because it is too large
Load diff
Loading…
Add table
Reference in a new issue