DigitalOcean

Provision DigitalOcean with Terraform; inspect it with doctl. The API is small and predictable, which makes the gaps the expensive part: Spaces-backed state has no locking, doctl does not manage buckets, and a firewall written against an IP breaks the day the IP moves.

Pair this with senior-devops for apply discipline, and with terraform-style-guide for HCL conventions.

When to use

• Writing or reviewing Terraform for DigitalOcean resources.
• Storing Terraform state in Spaces.
• Taking inventory of an account, or reconciling code against what the account actually holds.
• Operating Droplets, managed databases, DOCR, or Spaces day to day.

Ground rules

• Private network by default. Put every Droplet and managed database in a VPC and connect over private hostnames; the public database URI is a fallback, not the design.
• Reference resources by ID, not address. Firewall rules take source_droplet_ids; database firewalls take type = "droplet". A /32 breaks the day a Droplet is rebuilt.
• Attach everything to a DO Project (digitalocean_project_resources), or it disappears from the account view your teammates use.
• Region is a hard boundary. VPCs, Droplets, databases, and Spaces buckets must share the region you standardized on; a cross-region private connection does not exist.