Migrate state

infra/railway/main.tf

@@ -4,7 +4,7 @@
 #
 # Terraform makes the project, the service and the domains, and puts their
 # records on Cloudflare. It never deploys: deploy.sh uploads the site with
-# Railway's CLI. State is local (terraform.tfstate here, gitignored).
+# Railway's CLI. State is in the tfstate bucket on Railway (infra/README.md).
 
 terraform {
   required_version = ">= 1.10"
@@ -12,6 +12,21 @@ terraform {
     railway    = { source = "terraform-community-providers/railway", version = "~> 0.6.2" }
     cloudflare = { source = "cloudflare/cloudflare", version = "~> 5.25" }
   }
+
+  # The tfstate project's bucket on Railway, which holds every project's state
+  # under its own key. S3-compatible, not AWS: hence the skips. Its keys come
+  # from TFSTATE_* in .env (compose.yaml passes them as AWS_*).
+  backend "s3" {
+    bucket                      = "tfstate-9p20m8qvmqf8gqk-z"
+    key                         = "bible/terraform.tfstate"
+    region                      = "auto"
+    endpoints                   = { s3 = "https://t3.storageapi.dev" }
+    use_lockfile                = true
+    skip_credentials_validation = true
+    skip_region_validation      = true
+    skip_requesting_account_id  = true
+    skip_metadata_api_check     = true
+  }
 }
 
 # Reads RAILWAY_TOKEN (compose.yaml sets it from RAILWAY_API_TOKEN in .env):