Migrate state

infra/README.md

@@ -32,8 +32,9 @@ Commit `.terraform.lock.hcl`; it pins the provider builds.
 ## First-time setup
 
 1. **Tokens.** A Railway workspace token (account settings -> Tokens, with the
-   workspace selected; a project token cannot make projects) and the
-   Cloudflare token. `cp .env.example .env` and fill both in.
+   workspace selected; a project token cannot make projects), the Cloudflare
+   token, and the state bucket's keys (below). `cp .env.example .env` and fill
+   them in.
 
 2. **Project and domains.**
    ```
@@ -63,12 +64,30 @@ config-as-code (healthchecks, start commands); Railway's defaults do.
 
 ## State
 
-Local: `infra/railway/terraform.tfstate`, gitignored. Back it up. If it is
-lost, nothing on Railway goes away; `terraform import` each resource back
-(IDs from the dashboard URLs; the Cloudflare records as `<zone_id>/<id>`).
+In a bucket on Railway: project `tfstate`, bucket `tfstate` (S3 name
+`tfstate-9p20m8qvmqf8gqk-z`, endpoint `https://t3.storageapi.dev`, US East).
+Every project keeps its state there under its own key, `<project>/terraform.tfstate`,
+with Terraform's lock file next to it. The bucket's keys are `TFSTATE_*` in
+`.env`; compose passes them to Terraform as `AWS_*`, the names the S3 backend
+reads.
+
+The bucket is made outside Terraform, once: the provider has no bucket
+resource, and a bucket cannot hold the state that creates it. It was made
+through the API, since the CLI refuses a workspace token for `init`/`link`:
+`projectCreate`, then `bucketCreate`, then `environmentPatchCommit` with
+`{buckets: {<id>: {region: "iad", isCreated: true}}}`.
+
+A new project's stack copies the `backend "s3"` block from
+`railway/main.tf` with a new `key`.
+
+If the state is ever lost, nothing on Railway goes away; `terraform import`
+each resource back (IDs from the dashboard URLs; the Cloudflare records as
+`<zone_id>/<id>`).
 
 ## Cost
 
+The state bucket is $0.015 per GB-month: nothing, at a few KB.
+
 Hobby plan: $5 a month, which includes $5 of usage. The service idles at a
 few tens of MB and next to no CPU in each environment ($10 per GB-month of
 memory, $20 per vCPU-month), so both fit in the included usage. Egress is