phpboyscout IaC toolkit
Opinionated, reusable AWS OpenTofu / Terraform modules — account bootstrap, security baseline, KMS signing and encryption keys, and a CI runner fleet, each independently versioned and consumed straight from the GitLab Terraform Module Registry.
Every module publishes to gitlab.com/phpboyscout/<name>/aws and documents at aws-<name>.iac.phpboyscout.uk. The registry addresses modules by the top-level phpboyscout namespace, so a source = line never encodes the subgroup — pin once, and the address holds.
New here? These are written up end to end, in the order they make sense: Infrastructure with AWS and OpenTofu
Modules
terraform-aws-bootstrap
Minimal, opinionated AWS account bootstrap — the OpenTofu state backend (S3 + lock), a GitLab-OIDC automation role, and an aws-nuke config for disposable accounts. The one module you run first, before any other state exists.
terraform-aws-encryption-kms
The AWS half of an OpenPGP identity that can receive encrypted mail — a KMS certification primary plus an ECDH encryption subkey, so a published contact address can hold its private key in KMS. Splits decrypting from re-certifying into separate roles, and grants no CI pipeline either. The counterpart to signing-kms, which can only ever sign.
terraform-aws-gitlab-runner-fleet
A GitLab Runner fleeting fleet on AWS: one always-on manager plus scale-to-zero spot workers, on the docker-autoscaler executor. Built to replace cattle-ops/gitlab-runner and expose the levers it hid — spot allocation strategy, worker disk size, an EFS/S3 cache layer, and no plan-time Lambda, so CI can plan and apply.
terraform-aws-security-baseline
Opinionated AWS security baseline — account hardening, audit logging, AWS Config, threat detection, alerting, and an MFA-required operator role. The controls every account should carry, as one module.
terraform-aws-signing-kms
An AWS KMS asymmetric signing key plus a GitLab-OIDC signer role — the cloud half of a release-binary signing chain, so a pipeline can sign without a long-lived key ever leaving KMS.
How the registry addresses these
The GitLab Terraform Module Registry keys a module on the top-level namespace — phpboyscout — plus its name and system (aws), never the project path or subgroup. So these modules living under iac/ changes nothing for a consumer: source = "gitlab.com/phpboyscout/bootstrap/aws" resolves exactly as before. Pin a version with version = "…" against the registry.