Skip to main content

Terraform

The Terraform path supports AWS, Azure, and GCP from one shared deployer. The AWS, scripted path stays the stable, AWS-only option. Both coexist and produce the same running platform.

Mental model: two layers, upgraded separately​

LayerOwnerState
VPC/network, firewall, VMs, disks, SSH keyTerraformterraform.tfstate
App (env render, Docker Compose, gateways, reverse proxy)The deploy script, over SSHDocker named volumes on the VMs

Terraform provisions the infrastructure; the deploy script reads its output plus your .env and installs the app. The compose/gateway/proxy runtime it syncs is shared with the AWS scripted path.

Prerequisites​

  • Terraform >= 1.5.
  • AWS: credentials via the default chain (aws configure or AWS_PROFILE); set region/profile in terraform.tfvars.
  • Azure: az login (or a service principal); set subscription/location.
  • GCP: gcloud auth application-default login; set project/region/zone.

Terraform generates the SSH keypair itself and writes the private key locally. On AWS it also creates the IAM role and instance profile every Cortega EC2 instance needs, including read access for the AWS-native provider integrations Cortega supports.

Next​

Run terraform apply in the cloud-specific directory, then the deploy script over SSH to install the app. See Install overview for first login. Full day-2 operations are covered in the Terraform runbook that ships in the release package.