blocked(oci): recover Terraform root from home workstation #9

New Issue

2026-09-09T18:32:57Z

panxiao81 commented

2026-09-09 18:32:57 +00:00

Status

Blocked until physical access to the home workstation, expected in roughly one month.

The only known copy of the OCI Terraform configuration may be on that workstation. It may be powered on, but no known SSH or remote-desktop path is available. The OCI Object Storage state object remains present and is likely authoritative.

Safety freeze while blocked

Do not:

modify the OCI VM, VCN, subnet, gateways, route tables or security lists
migrate or reconfigure the OCI Terraform backend
initialize an empty replacement root against the existing state name
import, remove or move resources in the state
enable CI apply for the OCI root

Read-only inventory is acceptable, but state contents and credentials must never be pasted into issues or logs.

Recovery checklist

When the workstation is accessible, recover without committing secrets:

Terraform root source files
.terraform.lock.hcl
backend configuration or its documented inputs
variable files and the source of sensitive variables
any local terraform.tfstate.backup files
README, scripts and shell history clues needed to reproduce invocation

Then:

create an encrypted independent copy of the OCI Object Storage state
record object metadata and a cryptographic hash without exposing state content
run terraform init against an isolated working copy
reconcile provider and Terraform versions
reach a zero-change plan before any mutation
review bucket versioning and concurrent lockfile behavior separately

Unblock condition

The original root has been recovered or faithfully reconstructed, its secret inputs are accounted for, and a zero-change plan succeeds against the existing OCI state.

Related next work that can proceed independently: OpenBao/ESO recovery verification and Flux bootstrap.

## Status Blocked until physical access to the home workstation, expected in roughly one month. The only known copy of the OCI Terraform configuration may be on that workstation. It may be powered on, but no known SSH or remote-desktop path is available. The OCI Object Storage state object remains present and is likely authoritative. ## Safety freeze while blocked Do not: - modify the OCI VM, VCN, subnet, gateways, route tables or security lists - migrate or reconfigure the OCI Terraform backend - initialize an empty replacement root against the existing state name - import, remove or move resources in the state - enable CI apply for the OCI root Read-only inventory is acceptable, but state contents and credentials must never be pasted into issues or logs. ## Recovery checklist When the workstation is accessible, recover without committing secrets: - Terraform root source files - .terraform.lock.hcl - backend configuration or its documented inputs - variable files and the source of sensitive variables - any local terraform.tfstate.backup files - README, scripts and shell history clues needed to reproduce invocation Then: 1. create an encrypted independent copy of the OCI Object Storage state 2. record object metadata and a cryptographic hash without exposing state content 3. run terraform init against an isolated working copy 4. reconcile provider and Terraform versions 5. reach a zero-change plan before any mutation 6. review bucket versioning and concurrent lockfile behavior separately ## Unblock condition The original root has been recovered or faithfully reconstructed, its secret inputs are accounted for, and a zero-change plan succeeds against the existing OCI state. Related next work that can proceed independently: OpenBao/ESO recovery verification and Flux bootstrap.

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: panxiao81/homelab-infra#9