heygo/terraform/README.md

Terraform Infrastructure

This directory provisions the Cloudflare resources that heygo depends on: a D1 database, a Workers KV namespace, and two Worker custom domains (public + private shortlink hosts). The same configuration targets both the dev and prod environments via separate .tfvars files.

Resources managed

Resource	Terraform type	Purpose
D1 database	cloudflare_d1_database	Stores links, sessions, users, promotion submissions
KV namespace	cloudflare_workers_kv_namespace	Public link cache in front of D1
Public custom domain	cloudflare_workers_custom_domain	dev.heygo.cc / heygo.cc
Private custom domain	cloudflare_workers_custom_domain	my.dev.heygo.cc / my.heygo.cc

First-time setup

1. Install Terraform >= 1.5.

2. Create a Cloudflare API token with these permissions:

   • Account / D1: Read + Write
   • Account / Workers KV Storage: Read + Write
   • Account / Workers Scripts: Read + Write
   • Zone / Workers Routes: Read + Write

3. Export the token:

   export CLOUDFLARE_API_TOKEN=cf-token-here
   

4. Fill in account_id, heygo_cc_zone_id, and private_domain_zone_id in environments/dev.tfvars and environments/prod.tfvars. The other values are pre-filled for each environment.

Apply per environment

# Dev
terraform -chdir=terraform init
terraform -chdir=terraform plan  -var-file=environments/dev.tfvars
terraform -chdir=terraform apply -var-file=environments/dev.tfvars

# Prod
terraform -chdir=terraform plan  -var-file=environments/prod.tfvars
terraform -chdir=terraform apply -var-file=environments/prod.tfvars

These commands are also exposed as npm scripts (infra:init, infra:plan:dev, infra:apply:dev, infra:plan:prod, infra:apply:prod) from the project root.

Copy outputs into Wrangler configs

After terraform apply, read the outputs:

terraform -chdir=terraform output -var-file=environments/dev.tfvars

Copy the printed d1_database_id into the d1_databases[].database_id field and kv_namespace_id into the kv_namespaces[].id field of the matching wrangler config:

• dev outputs → wrangler.dev.jsonc
• prod outputs → wrangler.prod.jsonc

Then apply D1 migrations and deploy the Worker (see the project root README Deployment section).

Notes

• terraform/*.tfvars are committed because they contain no secrets, only placeholder zone/account IDs. Real IDs are filled in locally. The .gitignore keeps any other stray *.tfvars files out of version control.
• State files (*.tfstate) and the .terraform/ plugin cache are git-ignored. For team use, configure a remote backend (e.g. Cloudflare R2 + native backend block) before the first apply.