Documentation · Use it

Reference

The normative specifications live in the repository beside the code and the tests holding them to it. This page indexes them.

They are for people integrating with choudoufu or working on it. To get an estate running, use the path pages.

Specifications

These files in the repository are the authority, and this page summarises them.

Commands

choudoufu <command> -help is authoritative for flags. The live-specific commands follow.

-adoption-only

choudoufu plan -adoption-only answers one question during a migration: which live resource does each declared instance bind to. It prints each instance’s class (already marked, adoptable now, waits on parent, no path, in the way, nothing live) with the command that adopts it, and nothing else. It takes the full sweep, so it costs more than an ordinary plan. Recover an estate has the classes, and live/ADOPTION-ONLY.md has the measurements.

The live configuration

Two places to write it, one dialect. The leading form is the sidecar estate.chdf.hcl at the configuration root. Its extension is not .tf, so stock tooling never parses it: OpenTofu, Terraform, fmt and linters all skip it.

# estate.chdf.hcl
estate = "prod-networking"

record_store "s3" {
  bucket = "my-records-bucket"
}

The same content may live in a live block inside terraform. Both forms are supported; both present at once is an error naming the file and the block. A backend or cloud block alongside either is refused in the decoder, before any command runs.

Arguments

snapshots and snapshot_path are tombstones: the subsystem they configured was removed, and setting either errors with what replaced it. Guided discovery’s hint now rides the record_store.

record_store block

One label picks the backend: "local", "s3" or "kubernetes". Every estate has a store; a live block naming none gets the local one. Where things are stored has the rest.

policy block

The ownership matrix. One verb per quadrant of declared-or-not against tagged-or-not, plus marker key overrides and the delete guard. The ownership policy matrix has the verbs, defaults and reasoning.

strict block

The principles this fork exists for, each as a toggle whose default is what stock OpenTofu does. A block that sets nothing and no block at all mean the same thing, so an estate that sets none behaves like stock plus markers. Turning a toggle on is the setup step.

secrets and no_source_create can be pinned to their strict setting by CHOUDOUFU_STRICT_PIN=1 in the environment that runs the plan or apply, so a configuration cannot relax them. live/STRICT.md has each toggle’s reasoning and what it refuses, with the fixtures that prove it.

Permissions a run needs

choudoufu makes few calls of its own. Resource reads, writes and lists go through the provider plugin, so those are the provider’s permissions as in any OpenTofu run. The fork’s own surface follows.

Each row names the file making the calls. The tagging verbs below move with botocore across 205 services, so they are generated.

Marker stamping

Writing an ownership marker calls the tagging action for the resource’s own service. The provider makes that call during the ordinary apply, so a role that can create the resource can usually already tag it. The actions matter when a policy is scoped tightly.

158 services carry an unambiguous tagging verb. 47 do not, and a run cannot stamp a marker on those.

Whether a policy condition on those actions is evaluated is a separate question. live/iam-reference.json answers it from AWS’s own Service Authorization Reference. That artifact is authoritative about the condition keys it names and silent about the ones it omits. A listed key is evidence the condition applies. An unlisted one is an absent statement rather than a statement of absence.

Everything else is OpenTofu

The language and CLI are unmodified, and so are providers and backends. Use opentofu.org/docs.