Infrastructure as code

The Cloudflare data plane is provisioned by Terraform (infra/terraform). One terraform apply creates every resource the Worker binds to, and the whole config is parameterized so the same code stands up EstimateIQ on any Cloudflare account or environment.

What Terraform provisions

Resource	Binding	Purpose
D1 database	DB	Append-only event/audit mirror for cross-instance reporting.
KV namespace	CACHE	Semantic-search result cache + last-reindex marker.
R2 bucket	ARTIFACTS	AI briefs, .eml correspondence, Xactimate .pdf / .esx.
Queues ×2	MAIL_INGEST	Inbound carrier-mail ingest + a dead-letter queue.
Vectorize index	VECTORIZE	Semantic search over estimate content (estimateiq-notes, 768-dim).

What Terraform does NOT do

The Worker code, the Durable Objects (created by the Worker’s v1 migration on first wrangler deploy), Workflows, Workers AI, the AI Gateway, and the esb.guru custom domain are shipped by wrangler deploy — not Terraform. Secrets stay out of state; set them with wrangler secret put.

Apply anywhere

Everything is parameterized by name_prefix and account_id, so switching environments is just a change of tfvars — resource names, ids, and outputs follow the prefix:

cd infra/terraform
export TF_VAR_cloudflare_api_token=cfat_...     # D1/KV/R2/Queues/Vectorize edit
cp terraform.tfvars.example terraform.tfvars    # set account_id + name_prefix
terraform init
terraform apply                                 # provisions the data plane
terraform output bindings                       # ids to feed into wrangler.jsonc

Set name_prefix to estimateiq-staging (or a customer name) and point account_id at another account, and the identical config provisions a fully isolated stack there. terraform destroy tears an environment down.

Adopt existing resources (imported)

The live estimateiq resources already exist, so they were imported into state rather than recreated. make import adopts the current D1, KV, R2, Queues, and Vectorize resources by id so Terraform manages them without duplicating anything.

From apply to running app

1. terraform apply — provision D1 / KV / R2 / Queues / Vectorize.
2. Feed the outputs into cloudflare/wrangler.jsonc (ids for each binding).
3. wrangler deploy — ship the Worker, create the Durable Objects, attach the domain.
4. bun run load — populate the empty DO via the API (see Data loading).
5. POST /api/admin/reindex — build the search index.

The Terraform Makefile wraps these (init / plan / apply / import / deploy / load), so one workflow can provision the infrastructure and load the data on any account.