From 850a4b5b7e95d8d35450470037a7cd7efbe76a9e Mon Sep 17 00:00:00 2001
From: Stefan Weber <s.weber@nexus.local>
Date: Thu, 26 Feb 2026 09:00:00 +0000
Subject: [PATCH] Add plan/apply wrapper scripts

---
 scripts/apply.sh | 11 +++++++++++
 scripts/plan.sh  |  8 ++++++++
 2 files changed, 19 insertions(+)
 create mode 100755 scripts/apply.sh
 create mode 100755 scripts/plan.sh

diff --git a/scripts/apply.sh b/scripts/apply.sh
new file mode 100755
index 0000000..80cf8d8
--- /dev/null
+++ b/scripts/apply.sh
@@ -0,0 +1,11 @@
+#!/bin/bash
+# Apply a previously generated plan. Never auto-approves in prod.
+set -euo pipefail
+ENV="${1:?Usage: apply.sh <staging|prod>}"
+cd "$(dirname "$0")/../terraform/envs/$ENV"
+if [ "$ENV" = "prod" ]; then
+    echo "[apply] WARNING: applying to PRODUCTION."
+    read -rp "Type 'yes' to continue: " confirm
+    [ "$confirm" = "yes" ] || { echo "Aborted."; exit 1; }
+fi
+terraform apply tfplan
diff --git a/scripts/plan.sh b/scripts/plan.sh
new file mode 100755
index 0000000..8810d8c
--- /dev/null
+++ b/scripts/plan.sh
@@ -0,0 +1,8 @@
+#!/bin/bash
+# Wrapper around terraform plan with colour output and cost estimation.
+set -euo pipefail
+ENV="${1:?Usage: plan.sh <staging|prod>}"
+cd "$(dirname "$0")/../terraform/envs/$ENV"
+terraform init -input=false
+terraform plan -out=tfplan -input=false
+echo "[plan] Run './scripts/apply.sh $ENV' to apply."