Update software versions and add CLAUDE.md

- Replace deprecated hashicorp/terraform-github-actions with setup-terraform@v3
- Upgrade actions/checkout@master to @v6
- Upgrade Terraform CLI 1.13.4 to 1.14.5
- Upgrade AWS provider 5.82.2 to 6.32.1
- Add CLAUDE.md for Claude Code guidance

Author: combor

.github/workflows/terraform.yml

@@ -8,66 +8,31 @@ jobs:
   terraform-actions:
     name: workflow
     runs-on: ubuntu-latest
+    env:
+      AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
+      AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
+      TF_VAR_ssh_authorized_key: ${{ secrets.TF_VAR_SSH_AUTHORIZED_KEY }}
+      TF_VAR_acme_email: ${{ secrets.TF_VAR_ACME_EMAIL }}
     steps:
     - name: Checkout Repo
-      uses: actions/checkout@master
+      uses: actions/checkout@v6
 
-    - name: format
-      uses: hashicorp/terraform-github-actions@master
+    - name: Setup Terraform
+      uses: hashicorp/setup-terraform@v3
       with:
-        tf_actions_version: 1.13.4
-        tf_actions_subcommand: 'fmt'
-        tf_actions_working_dir: '.'
-        tf_actions_comment: true
-      env:
-        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        terraform_version: 1.14.5
+
+    - name: format
+      run: terraform fmt -check
 
     - name: init
-      uses: hashicorp/terraform-github-actions@master
-      with:
-        tf_actions_version: 1.13.4
-        tf_actions_subcommand: 'init'
-        tf_actions_working_dir: '.'
-        tf_actions_comment: true
-      env:
-        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
-        AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
+      run: terraform init
 
     - name: validate
-      uses: hashicorp/terraform-github-actions@master
-      with:
-        tf_actions_version: 1.13.4
-        tf_actions_subcommand: 'validate'
-        tf_actions_working_dir: '.'
-        tf_actions_comment: true
-      env:
-        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+      run: terraform validate
 
     - name: plan
-      uses: hashicorp/terraform-github-actions@master
-      with:
-        tf_actions_version: 1.13.4
-        tf_actions_subcommand: 'plan'
-        tf_actions_working_dir: '.'
-        tf_actions_comment: true
-      env:
-        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
-        AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
-        TF_VAR_ssh_authorized_key: ${{ secrets.TF_VAR_SSH_AUTHORIZED_KEY }}
-        TF_VAR_acme_email: ${{ secrets.TF_VAR_ACME_EMAIL }}
+      run: terraform plan
 
     - name: apply
-      uses: hashicorp/terraform-github-actions@master
-      with:
-        tf_actions_version: 1.13.4
-        tf_actions_subcommand: 'apply'
-        tf_actions_working_dir: '.'
-        tf_actions_comment: true
-      env:
-        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
-        AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
-        TF_VAR_ssh_authorized_key: ${{ secrets.TF_VAR_SSH_AUTHORIZED_KEY }}
-        TF_VAR_acme_email: ${{ secrets.TF_VAR_ACME_EMAIL }}
+      run: terraform apply -auto-approve

.terraform.lock.hcl

@@ -0,0 +1,36 @@
+# CLAUDE.md
+
+This file provides guidance to Claude Code (claude.ai/code) when working with code in this repository.
+
+## Overview
+
+Personal AWS infrastructure managed with Terraform. Single-environment deployment in eu-west-2 managing Route53 DNS and IAM for the `kombor.ski` domain.
+
+## Commands
+
+```bash
+terraform init          # Initialize (S3 backend)
+terraform fmt           # Format code
+terraform validate      # Validate syntax
+terraform plan          # Preview changes
+terraform apply         # Deploy to AWS
+```
+
+CI (GitHub Actions on push to main) runs: fmt → init → validate → plan → apply.
+
+## Architecture
+
+Flat Terraform layout, no modules or workspaces — all resources in root:
+
+- **dns.tf** — Route53 hosted zone and DNS records for kombor.ski (internal services point to 172.31.255.3, external services via CNAMEs)
+- **users.tf** — IAM robot user for Traefik with scoped Route53 permissions (LetsEncrypt ACME DNS challenges)
+- **backend.tf** — S3 remote state (`infrastructure-tf-state` bucket)
+- **providers.tf** — AWS provider config
+- **variables.tf** — Input variables (`aws_region`)
+
+## Key Details
+
+- Terraform version: 1.13.4+ (pinned in CI)
+- AWS provider version pinned via `.terraform.lock.hcl` (committed)
+- Secrets (AWS creds, `TF_VAR_SSH_AUTHORIZED_KEY`, `TF_VAR_ACME_EMAIL`) are in GitHub Actions secrets, never in code
+- Dependabot updates Terraform providers and GitHub Actions daily