Skip to content
choudoufuDocs

What you set up by hand

llms.txtlists every page for an agent
Optional: hand this page to your coding agentThe steps work by hand too.
Show the whole prompt
Follow https://intentius.io/choudoufu/docs/use/setup/ for this repository and tell me what is missing. Create nothing in the cloud. Never apply or destroy (`choudoufu apply`, `choudoufu destroy`, `tofu apply`), approve a saved plan, or merge; never edit or remove an owner tag by hand.
Piece Who creates it
Credentials and an access policy You
estate.chdf.hcl, the live backend: the estate name and the record_store block You
The record store: a bucket, a namespace or a storage container You
Markers on new resources The apply
Markers on existing resources You, by migrating

Credentials

Section titled “Credentials”
Platform Credentials
AWS AWS_PROFILE and a region
Kubernetes config_path in record_store, or KUBECONFIG or KUBE_CONFIG_PATH
GCP gcloud auth application-default login
Azure az login, and subscription_id in the azurerm provider block

The estate declaration

Section titled “The estate declaration”
estate.chdf.hcl
estate = "my-estate"




record_store "s3" {


  bucket = "my-records-bucket"


  region = "us-east-2"


}

The record store

Section titled “The record store”
Store What must exist first
local Nothing. Gitignore .tofu-records/
s3 The bucket (set it up)
kubernetes The namespace, a role bound to Secrets in it (examples/record-store-cluster), the admission policy and encryption at rest (Records)
gcs The bucket (CONTRACT.md)
azurerm The storage account and container (CONTRACT.md)

Create the store outside the estate that uses it.

Permissions

Section titled “Permissions”
Platform What each writer holds
AWS The service’s tagging action, such as ec2:CreateTags (live/IAM-REFERENCE.md)
Kubernetes use on its estate (the gate)
GCP The roles for the estate’s types, on its project (the gate)
Azure A role on the estate’s resource groups (the gate)

choudoufu