docs(terraform): add state management script and best practices guide

scripts/terraform-state-backup.sh

@@ -0,0 +1,56 @@
+#!/bin/bash
+# Terraform state backup script
+# Backs up Terraform state to local directory and verifies S3 backend accessibility
+
+set -e
+
+BACKUP_DIR="$HOME/.terraform-backups/homelab"
+TIMESTAMP=$(date +%Y%m%d-%H%M%S)
+STATE_BACKUP="$BACKUP_DIR/$TIMESTAMP-terraform.tfstate"
+
+mkdir -p "$BACKUP_DIR"
+
+echo "=== Terraform State Backup ==="
+echo "Backup directory: $BACKUP_DIR"
+
+# Navigate to terraform directory
+cd "$(dirname "${BASH_SOURCE[0]}")/../terraform" || exit 1
+
+# Pull state from remote backend
+echo "Pulling Terraform state from S3..."
+terraform state pull > "$STATE_BACKUP" && \
+  echo "✓ State backed up to $STATE_BACKUP" || \
+  echo "⚠️ Failed to pull state (S3 backend may not be initialized)"
+
+# Verify S3 bucket
+echo ""
+echo "Verifying S3 backend accessibility..."
+if [ -z "$KUBECONFIG" ]; then
+  echo "⚠️ KUBECONFIG not set. Run: core auth login"
+  exit 1
+fi
+
+if kubectl get pods -n storage -l app=minio &>/dev/null; then
+  MINIO_POD=$(kubectl get pods -n storage -l app=minio -o jsonpath='{.items[0].metadata.name}')
+  echo "MinIO pod: $MINIO_POD"
+
+  # Check bucket
+  if kubectl exec -n storage "$MINIO_POD" -- mc ls minio/terraform-state &>/dev/null; then
+    echo "✓ S3 bucket 'terraform-state' accessible"
+  else
+    echo "⚠️ S3 bucket 'terraform-state' not found or inaccessible"
+    echo "   To create: kubectl exec -n storage $MINIO_POD -- mc mb minio/terraform-state"
+  fi
+else
+  echo "⚠️ MinIO not running in storage namespace"
+fi
+
+# Keep only last 30 backups
+echo ""
+echo "Cleaning up old backups (keeping last 30)..."
+ls -t "$BACKUP_DIR"/*.tfstate 2>/dev/null | tail -n +31 | xargs -r rm && \
+  echo "✓ Cleanup complete" || \
+  echo "ℹ️ No old backups to remove"
+
+echo ""
+echo "Backup complete. Location: $STATE_BACKUP"