Mykhailo Marynenko

2 June

I think it's time we create a Fediverse but for Git repos.

Let's talk about Terraform/OpenTofu - the tools that promised to revolutionize infrastructure management but instead gave us a masterclass in why "declarative" doesn't mean "predictable." After 10+ years in the trenches, here are the real issues nobody talks about.

Sometimes the "best practice" is knowing when to ignore the best practices. The goal isn't perfect Infrastructure as Code. The goal is reliable infrastructure that your team can actually maintain, debug, and operate without losing sleep.

So before you write another Terraform module, ask yourself: "Does this actually need to be infrastructure as code, or am I just doing it because that's what we're supposed to do?" Your future self (and your on-call rotation) will thank you.

The Bottom Line: Terraform and OpenTofu aren't bad tools - they're just overused tools. The real problem isn't the software, it's the industry's obsession with making everything "Infrastructure as Code" even when it makes operations more complex and fragile.

Sometimes the most professional thing you can do is tell your team that not everything needs to be in Terraform. Sometimes a bash script is the right answer. Sometimes clicking through the console is perfectly fine for that one-off resource.

The Industry Reality Check: The dirty secret is that most successful infrastructure teams use Terraform for maybe 20% of their actual infrastructure management. The other 80% is handled by specialized tools, scripts, and yes, sometimes even manual processes where that makes more sense.

The companies with the most reliable infrastructure aren't the ones with the most comprehensive Terraform configurations. They're the ones that picked the right tool for each job and didn't try to force everything into a single "Infrastructure as Code" paradigm.

Embrace hybrid approaches. Use Terraform for the foundation, then use cloud-native tools for everything else. Don't force everything through one tool just for consistency's sake. Let each tool do what it does best.

Focus on operational reality. Optimize for debugging, not elegance. Prioritize clarity over cleverness. Plan for the 3 AM production incident when you're half-asleep trying to figure out why the apply failed. Document why you made decisions, not just what the code does.

Don't ignore blast radius. One monolithic Terraform state managing 500 resources across every environment is a ticking time bomb. Break it up by failure domains and operational boundaries, not by "logical separation" from some consultant's diagram.

The Sane Terraform Strategy: Start simple and stay simple. Write plain Terraform first. Add complexity only when you feel real pain, not because a blog post said you should. Test everything in disposable environments. Keep state files small and focused on related resources.

Don't DRY yourself to death. Some repetition is good! Copy-pasting 3 similar resources is often cleaner than building a complex loop with conditional logic that nobody can debug at 3 AM. If you can't understand your own code in 6 months, you've gone too far.

Don't Terraform all the things. Your application code doesn't belong in Terraform. Your monitoring dashboards don't belong in Terraform. Your team's lunch orders don't belong in Terraform. Keep it focused on actual infrastructure.

Frequent Changes - If it changes daily, weekly, or even monthly, it probably shouldn't be in Terraform. The overhead isn't worth it.

The Anti-Pattern Playbook: Stop over-modularizing everything. A simple aws_instance doesn't need to be wrapped in 3 layers of abstraction. Modules should solve real problems, not just follow "best practices" from blog posts.

Where you should stop fighting the tool: Application Deployments - Use proper deployment tools like Helm or Nomad. Terraform doesn't understand application lifecycles.

Configuration Management - Use Ansible, Salt, or good old bash scripts. Don't try to manage application configs through infrastructure tools. Secrets Management - Use dedicated secret stores, not Terraform state files. Your database passwords have no business being in a state file.

Stateful Resources - Databases, storage buckets, DNS zones. Things you absolutely need to recreate identically if disaster strikes. Foundation Layer - IAM roles, policies, networking backbone. The plumbing that everything else depends on.

Disaster Recovery scenarios - Resources you need to recreate identically in another region when everything goes sideways.

But Here's The Real Issue: We're Using It Wrong Most Terraform disasters happen because we've bought into the myth that everything must be "Infrastructure as Code." This is like using a hammer for every job because someone told you "everything is a nail."

Here's what Terraform/OpenTofu is actually good at: Core Infrastructure - VPCs, subnets, security groups, load balancers. The foundational stuff that changes rarely and has clear dependencies.

The Import Circus deserves special mention. Need to import existing infrastructure? Hope you enjoy playing "guess the exact configuration that matches your existing resource." Get one attribute wrong? Start over.

No autocomplete, no hints, just pure archaeological guesswork until you match whatever the provider thinks that resource should look like.

What we got was learning three different flavors of the same broken abstraction. My personal favorite error: "Provider produced inconsistent final plan." This is Terraform's way of saying "I have no idea what I'm doing, but it's definitely your fault.

