Rebuild, rather than repair
When the estate is a repository, catastrophic failure becomes a rebuild with a known duration instead of an archaeology project with an unknown one.
No console activity. Anywhere. By design.
Every resource on every estate is declared in Terraform and applied by a pipeline. There is no manual step in the delivery path, on AWS or on the metal — which is what makes the environment reproducible, the changes reviewable and the cost analysable at all.
A console change is an undocumented change
Someone fixes an incident at two in the morning by adjusting a security group in a console. It works, the incident closes, and nobody writes it down. Six weeks later a rebuild from the repository produces an environment that is subtly different, and nobody can say why. That is how estates become unreproducible — not through a decision, but through a sequence of individually reasonable exceptions.
The only defence that survives contact with a bad night is a rule with no exceptions: if it is not in the repository, it is not in the environment. That is uncomfortable during the incident and it is the reason the next one is shorter.
The only path to production
The same on every estate — the AWS account, the Proxmox cluster, the edge nodes. One workflow, two providers, no exceptions.
git switch -c raise-vod-cache-ttl
$EDITOR infra/edge/cache-policy.tf
terraform fmt -check
terraform validate
terraform plan -out=tfplan # plan output attached to the MR
git push -u origin raise-vod-cache-ttl
# review -> approve -> merge -> pipeline applies
# What does not exist in this workflow:
# a console session
# an ssh into a box to "just fix it"
# a change nobody can replayWhat the rule actually buys
Changes get read before they happen
A Terraform plan attached to a merge request is a diff of reality. Somebody sees what is about to change while it is still cheap.
A bill you can explain
Cost analysis is only possible when every resource has a declaration and an owner. Untracked resources are where cloud bills go to hide.
Somebody else can run it
A repository can be read by a new team. Tribal knowledge cannot, and it leaves when its owner does.
The things people ask first
Isn't this slower during an incident?
Marginally, once. It is dramatically faster during every subsequent incident, because the estate still matches its description and the previous fix is visible in the history.
What about things Terraform does not cover?
They go in configuration management or in the pipeline, and they are still in the repository. The rule is about the repository being authoritative, not about one tool.
Do you follow this on our estate too?
Yes. That is the point of it — and it is why an engagement can be handed over at all.
Can you rebuild your estate from your repository?
It is an uncomfortable question and the answer is usually 'mostly'. Mostly is the part that hurts at three in the morning.