Infrastructure as code: why describe your servers in Terraform

Infrastructure as Code (IaC) means describing servers, networks, databases, DNS and access rules in text files and having a tool create them automatically instead of configuring them by hand in a provider's console. Infrastructure becomes reproducible, reviewable and recoverable after a disaster. The most widely used tool is Terraform and its open-source fork OpenTofu.

Here is which problems IaC solves, how Terraform works, how to store state and secrets and where to start.

Which problems does infrastructure as code solve?

Manual configuration through web consoles scales badly: nobody remembers exactly which settings were made and why, environments drift apart, and recreating everything after a disaster or for a new customer turns into a week of work.

What IaC gives you:

• reproducibility — the test environment is an exact copy of production;
• change history — every change is visible in the repository: who, when and why;
• review — infrastructure changes are checked like ordinary code;
• recovery — after a disaster infrastructure comes back with a command, not from memory;
• documentation — the code is the up-to-date description of what is deployed.

How does Terraform work?

In Terraform you describe the desired state: which resources should exist and with which parameters. The tool compares the description with reality, shows a plan of changes and, once approved, creates, modifies or deletes resources through the provider's API.

resource "yandex_compute_instance" "app" {
  name        = "app-1"
  platform_id = "standard-v3"

  resources {
    cores  = 2
    memory = 4
  }

  boot_disk {
    initialize_params {
      image_id = var.ubuntu_image_id
      size     = 30
    }
  }

  network_interface {
    subnet_id = yandex_vpc_subnet.main.id
    nat       = true
  }
}

The core loop:

1. Change the description in code.
2. Run plan and see exactly what will change.
3. Get it reviewed together with the plan.
4. Run apply — preferably from CI, not from a laptop.

More on pipelines in CI/CD with GitHub Actions.

Photo: Unsplash

How do you store state and secrets?

Terraform keeps a state file — the mapping between code and real resources. It must not live on a laptop or in the repository: state goes in remote storage with locking, so two people cannot apply changes at once, and with encryption, because it may contain secrets.

What	Where to store	Why
Infrastructure code	A Git repository	History and review
State	Object storage with locking	Shared access, protection from concurrent changes
Secrets	A secrets manager or CI variables	Kept out of code and history
Environment variables	Separate files or workspaces	Test and production kept apart

More on secrets in secrets management.

How do you organise infrastructure code?

Organise it like ordinary code: repeated parts become modules, environments are separated and changes go through review. Separate state is important, so a mistake in the test environment cannot touch production.

• modules for repeated blocks: network, database cluster, application server;
• separate directories or workspaces for test and production;
• pinned versions of providers and modules;
• an automatic plan on every pull request;
• no manual console changes for resources described in code.

Where should a small team start?

A small team does not need to describe everything at once. Start with resources that are hardest to recreate by hand and change most often: DNS, networks, the database, object storage and application servers. The rest can move over gradually.

1. Describe a new test environment in code — a safer place to learn.
2. Import existing production resources one at a time.
3. Set up remote state with locking.
4. Add plan to CI and apply changes only through the pipeline.
5. Use Docker or Ansible to configure the servers themselves — see Docker for development and production.

On choosing between the cloud and your own servers, see VPS, cloud or managed services.

In short

• IaC describes infrastructure in code rather than manual console settings.
• It brings reproducibility, history, review and fast recovery.
• Terraform compares the description with reality and applies changes from a plan.
• State is stored remotely with locking and encryption; secrets are kept separately.
• Start with a test environment and the most critical resources.