encrypt terraform state

[siddarthkay]

fixes: #2

Summary

• This PR encrypts terraform state backup with a hash generated from CONSUL_HTTP_TOKEN

[jakubgs]

This is incorrect. We do need local backups of Terraform state. This is a disaster recovery measure.

This about a scenario in which Consul cluster is broken or unavailable, but you need to manage the state of our cloud resources using Terraform, for example scale up. Without Consul that would not be doable, but with the backup available you could decrypt it and migrate to a local state to handle necessary changes even without Consul.

[siddarthkay]

Hmm In that case, I can encrypt the state backed up by terraform with consul's http token.
I'll use this PR for that.

[jakubgs]

I tested it locally, works nicely. Two notes tho:

• I would move the decryption script to infra-utils/ansible and just reference it since it should be rarely needed.
• The ansible/README.md should updated in the Inventory section to explain the encrypted backup and how to decrypt.

[siddarthkay]

@jakubgs : One thing i worry about is if CONSUL_HTTP_TOKEN were ever to change, all backups encrypted with old token would no longer decrypt with new CONSUL_HTTP_TOKEN
What should we do to handle such a situation ?
A warning in readme is enough OR should we use another token dedicated for encrypting terraform state?

[jakubgs]

I think this is fine, since the Consul token history would still exist in infra-pass, so we can always recover older backups.

And overwriting existing ones with new ones encrypted with new token is also the correct behavior, so it's fine.

[siddarthkay]

I guess now this commit needs to be replicated over all infra-* repos