chore: migrate terraform modules to CC008

.github/workflows/generate_terraform_docs.yaml

@@ -0,0 +1,30 @@
+# Copyright 2026 Canonical Ltd.
+# See LICENSE file for licensing details.
+
+name: Update Terraform documentation
+
+# Keep the `paths` filters below and the `terraform-directory` input in sync with
+# the directories where the Terraform modules live.
+on:
+  pull_request:
+    paths:
+      - "terraform/**"
+      - ".github/workflows/generate_terraform_docs.yaml"
+  push:
+    branches:
+      - main
+    paths:
+      - "terraform/**"
+      - ".github/workflows/generate_terraform_docs.yaml"
+
+permissions:
+  contents: write
+  pull-requests: write
+
+jobs:
+  terraform-docs:
+    name: Update Terraform documentation
+    uses: canonical/operator-workflows/.github/workflows/generate_terraform_docs.yaml@030c5b20a0bb880dcf1ed326bff0fc16b6eb6ac1  # main
+    secrets: inherit
+    with:
+      terraform-directory: terraform/charm

.github/workflows/terraform_modules_compliance.yaml

@@ -0,0 +1,17 @@
+# Copyright 2026 Canonical Ltd.
+# See LICENSE file for licensing details.
+
+name: Terraform modules compliance
+
+on:
+  workflow_dispatch:
+  pull_request:
+    paths:
+      - "**/terraform/**"
+      - ".github/workflows/terraform_modules_compliance.yaml"
+
+jobs:
+  terraform-compliance:
+    uses: canonical/operator-workflows/.github/workflows/terraform_modules_compliance.yaml@030c5b20a0bb880dcf1ed326bff0fc16b6eb6ac1  # main
+    with:
+      terraform-directories: '["terraform/charm"]'

.github/workflows/terraform_modules_release.yaml

@@ -0,0 +1,23 @@
+# Copyright 2026 Canonical Ltd.
+# See LICENSE file for licensing details.
+
+name: Terraform modules release
+
+on:
+  workflow_dispatch:
+  pull_request:
+    paths:
+      - "terraform/**"
+      - ".github/workflows/terraform_modules_release.yaml"
+  push:
+    branches:
+      - main
+    paths:
+      - "terraform/**"
+      - ".github/workflows/terraform_modules_release.yaml"
+
+jobs:
+  terraform-release:
+    uses: canonical/operator-workflows/.github/workflows/terraform_modules_release.yaml@030c5b20a0bb880dcf1ed326bff0fc16b6eb6ac1  # main
+    permissions:
+      contents: write

.github/workflows/test_terraform_modules.yaml

@@ -0,0 +1,20 @@
+# Copyright 2026 Canonical Ltd.
+# See LICENSE file for licensing details.
+
+name: Terraform modules tests
+
+on:
+  workflow_dispatch:
+  pull_request:
+    paths:
+      - "**/terraform/**"
+      - ".github/workflows/test_terraform_modules.yaml"
+
+jobs:
+  terraform-tests-lxd:
+    uses: canonical/operator-workflows/.github/workflows/terraform_modules_test.yaml@030c5b20a0bb880dcf1ed326bff0fc16b6eb6ac1  # main
+    secrets: inherit
+    with:
+      k8s-controller: false
+      lxd-controller: true
+      terraform-directories: '["terraform/charm"]'

.gitignore

@@ -11,7 +11,9 @@ __pycache__/
 .mypy_cache
 *.egg-info/
 */*.rock
-terraform/tests/.terraform
+terraform/charm/tests/.terraform
+**/.terraform/
+**/.terraform.lock.hcl
 
