Terraform Setup

Where the modules live

In the platform repository under deployment/terraform/, one directory per cloud:

deployment/terraform/
├── aws/     main.tf, iam-trust/, tenants/
├── azure/   main.tf, iam-trust/
└── gcp/     main.tf, iam-trust/

Each cloud has two pieces:

Module	What it provisions
`<cloud>/`	Kubernetes cluster, managed Postgres, container registry, networking
`<cloud>/iam-trust/`	The cloud-side IAM trust so a SPIFFE identity can exchange for cloud credentials

aws/tenants/ additionally holds per-tenant IAM role mappings.

Using a module

Clone the repo and run Terraform against the directory for your cloud:

git clone https://github.com/hexrdev/hexr.git
cd hexr/deployment/terraform/gcp
terraform init
terraform plan

Or reference it as a module source from your own root configuration:

module "hexr_gcp" {
  source = "github.com/hexrdev/hexr//deployment/terraform/gcp"

  project_id   = "your-project"
  region       = "us-central1"
  zone         = "us-central1-a"
  environment  = "prod"

  domain       = "example.com"
  trust_domain = "agents.example.com"

  db_tier      = "db-custom-2-8192"
  db_password  = var.db_password   # do not hardcode
}

Note the // in the source URL — it is what selects a subdirectory of a repo.

domain and trust_domain are different values and must stay different. domain is where the dashboards and APIs are served. trust_domain is the SPIFFE trust domain that appears inside every SVID and every evidence row, and changing it invalidates existing identities. The GCP module’s own variable description says so: “SPIFFE trust domain (hexr.dev, NOT hexr.cloud)”.

Defaults are Hexr’s own, not yours

Every variable in the GCP module ships with a default pointing at Hexr’s production project:

project_id   default = "hexr-cloud-prod"
region       default = "us-central1"
domain       default = "hexr.cloud"
trust_domain default = "hexr.dev"
db_tier      default = "db-f1-micro"

Those exist because the modules provision Hexr’s own planes. Set every one of them explicitly for your deployment, or a terraform apply will attempt to build against Hexr’s project names. db_tier in particular defaults to db-f1-micro, which is a development instance and not a size to run a production evidence store on.

What Terraform does not do

It provisions infrastructure only. The Hexr runtime itself is installed with Helm afterwards — see Helm Install. Terraform gives you a cluster; Helm puts SPIRE, the evidence API, the credential injector and the rest of the plane into it.

Getting Started

Self-Hosted Deployment

Architecture

Security & Compliance

Terraform Setup

Where the modules live

Using a module

Defaults are Hexr’s own, not yours

What Terraform does not do

​Where the modules live

​Using a module

​Defaults are Hexr’s own, not yours

​What Terraform does not do

Where the modules live

Using a module

Defaults are Hexr’s own, not yours

What Terraform does not do