Managing infrastructure can be daunting, especially when changes are frequent and involve multiple team members. OpenTofu is a powerful open-source Infrastructure as Code (IaC) solution that can be used to automate infrastructure management. Combined with Git, you can track, manage, and collaborate on infrastructure configurations just like software code. This post will cover how to set up and manage infrastructure collaboratively using OpenTofu and Git.

What is Version-Controlled Infrastructure?

Version-controlled infrastructure means storing and managing your infrastructure configuration files (IaC) in a version-control system like Git. It provides:

• Auditability: Track who made changes, when, and why.
• Reproducibility: Roll back to a previous version if something breaks.
• Collaboration: Allow multiple team members to contribute safely.

Why Use OpenTofu with Git?

OpenTofu is an open-source Terraform fork to help provision infrastructure across cloud providers like AWS, Azure, and GCP using declarative configuration files. When combined with Git:

• You store your OpenTofu files in a Git repository.
• Changes are reviewed via pull requests before applying them.
• You can create branches for testing configurations safely.

Step-by-Step Guide

Let’s deploy a simple AWS EC2 instance managed by OpenTofu, with all configurations tracked in Git.

Prerequisites

Before starting, ensure you have:

• AWS Account with an access key and secret key.
• AWS CLI installed
• OpenTofu installed
• Git installed
• Text Editor/IDE: For editing files (e.g., VSCode).

Initialize your Git repository

1. Create a project directory.

mkdir my-infra
cd my-infra

2. Initialize Git.

git init

3. Create a .gitignore file and add some OpenTofu-specific files to it to avoid pushing sensitive information to git repository.

echo ".terraform/" >> .gitignore
echo "terraform.tfstate*" >> .gitignore

4. Commit the .gitignore file.

git add .gitignore
git commit -m "Add .gitignore file"

Write OpenTofu configuration

1. Create a main.tf file to describe the infrastructure (an EC2 instance in AWS).

terraform {
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 5.0"
    }
  }
}

provider "aws" {
  region = "ap-southeast-1"
}

resource "aws_instance" "example" {
  ami           = "ami-0c02fb55956c7d316" # Amazon Linux 2 AMI
  instance_type = "t2.micro"
  tags = {
    Name = "OpenTofuManagedInstance"
  }
}

2. Create a variables.tf file to define variables for re-usability.

variable "aws_region" {
  default = "ap-southeast-1"
}

3. Create an outputs.tf file to display useful information like the public IP of the EC2 instance.

output "instance_ip" {
  value = aws_instance.example.public_ip
}

Initialize and Test OpenTofu

1. Run the following command to download necessary providers and initialize OpenTofu.

tofu init

2. Next, plan the infrastructure and preview the changes OpenTofu will make.

tofu plan

3. Now, deploy the infrastructure.

tofu apply

4. Once completed, OpenTofu will display the public IP address of the EC2 instance. You can SSH into it.

ssh ec2-user@<instance_ip>

Commit your configuration to Git

1. Now you can stage and commit your configuration files.

git add main.tf variables.tf outputs.tf
git commit -m "Add OpenTofu configuration for AWS EC2 instance"

If you want to collaborate with other admins, it is importrant to use meaningful commit messages describing what changed and why.

2. [Optional] Create a remote repository and push your project.

git remote add origin https://github.com/your-username/my-infra.git
git branch -M main
git push -u origin main

Best Practices

• Use meaningful commit messages to help others understand what changed and why.
• Keep your stable code in the master or main branch, and do the testing in feature branches.
• Never commit sensitive files (e.g., .tfstate) to avoid leaking secrets.
• Always use tools like AWS Secrets Manager or HashiCorp Vault for storing and managing secrets.
• Integrate Git with CI/CD tools like GitHub Actions or GitLab Pipelines to validate OpenTofu configurations on pull requests.

Wrap Up

By combining OpenTofu and Git, you’ve taken a major step toward automating and simplifying infrastructure management. This approach ensures that every change is tracked, reviewed, and can be rolled back if needed, making infrastructure deployment safer and more reliable. Now that you have a version-controlled infrastructure setup, you can expand it by automating more resources or integrating CI/CD for smoother workflows. Stay tuned for more beginner-friendly automation guides.