State and plan encryption support
I wonder if it makes sense if the component templates and gitlab-tofu would inject a TF_ENCRYPTION setup (docs here), like this:
TF_ENCRYPTION=$(cat <<EOF
key_provider "some_key_provider" "some_name" {
# Key provider options here
}
method "some_method" "some_method_name" {
# Method options here
keys = key_provider.some_key_provider.some_name
}
state {
# Encryption/decryption for state data
method = method.some_method.some_method_name
}
plan {
# Encryption/decryption for plan data
method = method.some_method.some_method_name
}
EOF)
The downside of this is that if someone wants to use the code locally they would have to configure this themselves. The question here is if that really is a good use case. Maybe they can just use gitlab-tofu locally in those scenarios