Appendix: Tear down the deployment

Destroying these resources is irreversible. The keyshares and the databases go with them.

Destroy the modules in the reverse of the order you applied them. backend reads the network and service account details from bootstrap-backend's state, and OpenTofu cannot see that dependency, so the order is yours to get right.

1. Destroy the services

tofu -chdir=deploy/gcp/tf/backend destroy -var-file=../global.tfvars

This removes the VMs and, if you enabled it, the dashboard.

2. Destroy the backend resources

2.1 Run the destroy

tofu -chdir=deploy/gcp/tf/bootstrap-backend destroy -var-file=../global.tfvars

This stops at the Cloud SQL instance, which is expected:

Error: Error, failed to delete instance because deletion_protection is set to true

2.2 Delete the database instance

gcloud sql instances delete PREFIX-postgres --project=BACKEND_PROJECT_ID

2.3 Run the destroy again

tofu -chdir=deploy/gcp/tf/bootstrap-backend destroy -var-file=../global.tfvars

If you deployed the policy engine, this stops again, this time on the subnet:

Error 400: The subnetwork resource 'PREFIX-subnet' is already being used by
'.../addresses/serverless-ipv4-<id>', resourceInUseByAnotherResource

The dashboard's Direct VPC egress reserved a /28 in the subnet. It cannot be deleted by hand. Cloud Run releases it once the service is gone, usually within the hour. Check whether it is still held:

gcloud compute addresses list --project=BACKEND_PROJECT_ID --filter="purpose=SERVERLESS"

Once it reports Listed 0 items., run the destroy again.

3. Destroy the Secret Guardian resources

tofu -chdir=deploy/gcp/tf/bootstrap-secret-guardian destroy -var-file=../global.tfvars

Destroying this module removes the KMS key ring and key from OpenTofu's state, but leaves those resources in the project with their names still reserved. The key versions are scheduled for destruction and cannot be used to decrypt surviving keyshares unless restored before the destruction period ends. After that, the key material is permanently destroyed.

Deploy again under a different prefix, or import the existing key ring and key into state first.