" Hours of debugging later, you discover it's a known provider bug from 2019 that's still not fixed, but somehow it's your configuration that's wrong.

The gap between plan and reality is where careers go to die, and we've all learned to hold our breath during every apply.

Provider inconsistency is another nightmare. Each cloud provider implements Terraform differently. AWS provider works one way, Azure has its own special interpretation, GCP throws curveballs. "Multi-cloud" they promised. "Consistent experience" they said.

Your tfstate is simultaneously the most critical and most fragile part of your entire infrastructure. One corrupted state file and you're manually rebuilding production at 2 AM while explaining to executives why "Infrastructure as Code" just broke everything that was working fine.

Then there's the Plan vs Apply Russian Roulette. terraform plan cheerfully shows you'll create 5 resources. terraform apply somehow destroys half your infrastructure and creates 3 resources you never asked for.

techcrunch.comThreads is nearing X's daily app users, new data shows | TechCrunchThreads' mobile app for iOS and Android saw 115.1 million daily active users, representing 127.8% year-over-year growth.

19 July 2025

Threads is nearing X’s daily app users techcrunch.com/2025/07/07/...

18 July 2025

Ever seen music born from code? Livecoding is the underground revolution where performers write algorithms on stage, turning laptops into live instruments. No pre-recorded tracks – just real-time creation.

youtube.comAlgorave Generation | Resident AdvisorVisit the RA feature page: https://www.residentadvisor.net/features/3396In this film, we meet a community of artists who are harnessing algorithms to make li...

18 July 2025

"If music is a form of code, then perhaps code is a form of music." – www.youtube.com/watch?v=S2E...

18 July 2025

Yesterday, I attended DJ Dave's performance, she was using strudel.cc, and it was truly inspiring!

17 July 2025

Hot take: Comedy actors transitioning to drama often outshine traditional dramatic actors because they've mastered the hardest skill – making people feel something on command.

17 July 2025

Comedy requires split-second emotional precision. You need to build tension, create vulnerability, nail timing, and connect with your audience's deepest feelings, all while making it look effortless.

15 July 2025

0din.ai/blog/phishi...

14 July 2025

It's so easy to experience a crash or kernel panic in macOS/Darwin when working with native code. I've lost count of how many times this has happened today while handling a high I/O project.

14 July 2025

All three of my Macs have crashed, regardless of whether I'm using the beta or stable OS versions. In contrast, Linux has run flawlessly with the same codebase and similar syscalls.

14 July 2025

Feels like Linux is soon to become an actual OS for everything, and yeah, the Linux community has been yapping about their superiority for decades now. But in 2025, it's closer to reality than ever, yet still has a long way to go before becoming a reality.

11 July 2025

Me after adding one more language to the codebase that already has 8 of them.

8 July 2025

The web feels like Star Wars now. Cloudflare Workers compete with Vercel. Nuxt has been an amazing framework to run on Cloudflare Workers – one of the best, in fact. Then Vercel just buys them. 🤷‍♂️ x.com/nuxtlabs/st...

7 July 2025

I now have a local and isolated mirror of everything from my most-used cloud services. It feels great! Additionally, having a local cache and partial mirror for Docker, Nix, APT, Pacman, HuggingFace, npm, and Conda over a 10G LAN is amazing!

Everyone has their one favorite artist they listen to on repeat for years, for me one of them is Stanislav Tolkachev

Rooted in Detroit's foundational brutalism but filtered through Ukrainian melancholy, his compositions unfold like sonic archaeology. Each track reveals layers of psychedelic decay, atonal experiments that challenge your perception of what techno can be.

This isn't music designed for seamless DJ transitions. It's uncompromising art that demands contemplation - hypnotic rhythms that pull you into meditative states while aggressive textures keep you alert.

Everyone has their one favorite artist they listen to on repeat for years, for me one of them is Stanislav Tolkachev

youtube.comStanislav Tolkachev | Boiler Room x Cxema► Ukrainian Techno icon Stanislav Tolkachev back on BR with 50 mins of brute rhythmic force.► Subscribe to our YT channel: http://blrrm.tv/YT

I just revisited CXEMA x Boiler Room set and I'm still not over it. This man defines what real techno should sound like - raw, uncompromising, hypnotic. Delivering 50 minutes of pure sonic brutality that never gets old. www.youtube.com/watch?v=XhW...

What sets Tolkachev apart is his commitment to the imperfect, the organic chaos that emerges from modular synthesis. His sound breathes with the rawness of analog circuits pushed to their limits - jagged textures that feel carved from industrial concrete, yet somehow deeply emotional.

Happy 4th of July! 🇺🇸🦅