infra — single source of truth for provider infrastructure

Per the cloudflare-iac-consolidation Quorum verdict (2026-08-14): one repo, directory-per-stack, one state per stack (not a monolith, not workspaces). CI-only Terraform (PR->plan, merge->apply), per-stack path filters.

Boundary rule

If destroying it loses data or access -> here (Terraform). If redeploying it ships code -> the app repo (its deploy tool).

So R2/D1/Queues/Vectorize/tunnels/Access/DNS/zone live here; Worker script + bindings stay with the app. Apps consume published outputs (GH vars), never terraform_remote_state.

Stacks

• cloudflare/apollo-brain/ — Zero Trust tunnel + Access for the brain VM. Migrated 2026-08-14 (whole-stack move, state apollo-tfstate unchanged).
• cloudflare/relay/ — planned (Phase 2).
• cloudflare/talvi/ — planned (Phase 3, holds real data — import blocks only, never recreate).
• cloudflare/shared/ — planned (zone, DNS, email-OTP idp).
• sentry/ — planned (jianyuan/sentry provider).
• clerk/ — NOT Terraform (no provider) — versioned Backend-API apply script.

Migration doctrine

Config-driven only (import/removed blocks); any plan showing a destroy on a D1/R2/tunnel/Worker = STOP. Whole-stack code moves keep the backend byte-identical so the plan is "No changes." Order: apollo-brain -> relay -> talvi.