[stale] (Copilot Workspace) Implement Terraform

.github/workflows/cd.yml

@@ -50,11 +50,13 @@ jobs:
       - name: Install dependencies
         run: pnpm install
 
-      - name: Deploy
-        uses: cloudflare/wrangler-action@v3
+      - name: Trigger Terraform Workflow
+        uses: actions/github-script@v6
         with:
-          apiToken: ${{ secrets.CLOUDFLARE_API_TOKEN }}
-          accountId: ${{ secrets.CF_ACCOUNT_ID }}
+          script: |
+            const { execSync } = require('child_process');
+            execSync('terraform init', { stdio: 'inherit' });
+            execSync('terraform apply -auto-approve', { stdio: 'inherit' });
 
       - name: Create Sentry release
         uses: getsentry/action-release@v1

.github/workflows/terraform.yml

@@ -0,0 +1,32 @@
+name: "Terraform Deployment"
+
+on:
+  push:
+    branches:
+      - main
+  pull_request:
+    branches:
+      - main
+
+jobs:
+  terraform:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v2
+
+      - name: Set up Terraform
+        uses: hashicorp/setup-terraform@v1
+        with:
+          terraform_version: 1.0.0
+
+      - name: Terraform Init
+        run: terraform init
+
+      - name: Terraform Apply
+        run: terraform apply -auto-approve
+
+      - name: Store Terraform State
+        run: |
+          mkdir -p $HOME/.terraform.d/plugin-cache
+          terraform init -backend-config="path=$HOME/.terraform.d/plugin-cache"

terraform/main.tf

@@ -0,0 +1,58 @@
+terraform {
+  required_providers {
+    cloudflare = {
+      source  = "cloudflare/cloudflare"
+      version = "~> 3.0"
+    }
+  }
+}
+
+provider "cloudflare" {
+  api_token = var.cloudflare_api_token
+}
+
+resource "cloudflare_worker_script" "nceahelpworker" {
+  name = "nceahelpworker"
+  content = file("src/server.ts")
+  type = "javascript"
+}
+
+resource "cloudflare_kv_namespace" "token_store" {
+  title = "TOKEN_STORE"
+}
+
+resource "cloudflare_worker_secret" "discord_token" {
+  script = cloudflare_worker_script.nceahelpworker.name
+  name   = "DISCORD_TOKEN"
+  value  = var.discord_token
+}
+
+resource "cloudflare_worker_secret" "discord_public_key" {
+  script = cloudflare_worker_script.nceahelpworker.name
+  name   = "DISCORD_PUBLIC_KEY"
+  value  = var.discord_public_key
+}
+
+resource "cloudflare_worker_secret" "discord_application_id" {
+  script = cloudflare_worker_script.nceahelpworker.name
+  name   = "DISCORD_APPLICATION_ID"
+  value  = var.discord_application_id
+}
+
+resource "cloudflare_worker_secret" "discord_client_secret" {
+  script = cloudflare_worker_script.nceahelpworker.name
+  name   = "DISCORD_CLIENT_SECRET"
+  value  = var.discord_client_secret
+}
+
+resource "cloudflare_worker_secret" "worker_url" {
+  script = cloudflare_worker_script.nceahelpworker.name
+  name   = "WORKER_URL"
+  value  = var.worker_url
+}
+
+resource "cloudflare_worker_secret" "cookie_secret" {
+  script = cloudflare_worker_script.nceahelpworker.name
+  name   = "COOKIE_SECRET"
+  value  = var.cookie_secret
+}

terraform/outputs.tf

@@ -0,0 +1,4 @@
+output "cloudflare_worker_url" {
+  description = "The URL of the deployed Cloudflare Worker"
+  value       = cloudflare_worker_script.nceahelpworker.id
+}

terraform/variables.tf

@@ -0,0 +1,45 @@
+variable "cloudflare_account_id" {
+  description = "The Cloudflare account ID"
+  type        = string
+}
+
+variable "cloudflare_api_token" {
+  description = "The Cloudflare API token"
+  type        = string
+  sensitive   = true
+}
+
+variable "discord_token" {
+  description = "The Discord API token"
+  type        = string
+  sensitive   = true
+}
+
+variable "discord_public_key" {
+  description = "The Discord public key"
+  type        = string
+  sensitive   = true
+}
+
+variable "discord_application_id" {
+  description = "The Discord application ID"
+  type        = string
+  sensitive   = true
+}
+
+variable "discord_client_secret" {
+  description = "The Discord client secret"
+  type        = string
+  sensitive   = true
+}
+
+variable "worker_url" {
+  description = "The URL of the worker"
+  type        = string
+}
+
+variable "cookie_secret" {
+  description = "The secret for signing cookies"
+  type        = string
+  sensitive   = true
+}