migrate to OpenTofu with Terraform fallback

- Change required_version from >= 1.5.4 to >= 1.6.0 (OpenTofu baseline)
- Make Makefile use  variable: auto-detects tofu first, terraform fallback
- Override with: make TERRAFORM=terraform <target>
- Update managed tag from 'terraform' to 'tofu'

Makefile

@@ -1,95 +1,102 @@
 # Makefile for OpenBoatmobile
 # Convenience commands for common operations
 
+# Auto-detect infrastructure-as-code binary: OpenTofu preferred, Terraform fallback.
+# Override with: make TERRAFORM=terraform <target>
+TERRAFORM ?= $(shell command -v tofu 2>/dev/null || command -v terraform 2>/dev/null || echo tofu)
+
 .PHONY: help init plan apply destroy ssh logs health clean
 
 # Default target
 help:
-	@echo "OpenBoatmobile - Terraform deployment commands"
+	@echo "OpenBoatmobile - deployment commands"
+	@echo ""
+	@echo "Binary: $(TERRAFORM) (OpenTofu preferred, Terraform fallback)"
+	@echo "Override: make TERRAFORM=terraform <target>"
 	@echo ""
 	@echo "Usage: make <target>"
 	@echo ""
 	@echo "Targets:"
-	@echo "  init      Initialize Terraform"
+	@echo "  init      Initialize $(TERRAFORM)"
 	@echo "  plan      Show deployment plan"
-	@echo "  apply     Deployinfrastructure"
+	@echo "  apply     Deploy infrastructure"
 	@echo "  destroy   Destroy infrastructure"
 	@echo "  output    Show deployment outputs"
 	@echo "  ssh       SSH into server"
 	@echo "  tunnel    Create SSH tunnel to gateway"
 	@echo "  logs      Show gateway logs"
 	@echo "  health    Run health check"
-	@echo "  clean     Clean Terraform state"
+	@echo "  clean     Clean IaC state"
 	@echo ""
 	@echo "Prerequisites:"
 	@echo "  source .env   # Load secrets before running"
 	@echo ""
 
-# Initialize Terraform
+# Initialize
 init:
-	terraform init
+	$(TERRAFORM) init
 
 # Show deployment plan
 plan:
-	terraform plan
+	$(TERRAFORM) plan
 
 # Deploy infrastructure
 apply:
-	terraform apply
+	$(TERRAFORM) apply
 
 # Destroy infrastructure
 destroy:
-	terraform destroy
+	$(TERRAFORM) destroy
 
 # Show outputs
 output:
-	terraform output
+	$(TERRAFORM) output
 
-# SSH into server (extracts command from Terraform output)
+# SSH into server (extracts command from output)
 ssh:
-	@SSH_CMD=$$(terraform output -raw ssh_command); 
+	@SSH_CMD=$$($(TERRAFORM) output -raw ssh_command); \
 	echo "$$SSH_CMD"; \
 	$$SSH_CMD
 
 # Create SSH tunnel to gateway (extracts command from output)
 tunnel:
-	@SSH_CMD=$$(terraform output -raw ssh_command); \
-	IP=$$(terraform output -raw server_ip); \
+	@SSH_CMD=$$($(TERRAFORM) output -raw ssh_command); \
+	IP=$$($(TERRAFORM) output -raw server_ip); \
 	echo "Creating tunnel to gateway..."; \
 	$$SSH_CMD -L 18789:localhost:18789
 
 # Show gateway logs (requires SSH)
 logs:
-	@SSH_CMD=$$(terraform output -raw ssh_command); \
+	@SSH_CMD=$$($(TERRAFORM) output -raw ssh_command); \
 	$$SSH_CMD "journalctl -u openclaw-gateway -f"
 
 # Run health check (requires SSH)
 health:
-	@SSH_CMD=$$(terraform output -raw ssh_command); \
+	@SSH_CMD=$$($(TERRAFORM) output -raw ssh_command); \
 	$$SSH_CMD "sudo /usr/local/bin/openclaw-health-check.sh"
 
-# Clean Terraform state
+# Clean state
 clean:
 	rm -rf .terraform/
 	rm -f .terraform.lock.hcl
 	rm -f terraform.tfstate*
-	@echo "Terraform state cleaned. Run 'make init' to reinitialize."
+	@echo "State cleaned. Run 'make init' to reinitialize."
 
 # Validate configuration
 validate:
-	terraform validate
+	$(TERRAFORM) validate
 
 # Format code
 fmt:
-	terraform fmt
+	$(TERRAFORM) fmt
 
 # Show workspace status
 status:
-	@echo "=== Terraform Workspace ==="
-	@terraform workspace show 2>/dev/null || echo "default"
+	@echo "=== Workspace ==="
+	@$(TERRAFORM) workspace show 2>/dev/null || echo "default"
 	@echo ""
 	@echo "=== State Resources ==="
-	@terraform state list 2>/dev/null || echo "No resources in state"
+	@$(TERRAFORM) state list 2>/dev/null || echo "No resources in state"
 	@echo ""
 	@echo "=== Outputs ==="
-	@terraform output 2>/dev/null || echo "No outputs defined"
+	@$(TERRAFORM) output 2>/dev/null || echo "No outputs defined"

main.tf

@@ -2,7 +2,7 @@
 # Provider-agnostic infrastructure for OpenClaw or Hermes agents
 
 terraform {
-  required_version = ">= 1.5.4"
+  required_version = ">= 1.6.0"
 
   required_providers {
     digitalocean = {
@@ -49,7 +49,7 @@ locals {
   # Common tags/labels for resource tracking
   common_tags = {
     project   = var.project_name
-    managed   = "terraform"
+    managed   = "tofu"
     component = var.agent_framework == "hermes" ? "hermes-agent" : "openclaw-gateway"
   }
 }