---
id: w1/m19.1/t004
title: Destroy bex-infra (definition retained) + docs trust-chain update
worker: worker1
status: done
estimate: 15m
depends_on: [w1/m19.1/t003]
---

## Objective

Retire the bootstrap machine: `terraform destroy -target` the `bex-infra` server, freeing the quota slot the tenant node (t005) needs. The Terraform definition stays — it is the DR bootstrap path ("delete the instance, keep the blueprint").

## Context

- Pre-conditions hard-gated: pivot done (t002) and CI access rewritten + proven (t003).
- After destroy: 4/5 quota slots used (2 CP + 2 platform).
- docs/ADR019-infra-credentials.md trust chain: the mgmt-cluster PKI link disappears — the app cluster is now the root; docs/ADR002-architecture.md two-cluster diagram becomes one self-managed cluster + disposable bootstrap.

## Steps

1. `terraform destroy -target=<bex-infra server resource>` (exact address from `infra/terraform/main.tf`); confirm only the server (+ its firewall attachment if any) is in the plan.
2. Verify via hcloud API: 4 servers remain; quota slot free.
3. Update the two docs; `npx prettier@3.4.2 --write` them.

## Files

- infra/terraform/ (state only — no definition changes)
- docs/ADR019-infra-credentials.md
- docs/ADR002-architecture.md

## Acceptance criteria

- [ ] hcloud API shows 4 servers; `terraform plan` shows bex-infra as intentionally absent/targeted-out, definition intact.
- [ ] Both docs reflect the self-managed world.

## Out of scope

- Removing the Terraform definition (never — DR bootstrap).
