State is the memory of the infra and the plan is the contract — no negotiation.
HCL IaC with OpenTofu and Terraform in parity: encrypted state, pinned versions, modules as APIs, and a saved plan that is reviewed and applied only by CI.
$ schematize install terraformNon-negotiable floors
Never switched off "to go faster". Full list in the skill.
One tool per repo
OpenTofu and Terraform carry equal weight, with no default; each repo picks one and never mixes them.
A root per environment
Never use a workspace to separate hml from prd: it shares backend, credentials and code.
Remote, locked, encrypted state
One per environment and stack, versioned; plaintext state is forbidden and *.tfstate or *.tfplan never go to git.
Pinned versions and lock file
required_version and required_providers with version, and .terraform.lock.hcl committed with hashes for all platforms.
A module is an API
Variables with type, description and validation, minimal outputs, secrets marked sensitive and never a provider inside a child module.
Secrets out of HCL
Never in .tf, .tfvars or a default; prefer what stays out of the state (ephemeral, a vault read at runtime).
Saved plan, human review, CI apply
Apply only that plan; in prd only through CI, in a protected environment, and never a local apply.
Commands
Installed in .claude/commands/. Run /tf-help anytime.
/tf-ccContext compact: writes context + checklist to the archive and runs /compact./tf-claudeCreates or merges the always-on IaC CLAUDE.md at the repo root (won't overwrite other skills' blocks)./tf-driftDetects and classifies drift (plan -detailed-exitcode) and proposes the fix as a PR./tf-handoffWrites the context handoff without compacting — session end or task switch./tf-helpLists every command./tf-importAdopts an existing resource with an import, moved or removed block, no hand-run state mv./tf-loadForce-loads the whole normative body: tooling, structure, state, versions and modules, secrets, flow, quality and providers./tf-moduleCreates a module to the house contract: variables with validation, outputs, a provider-free versions.tf and a test./tf-planThe plan rite: produces the saved plan, reads it in the right order and prepares the human review. Never applies./tf-reviewReviews the IaC repo: runs the gate, fmt/validate/tflint when present and reads what the machine cannot.For AI agents
Install with no human in the loop. Metadata in llms.txt.
- Run: git clone https://github.com/schematizeme/skill-terraform.git && ./skill-terraform/install.sh
- Or download: https://github.com/schematizeme/skill-terraform/releases/latest/download/skill-terraform.zip and unzip into .claude/skills/
- Copy assets/CLAUDE.md to the repo root (always-on rule).
- Confirm with /tf-help.
Thảo luận
Đang tải…