# quotesdb Infrastructure

OpenTofu configuration for deploying quotesdb to Cloudflare.

## Resources provisioned

| Resource | Description |
|---|---|
| `cloudflare_d1_database.quotesdb` | D1 SQLite database backing the API |
| `cloudflare_workers_script.api` | Compiled Wasm Worker serving `/api/*` |
| `cloudflare_workers_route.api` | Routes `quotes.elijah.run/api/*` to the Worker |
| `cloudflare_pages_project.ui` | Pages project hosting the Yew SPA |
| `cloudflare_record.ui` | CNAME `quotes.elijah.run` → Pages |
| `cloudflare_pages_domain.ui` | Custom domain binding on Pages |

## Required credentials

| Variable | Description |
|---|---|
| `cloudflare_api_token` | Cloudflare API token (Workers, D1, Pages, DNS edit) |
| `cloudflare_account_id` | Cloudflare account ID |
| `cloudflare_zone_id` | Zone ID for `elijah.run` |

These are set in `terraform.tfvars` (gitignored)

```sh
cloudflare_api_token="..."
cloudflare_account_id="..."
cloudflare_zone_id="..."
```

## First-time setup (chicken-and-egg)

D1 must exist before the Worker can bind to it. On the very first deploy:

```sh
cd infra/
tofu init
tofu apply -target=cloudflare_d1_database.quotesdb
wrangler d1 execute quotesdb --file schema.sql --remote
tofu apply
```

Subsequent deploys: CI/CD handles everything automatically.

## Local apply

```sh
cd quotesdb/infra/
tofu init
tofu plan
tofu apply
```

## State

State is stored locally in `terraform.tfstate` (gitignored). For a team setup, migrate to a remote backend (S3-compatible bucket, Terraform Cloud, etc.).

## Files

| File | Purpose |
|---|---|
| `main.tf` | Terraform block and provider version constraints |
| `providers.tf` | Cloudflare provider configuration |
| `variables.tf` | Input variable declarations |
| `d1.tf` | Cloudflare D1 database resource |
| `worker.tf` | Cloudflare Workers script + route |
| `pages.tf` | Cloudflare Pages project |
| `dns.tf` | DNS record and custom domain binding |
| `schema.sql` | Idempotent D1 schema (applied via wrangler, not tofu) |
| `.gitignore` | Ignores state, lock, and credential files |