Keep your OpenTofu and Terraform state in Cloudflare R2 with no secret on disk or in CI. One line of backend.ini, and the s3 backend gets short-lived R2 credentials from cloudflare-sts: the action's in CI, your login locally. Installed with Nix.
nix terraform cloudflare infrastructure-as-code tofu oidc r2 keyless secrets-management terraform-backend terraform-state nix-flake s3-backend credential-process cloudflare-r2 opentofu short-lived-credentials cloudflare-sts
-
Updated
Oct 19, 2026 - Shell