 # BEGIN VALE WORKFLOW IGNORE
 .vale/styles/*

.licenserc.yaml

@@ -19,6 +19,7 @@ header:
   - '.jujuignore'
   - '.gitignore'
   - '.licenserc.yaml'
+  - '**/MAJOR_VERSION'
   - 'CODEOWNERS'
   - 'LICENSE'
   - 'trivy.yaml'

docs/changelog.md

@@ -13,6 +13,14 @@ Place any unreleased changes here, that are subject to release in coming version
 - Added support for base ubuntu@26.04. Aproxy now supports 20.04, 22.04, 24.04, and 26.04.
 - Load the netfilter kernel modules required by the nftables rules before applying them.
 - Organize the documentation home page by user needs and explain its structure.
+- Migrated the Terraform module to the CC008 Charm Terraform Standard and moved it from `terraform/` to
+  `terraform/charm/`: renamed `versions.tf` to
+  `terraform.tf`, added the mandatory `constraints` variable and the `application`/`provides`/`requires`
+  outputs (replacing the deprecated `app_name` and `endpoints` outputs), added a `terraform/MAJOR_VERSION`
+  file, and wired the `terraform_modules_compliance`, `terraform_modules_release` and
+  `generate_terraform_docs` CI workflows. Note that the `base` variable now defaults to `null` (the
+  charm's default base) instead of `ubuntu@24.04`; pass `base = "ubuntu@24.04"` explicitly to keep the
+  previous default.
 
 # 2026-05-19
 - Add `aproxy-port` charm configuration to allow customizing the port that aproxy listens on.

terraform/MAJOR_VERSION

@@ -0,0 +1 @@
+1

terraform/charm/MAJOR_VERSION

@@ -0,0 +1 @@
+../MAJOR_VERSION

terraform/README.md → terraform/charm/README.md

@@ -10,25 +10,26 @@ deployment onto any Kubernetes environment managed by [Juju][Juju].
 - **main.tf** - Defines the Juju application to be deployed.
 - **variables.tf** - Allows customization of the deployment. Also models the charm configuration, 
   except for exposing the deployment options (Juju model name, channel or application name).
-- **output.tf** - Integrates the module with other Terraform modules, primarily
+- **outputs.tf** - Integrates the module with other Terraform modules, primarily
   by defining potential integration endpoints (charm integrations), but also by exposing
-  the Juju application name.
-- **versions.tf** - Defines the Terraform provider version.
+  the deployed Juju application.
+- **terraform.tf** - Defines the Terraform and Juju provider versions.
 
