feat(b2): manage B2 buckets and scoped keys with Terraform

deploy/.terraform.lock.hcl

@@ -1,6 +1,23 @@
 # This file is maintained automatically by "tofu init".
 # Manual edits may be lost in future updates.
 
+provider "registry.opentofu.org/backblaze/b2" {
+  version     = "0.13.1"
+  constraints = "0.13.1"
+  hashes = [
+    "h1:EzFvlZbga2AmrJMRJPfN0TwRozKCxsWJSCJbXFY2S1M=",
+    "h1:HcwbhTAZKXqz+WtrrZ/YEyqhli1CE3j6SeGa21DWras=",
+    "h1:Y+wku11muzAv46c/R+F/aRZJ2Avvixl2bT+y1d8dtuc=",
+    "h1:dMsfvu7an9H59WNlx4CIeo5dU9ZjrdHGAZ+lo+NMvwQ=",
+    "h1:pG4FacUyGSToRM68EkwaH8qBHHP6GLHKYzersA8wW0I=",
+    "zh:10a82dbadd26ff3401b4be0216e2334ce054855b21b35aac3b73d87344007f61",
+    "zh:313a455e2e66433944b4189672b511040003d4c8f9baf5ef9b555433bd26b160",
+    "zh:72addf06d7e70423bbfcbb2fed8e112054a0084141776744c9a32938dca00f9d",
+    "zh:9f1e3509ea5778e61fda5d9eddf3e0cc0e0bd940241a2a3bc76a02aac5c15423",
+    "zh:a7c98cc368d60d35ec419a634a50714a6ac967ad2a6b3dd168b269798da36d1d",
+  ]
+}
+
 provider "registry.opentofu.org/linode/linode" {
   version     = "4.0.0"
   constraints = "4.0.0"

deploy/b2.tf

@@ -0,0 +1,119 @@
+provider "b2" {
+  # Credentials from environment: B2_APPLICATION_KEY_ID and B2_APPLICATION_KEY
+}
+
+# ─── Existing buckets ─────────────────────────────────────────────────────────
+
+import {
+  to = b2_bucket.matrix
+  id = "08a0a3e2fabe2ddb9ff00712"
+}
+
+resource "b2_bucket" "matrix" {
+  bucket_name = "adriano-fyi-matrix"
+  bucket_type = "allPrivate"
+}
+
+import {
+  to = b2_bucket.personal
+  id = "8830a3d2ca9ebd5b8f800712"
+}
+
+resource "b2_bucket" "personal" {
+  bucket_name = "adriano-fyi-personal"
+  bucket_type = "allPublic"
+}
+
+import {
+  to = b2_bucket.bench
+  id = "78d023029a2e4d8b8fb00712"
+}
+
+resource "b2_bucket" "bench" {
+  bucket_name = "bench-application"
+  bucket_type = "allPrivate"
+}
+
+import {
+  to = b2_bucket.garbage_speak
+  id = "6890e3e2ba7ead3b8f900712"
+}
+
+resource "b2_bucket" "garbage_speak" {
+  bucket_name = "garbage-speak-application"
+  bucket_type = "allPrivate"
+}
+
+import {
+  to = b2_bucket.nomad_job_images
+  id = "880043022acecd6b9fd00712"
+}
+
+resource "b2_bucket" "nomad_job_images" {
+  bucket_name = "nomad-job-images"
+  bucket_type = "allPrivate"
+}
+
+import {
+  to = b2_bucket.opencloud
+  id = "78d073126a9e3deb9fc00712"
+}
+
+resource "b2_bucket" "opencloud" {
+  bucket_name = "oc-adriano-fyi"
+  bucket_type = "allPrivate"
+}
+
+import {
+  to = b2_bucket.zenitylabs_backups
+  id = "485033d2ca2ebd5b8f800712"
+}
+
+resource "b2_bucket" "zenitylabs_backups" {
+  bucket_name = "zenitylabs-infra-backups"
+  bucket_type = "allPrivate"
+
+  lifecycle_rules {
+    file_name_prefix              = ""
+    days_from_uploading_to_hiding = 365
+    days_from_hiding_to_deleting  = 1
+  }
+}
+
+# ─── Forgejo ──────────────────────────────────────────────────────────────────
+
+resource "b2_bucket" "forgejo" {
+  bucket_name = "forgejo-adriano-fyi"
+  bucket_type = "allPrivate"
+}
+
+resource "b2_application_key" "forgejo" {
+  key_name  = "forgejo-adriano-fyi"
+  bucket_id = b2_bucket.forgejo.bucket_id
+  capabilities = [
+    "listBuckets",
+    "listFiles",
+    "readFiles",
+    "writeFiles",
+    "deleteFiles",
+  ]
+}
+
+# ─── JuiceFS ──────────────────────────────────────────────────────────────────
+
+resource "b2_bucket" "juicefs" {
+  bucket_name = "juicefs-ncm"
+  bucket_type = "allPrivate"
+}
+
+resource "b2_application_key" "juicefs" {
+  key_name  = "juicefs-ncm"
+  bucket_id = b2_bucket.juicefs.bucket_id
+  capabilities = [
+    "listBuckets",
+    "listFiles",
+    "readFiles",
+    "writeFiles",
+    "deleteFiles",
+  ]
+}

deploy/main.tf

@@ -18,6 +18,10 @@ terraform {
       source  = "tailscale/tailscale"
       version = "0.17.2"
     }
+    b2 = {
+      source  = "backblaze/b2"
+      version = "0.13.1"
+    }
   }
 }
 

deploy/outputs.tf

@@ -43,3 +43,31 @@ output "generation_rollout" {
   value       = var.generation_rollout
 }
 
+output "forgejo_b2_bucket" {
+  value = b2_bucket.forgejo.bucket_name
+}
+
+output "forgejo_b2_access_key" {
+  value     = b2_application_key.forgejo.application_key_id
+  sensitive = true
+}
+
+output "forgejo_b2_secret_key" {
+  value     = b2_application_key.forgejo.application_key
+  sensitive = true
+}
+
+output "juicefs_b2_bucket" {
+  value = b2_bucket.juicefs.bucket_name
+}
+
+output "juicefs_b2_access_key" {
+  value     = b2_application_key.juicefs.application_key_id
+  sensitive = true
+}
+
+output "juicefs_b2_secret_key" {
+  value     = b2_application_key.juicefs.application_key
+  sensitive = true
+}
+

env.sample

@@ -52,3 +52,8 @@ export TF_VAR_opencloud_service_account_secret=<TF_VAR_opencloud_service_account
 export TF_VAR_opencloud_admin_user_id=<TF_VAR_opencloud_admin_user_id>
 export TF_VAR_opencloud_graph_application_id=<TF_VAR_opencloud_graph_application_id>
 export TF_VAR_opencloud_idm_admin_password=<TF_VAR_opencloud_idm_admin_password>
+
+# Backblaze B2 master key — used by the deploy module to manage buckets and scoped keys
+# Must have: listBuckets, createBuckets, writeKeys capabilities
+export B2_APPLICATION_KEY_ID=<B2_APPLICATION_KEY_ID>
+export B2_APPLICATION_KEY=<B2_APPLICATION_KEY>