mirror of
https://github.com/opentffoundation/opentf.git
synced 2026-02-19 07:01:10 -05:00
80 lines
3.7 KiB
Plaintext
80 lines
3.7 KiB
Plaintext
---
|
||
sidebar_label: http
|
||
description: OpenTofu can store state remotely at any valid HTTP endpoint.
|
||
---
|
||
|
||
# Backend Type: http
|
||
|
||
Stores the state using a simple [REST](https://en.wikipedia.org/wiki/Representational_state_transfer) client.
|
||
|
||
State will be fetched via GET, updated via POST, and purged with DELETE. The method used for updating is configurable.
|
||
|
||
This backend optionally supports [state locking](../../../language/state/locking.mdx). When locking
|
||
support is enabled it will use LOCK and UNLOCK requests providing the lock info in the body. The
|
||
endpoint should return a 423: Locked or 409: Conflict with the holding lock info when it's already
|
||
taken, 200: OK for success. Any other status will be considered an error. The ID of the holding lock
|
||
info will be added as a query parameter to state updates requests.
|
||
|
||
## Example Usage
|
||
|
||
```hcl
|
||
terraform {
|
||
backend "http" {
|
||
address = "http://myrest.api.com/foo"
|
||
lock_address = "http://myrest.api.com/foo"
|
||
unlock_address = "http://myrest.api.com/foo"
|
||
}
|
||
}
|
||
```
|
||
|
||
## Data Source Configuration
|
||
|
||
```hcl
|
||
data "terraform_remote_state" "foo" {
|
||
backend = "http"
|
||
config = {
|
||
address = "http://my.rest.api.com"
|
||
}
|
||
}
|
||
```
|
||
|
||
## Configuration Variables
|
||
|
||
:::danger Warning
|
||
We recommend using environment variables to supply credentials and other sensitive data. If you use `-backend-config` or hardcode these values directly in your configuration, OpenTofu will include these values in both the `.terraform` subdirectory and in plan files. Refer to [Credentials and Sensitive Data](../../../language/settings/backends/configuration.mdx#credentials-and-sensitive-data) for details.
|
||
:::
|
||
|
||
The following configuration options / environment variables are supported:
|
||
|
||
- `address` / `TF_HTTP_ADDRESS` - (Required) The address of the REST endpoint
|
||
- `update_method` / `TF_HTTP_UPDATE_METHOD` - (Optional) HTTP method to use
|
||
when updating state. Defaults to `POST`.
|
||
- `lock_address` / `TF_HTTP_LOCK_ADDRESS` - (Optional) The address of the lock
|
||
REST endpoint. Defaults to disabled.
|
||
- `lock_method` / `TF_HTTP_LOCK_METHOD` - (Optional) The HTTP method to use
|
||
when locking. Defaults to `LOCK`.
|
||
- `unlock_address` / `TF_HTTP_UNLOCK_ADDRESS` - (Optional) The address of the
|
||
unlock REST endpoint. Defaults to disabled.
|
||
- `unlock_method` / `TF_HTTP_UNLOCK_METHOD` - (Optional) The HTTP method to use
|
||
when unlocking. Defaults to `UNLOCK`.
|
||
- `username` / `TF_HTTP_USERNAME` - (Optional) The username for HTTP basic
|
||
authentication
|
||
- `password` / `TF_HTTP_PASSWORD` - (Optional) The password for HTTP basic
|
||
authentication
|
||
- `headers` - (Optional) Map of additional headers to be included in the HTTP
|
||
requests sent to the backend. Defaults to `{}`.
|
||
- `skip_cert_verification` - (Optional) Whether to skip TLS verification.
|
||
Defaults to `false`.
|
||
- `retry_max` / `TF_HTTP_RETRY_MAX` – (Optional) The number of HTTP request
|
||
retries. Defaults to `2`.
|
||
- `retry_wait_min` / `TF_HTTP_RETRY_WAIT_MIN` – (Optional) The minimum time in
|
||
seconds to wait between HTTP request attempts. Defaults to `1`.
|
||
- `retry_wait_max` / `TF_HTTP_RETRY_WAIT_MAX` – (Optional) The maximum time in
|
||
seconds to wait between HTTP request attempts. Defaults to `30`.
|
||
|
||
For mTLS authentication, the following three options may be set:
|
||
|
||
- `client_certificate_pem` / `TF_HTTP_CLIENT_CERTIFICATE_PEM` - (Optional) A PEM-encoded certificate used by the server to verify the client during mutual TLS (mTLS) authentication.
|
||
- `client_private_key_pem` /`TF_HTTP_CLIENT_PRIVATE_KEY_PEM` - (Optional) A PEM-encoded private key, required if client_certificate_pem is specified.
|
||
- `client_ca_certificate_pem` / `TF_HTTP_CLIENT_CA_CERTIFICATE_PEM` - (Optional) A PEM-encoded CA certificate chain used by the client to verify server certificates during TLS authentication.
|