Terraform and OpenTofu for reproducible labs

The plan is a review boundary

Terraform and OpenTofu turn infrastructure intent into a declarative artifact. A plan lets the team review resources, dependencies, and changes before touching a provider; if the team cannot explain the plan, it is not ready to apply it.

State requires an operating contract

State relates configuration to real resources. It may be local and ephemeral for a personal lab; collaboration requires a remote backend, locking, encryption, and an explicit access policy. State is never an innocent file or something to edit by hand as routine work.

• Pin CLI and provider versions before execution.
• Keep secrets, credentials, and state out of the repository.
• Preserve the plan, outputs, and teardown evidence when a lab creates resources.

A lab ends when it destroys

A reproducible cycle includes preflight, fmt, validate, plan, controlled apply, checks, and destroy. Teardown is not an appendix: it proves that the experiment has bounded cost, permissions, and time.