TerraformPilot

DevOps

Terraform for Unraid Homelab and Docker Apps

Unraid has no native Terraform provider. Here's how to manage the infrastructure around it instead: Cloudflare Tunnel, Backblaze B2 backups, and DNS.

LLuca Berton1 min read

Unraid has no Terraform provider. Like Synology, the realistic pattern is Terraform around it: Cloudflare / Tailscale / S3 / Backblaze B2 — declaratively managed. Containers and shares stay in the Unraid UI.

Cloudflare Tunnel

# 
terraform {
  required_providers {
    cloudflare = {
      source  = "cloudflare/cloudflare"
      version = "~> 5.0"
    }
  }
}
 
resource "cloudflare_zero_trust_tunnel_cloudflared" "homelab" {
  account_id = var.cf_account_id
  name       = "unraid-homelab"
  config_src = "cloudflare"
}
 
resource "cloudflare_dns_record" "jellyfin" {
  zone_id = var.cf_zone_id
  name    = "jellyfin"
  type    = "CNAME"
  content = "${cloudflare_zero_trust_tunnel_cloudflared.homelab.id}.cfargotunnel.com"
  proxied = true
  ttl     = 1
}

Backblaze B2 Backup Bucket

# 
terraform {
  required_providers {
    b2 = { source = "Backblaze/b2", version = "~> 0.10" }
  }
}
 
resource "b2_bucket" "unraid_backup" {
  bucket_name = "unraid-${var.hostname}-backup"
  bucket_type = "allPrivate"
 
  lifecycle_rules {
    file_name_prefix = ""
    days_from_uploading_to_hiding = 0
    days_from_hiding_to_deleting  = 30
  }
}
 
resource "b2_application_key" "unraid_backup" {
  key_name      = "unraid-backup"
  capabilities  = ["listBuckets", "readFiles", "writeFiles", "deleteFiles"]
  bucket_id     = b2_bucket.unraid_backup.bucket_id
}

Configure Unraid Duplicacy or rclone plugin with the B2 key.

Best Practices

#
  • Cloudflare Tunnel > port forwarding — never open inbound ports on a homelab.
  • B2 is cheaper than S3 for homelab backup volumes.
  • Versioned, hidden-then-deleted lifecycle for ransomware protection.
  • Tailscale Subnet Router on Unraid for LAN-style remote access.
#
#Terraform#Unraid#Homelab#Docker#Backup

Share this article

Related articles