Terraform Infrastructure
Relevant source files
The following files were used as context for generating this wiki page:
Terraform Infrastructure manages the lifecycle of the Thoth project's cloud resources and repository settings. The system automates the provisioning of the GitHub repository and the deployment environment on Railway.
The infrastructure logic is organized within the infra/ directory, separated into provider-specific modules for GitHub and Railway. This separation ensures that repository governance, such as branch protection and security scanning, remains distinct from service hosting and environment variables.
Sources: README.md:6, infra/github/README.md:1, infra/railway/README.md:1
GitHub Repository Management
The GitHub module configures the central repository for the Thoth monorepo. It enforces security policies, manages branch protections, and synchronizes CI/CD variables.
Repository Configuration
The infrastructure defines a github_repository resource that disables unused features like projects and wikis while enabling specific merge strategies. It enforces squash merging to maintain a clean history.
Sources: infra/github/main.tf:1-19
Security and Maintenance
The configuration enables automated security features to protect the codebase.
- Secret Scanning: Scans for leaked credentials in the repository.
- Push Protection: Prevents commits containing secrets from being pushed.
- Vulnerability Alerts: Notifies owners of vulnerable dependencies.
- Dependabot: Automates security updates for dependencies.
Sources: infra/github/main.tf:22-38
Branch Protection and Rulesets
The main branch is protected by a set of requirements to ensure code quality.
This diagram shows the requirements enforced before a merge to the main branch can occur.
Sources: infra/github/main.tf:46-57
The infrastructure also activates a GitHub Actions ruleset for Copilot code reviews. This ruleset triggers reviews on every push to the default branch.
Sources: infra/github/main.tf:61-80
Railway Service Provisioning
The Railway module provisions the hosting environment for the project's runnable services. It connects the GitHub repository to Railway to enable automated deployments.
Deployment Workflow
You provision the Railway infrastructure by providing a RAILWAY_TOKEN and executing the Terraform lifecycle commands.
- Copy
terraform.tfvars.exampletoterraform.tfvars. - Set the required variables in the
.tfvarsfile. - Export the
RAILWAY_TOKENfor the provider. - Run
terraform initandterraform apply.
Sources: infra/railway/README.md:3-7
Configuration Summary
The following table summarizes the key infrastructure components managed by Terraform.
| Component | Provider | Purpose |
|---|---|---|
github_repository | GitHub | Configures visibility, merge rules, and features. |
github_branch_protection | GitHub | Enforces linear history and status checks on main. |
github_actions_variable | GitHub | Synchronizes CI variables from Terraform to GitHub. |
github_issue_label | GitHub | Provisions standardized size labels for PRs. |
| Railway Project | Railway | Hosts the apps/ services (API and Web). |
Sources: infra/github/main.tf:1-90, infra/railway/README.md:1
Tooling and Automation
The monorepo uses pnpm and lint-staged to ensure infrastructure files follow formatting standards.
- Formatting: The command
terraform fmt -write=trueautomatically formats.tfand.tfvarsfiles during the pre-commit stage. - Secrets Detection:
secretlintruns against all files to prevent infrastructure credentials from being committed.
Sources: package.json:34, package.json:51-52
The infrastructure interacts with the graphify tool, which can extract relationships from Terraform files to update the project's knowledge graph.
Sources: CLAUDE.md:21-25
The infrastructure provides the foundation for the Thoth monorepo by codifying security, governance, and deployment configurations. This ensures consistent environments across the GitHub repository and the Railway hosting platform.