From 29d5ba3e6e3e8aafa65409b1799ff78a9cdd14c1 Mon Sep 17 00:00:00 2001
From: Story Crater Bot <19826264+Riotpiaole@users.noreply.github.com>
Date: Tue, 18 Aug 2026 15:08:01 -0700
Subject: [PATCH] chore(terraform): clean up TF state git-tracking (gitignore,
 drop cached state, dep bump)

---
 .gitignore                             |  9 ++++--
 terraform/.terraform.lock.hcl          | 45 ++++++++++++++++++++++++++
 terraform/.terraform/terraform.tfstate | 12 -------
 terraform/providers.tf                 |  8 +++++
 terraform/variables.tf                 |  7 ++++
 5 files changed, 67 insertions(+), 14 deletions(-)
 delete mode 100644 terraform/.terraform/terraform.tfstate

diff --git a/.gitignore b/.gitignore
index d2ea8ba..7bd047c 100644
--- a/.gitignore
+++ b/.gitignore
@@ -38,5 +38,10 @@ k8s/storage/test/test
 # Allowed markdown: CLAUDE.example.md, README.md, TROUBLESHOOTING.md
 CLAUDE.md
 
-skills-lock.jsonterraform/.terraform/
-terraform/*.tfstate*
+# Terraform state and cache (local files, remote state in MinIO)
+.terraform/
+terraform/.terraform/
+terraform/*.tfstate
+terraform/*.tfstate.*
+terraform.tfvars.local
+skills-lock.json
diff --git a/terraform/.terraform.lock.hcl b/terraform/.terraform.lock.hcl
index 81f48bc..91c83b8 100644
--- a/terraform/.terraform.lock.hcl
+++ b/terraform/.terraform.lock.hcl
@@ -1,6 +1,51 @@
 # This file is maintained automatically by "terraform init".
 # Manual edits may be lost in future updates.
 