 ## Using aproxy base module in higher level modules
 
 If you want to use `aproxy` base module as part of your Terraform module, import it
-like shown below:
+like shown below. Always pin the `?ref=` to a released tag or a commit hash: CC008 does
+not allow floating references such as branches.
 
 ```text
 data "juju_model" "my_model" {
   name = var.model
 }
 
 module "aproxy" {
-  source = "git::https://github.com/canonical/aproxy-operator//terraform"
-  
-  model = juju_model.my_model.name
+  source = "git::https://github.com/canonical/aproxy-operator//terraform/charm?ref=tf-1.0.0"
+
+  model_uuid = data.juju_model.my_model.uuid
   # (Customize configuration variables here if needed)
 }
 ```
@@ -37,10 +38,10 @@ Create integrations, for instance:
 
 ```text
 resource "juju_integration" "aproxy_to_principal" {
-  model = juju_model.my_model.name
+  model_uuid = data.juju_model.my_model.uuid
   application {
-    name     = module.aproxy.app_name
-    endpoint = module.aproxy.endpoints.juju_info
+    name     = module.aproxy.application.name
+    endpoint = module.aproxy.requires.juju_info.endpoint
   }
   application {
     name     = "principal-app"
@@ -51,7 +52,13 @@ resource "juju_integration" "aproxy_to_principal" {
 
 The complete list of available integrations can be found [in the Integrations tab][aproxy-integrations].
 
+<!-- The following section is auto-generated by terraform-docs. Do not edit it manually. -->
+<!-- vale off -->
+<!-- BEGIN_TF_DOCS -->
+<!-- END_TF_DOCS -->
+<!-- vale on -->
+
 [Terraform]: https://www.terraform.io/
 [Terraform Juju provider]: https://registry.terraform.io/providers/juju/juju/latest
-[Juju]: https://juju.is
+[Juju]: https://canonical.com/juju
 [aproxy-integrations]: https://charmhub.io/aproxy/integrations

terraform/main.tf → terraform/charm/main.tf

@@ -10,7 +10,8 @@ resource "juju_application" "aproxy" {
     base     = var.base
   }
 
-  model_uuid = var.model_uuid
-  config     = var.config
-  units      = 1
+  model_uuid  = var.model_uuid
+  config      = var.config
+  constraints = var.constraints
+  units       = 1
 }

terraform/charm/outputs.tf

@@ -0,0 +1,23 @@
+# Copyright 2025 Canonical Ltd.
+# See LICENSE file for licensing details.
+
+output "application" {
+  description = "The deployed application object."
+  value       = juju_application.aproxy
+}
+
+output "provides" {
+  description = "Map of the provided integration endpoints."
+  value       = {}
+}
+
+output "requires" {
+  description = "Map of the required integration endpoints."
+  value = {
+    juju_info = {
+      kind     = "endpoint"
+      name     = juju_application.aproxy.name
+      endpoint = "juju-info"
+    }
+  }
+}

terraform/versions.tf → terraform/charm/terraform.tf

@@ -2,10 +2,12 @@
 # See LICENSE file for licensing details.
 
 terraform {
+  required_version = "~> 1.12"
+
   required_providers {
     juju = {
       source  = "juju/juju"
-      version = "> 1.1.0"
+      version = "~> 1.0"
     }
   }
 }

terraform/charm/tests/main.tftest.hcl

@@ -0,0 +1,28 @@
+# Copyright 2026 Canonical Ltd.
+# See LICENSE file for licensing details.
+
+run "setup_tests" {
+  module {
+    source = "./tests/setup"
+  }
+}
+
+run "basic_deploy" {
+  variables {
+    model_uuid = run.setup_tests.model_uuid
+    base       = "ubuntu@24.04"
+    channel    = "latest/edge"
+    # renovate: depName="aproxy"
+    revision = 303
+  }
+
+  assert {
+    condition     = output.application.name == "aproxy"
+    error_message = "aproxy application name did not match expected"
+  }
+
+  assert {
+    condition     = output.requires.juju_info.endpoint == "juju-info"
+    error_message = "aproxy module should provide 'requires.juju_info' output"
+  }
+}

terraform/tests/setup/main.tf → terraform/charm/tests/setup/main.tf

@@ -1,20 +1,20 @@
-# Copyright 2025 Canonical Ltd.
+# Copyright 2026 Canonical Ltd.
 # See LICENSE file for licensing details.
 
 terraform {
-  required_version = ">= 1.0"
+  required_version = "~> 1.12"
   required_providers {
     juju = {
-      version = "> 1.1.0"
       source  = "juju/juju"
+      version = "~> 1.0"
     }
   }
 }
 
 provider "juju" {}
 
 resource "juju_model" "test_model" {
-  name = "tf-testing-aproxy"
+  name = "tf-testing-${formatdate("YYYYMMDDhhmmss", timestamp())}"
 }
 
 output "model_uuid" {

terraform/variables.tf → terraform/charm/variables.tf

@@ -5,18 +5,20 @@ variable "app_name" {
   description = "Application name for aproxy."
   type        = string
   default     = "aproxy"
+  nullable    = false
 }
 
 variable "base" {
   description = "The operating system on which to deploy"
   type        = string
-  default     = "ubuntu@24.04"
+  default     = null
 }
 
 variable "channel" {
   description = "The channel to use when deploying a charm."
   type        = string
   default     = "latest/stable"
+  nullable    = false
 }
 
 variable "config" {
@@ -25,9 +27,16 @@ variable "config" {
   default     = {}
 }
 
+variable "constraints" {
+  description = "Juju constraints to apply for this application."
+  type        = string
+  default     = null
+}
+
 variable "model_uuid" {
   description = "UUID of the Juju model where the application will be deployed."
   type        = string
+  nullable    = false
 }
 
 variable "revision" {