+provider "registry.terraform.io/goauthentik/authentik" {
+  version     = "2024.12.1"
+  constraints = "~> 2024.6"
+  hashes = [
+    "h1:jpWLnotmskcXHfA5sFrWpANOJbip3wlJpj5ui6KGWzg=",
+    "zh:090260dc7889ea822ec1d899344e1ee23eba5290461989c0796149c9511f2316",
+    "zh:13c2655ff824b0dc4b9bb832b5ca6d41dba97cb280330258c5fef4115e236209",
+    "zh:166a73c3a810c9c895d68a8ff968158f339f8a2c1c03e20ec9fc5ed99cc64e20",
+    "zh:203777eae1cdc711233315499643180604cff2324411b186b7cf07fdbe16f655",
+    "zh:3b2f18c9a8d28dac74dc6bbf168c946855ab9c68f053578d4630c50d5eaf30a0",
+    "zh:4822275985f6b74b6196c47112316a4252db22cf4ceaef7c9ab4c66d488abf2f",
+    "zh:53ea97562666c8a5a2f6d63d418a302a7f8ee4b7bb7da35dedaa89aa5708b7f0",
+    "zh:56b8a230901e3550c92a1d3f58ee9dafe9853f30fe4315af3ab28ae63262e15d",
+    "zh:6293ab7b1fd8206a0c853591f50186aca4a1eff117b2a773e10760a23a2c83e9",
+    "zh:9433970f79fb92d8aae3ee436db5630ab312c78b6dc9df9c1db3273a18f8aaa1",
+    "zh:95df406214f79b3b98222d7c7fe8fc319a3d90b7a9d53e1d5abbda5dfb8b9436",
+    "zh:a85880da0552a42c8f449390fbd7d8b03541d1a13e04bba9f1404fa658754260",
+    "zh:a95f6e9bd62c67e70eba1b1a14728856b9a6a28cd1e5e3be54a7718882c87e7f",
+    "zh:dd599b51c5beb34a4c6feece244fde07d2558d69929449ab1fd39a5ebe738781",
+  ]
+}
+
+provider "registry.terraform.io/hashicorp/aws" {
+  version     = "5.100.0"
+  constraints = "~> 5.0"
+  hashes = [
+    "h1:Ijt7pOlB7Tr7maGQIqtsLFbl7pSMIj06TVdkoSBcYOw=",
+    "zh:054b8dd49f0549c9a7cc27d159e45327b7b65cf404da5e5a20da154b90b8a644",
+    "zh:0b97bf8d5e03d15d83cc40b0530a1f84b459354939ba6f135a0086c20ebbe6b2",
+    "zh:1589a2266af699cbd5d80737a0fe02e54ec9cf2ca54e7e00ac51c7359056f274",
+    "zh:6330766f1d85f01ae6ea90d1b214b8b74cc8c1badc4696b165b36ddd4cc15f7b",
+    "zh:7c8c2e30d8e55291b86fcb64bdf6c25489d538688545eb48fd74ad622e5d3862",
+    "zh:99b1003bd9bd32ee323544da897148f46a527f622dc3971af63ea3e251596342",
+    "zh:9b12af85486a96aedd8d7984b0ff811a4b42e3d88dad1a3fb4c0b580d04fa425",
+    "zh:9f8b909d3ec50ade83c8062290378b1ec553edef6a447c56dadc01a99f4eaa93",
+    "zh:aaef921ff9aabaf8b1869a86d692ebd24fbd4e12c21205034bb679b9caf883a2",
+    "zh:ac882313207aba00dd5a76dbd572a0ddc818bb9cbf5c9d61b28fe30efaec951e",
+    "zh:bb64e8aff37becab373a1a0cc1080990785304141af42ed6aa3dd4913b000421",
+    "zh:dfe495f6621df5540d9c92ad40b8067376350b005c637ea6efac5dc15028add4",
+    "zh:f0ddf0eaf052766cfe09dea8200a946519f653c384ab4336e2a4a64fdd6310e9",
+    "zh:f1b7e684f4c7ae1eed272b6de7d2049bb87a0275cb04dbb7cda6636f600699c9",
+    "zh:ff461571e3f233699bf690db319dfe46aec75e58726636a0d97dd9ac6e32fb70",
+  ]
+}
+
 provider "registry.terraform.io/hashicorp/helm" {
   version     = "2.17.0"
   constraints = "~> 2.14"
diff --git a/terraform/.terraform/terraform.tfstate b/terraform/.terraform/terraform.tfstate
deleted file mode 100644
index e0613fc..0000000
--- a/terraform/.terraform/terraform.tfstate
+++ /dev/null
@@ -1,12 +0,0 @@
-{
-  "version": 3,
-  "terraform_version": "1.9.4",
-  "backend": {
-    "type": "local",
-    "config": {
-      "path": "terraform.tfstate",
-      "workspace_dir": null
-    },
-    "hash": 73024536
-  }
-}
\ No newline at end of file
diff --git a/terraform/providers.tf b/terraform/providers.tf
index d1f43da..bcb511b 100644
--- a/terraform/providers.tf
+++ b/terraform/providers.tf
@@ -17,6 +17,14 @@ terraform {
       source  = "hashicorp/null"
       version = "~> 3.2"
     }
+    authentik = {
+      source  = "goauthentik/authentik"
+      version = "~> 2024.6"
+    }
+    aws = {
+      source  = "hashicorp/aws"
+      version = "~> 5.0"
+    }
   }
 }
 
diff --git a/terraform/variables.tf b/terraform/variables.tf
index 4f415ac..74eac76 100644
--- a/terraform/variables.tf
+++ b/terraform/variables.tf
@@ -17,6 +17,13 @@ variable "vault_token" {
   default     = ""
 }
 
+variable "authentik_api_token" {
+  description = "Authentik API token for goauthentik provider (terraform configuration management)"
+  type        = string
+  sensitive   = true
+  default     = ""
+}
+
 variable "s3_access_key" {
   description = "MinIO S3 access key for terraform state backend"
   type        = string