diff --git a/.gitignore b/.gitignore
index 757bb73..17163d4 100644
--- a/.gitignore
+++ b/.gitignore
@@ -35,3 +35,5 @@ lerna-debug.log*
 .dev.vars*
 !.dev.vars.example
 !.env.example
+
+.terraform
diff --git a/apps/terraform/.infisical.json b/apps/terraform/.infisical.json
new file mode 100644
index 0000000..8587211
--- /dev/null
+++ b/apps/terraform/.infisical.json
@@ -0,0 +1,5 @@
+{
+  "workspaceId": "0b900d89-3abc-4578-ab05-8d14e67034ca",
+  "defaultEnvironment": "prod",
+  "gitBranchToEnvironmentMapping": null
+}
diff --git a/apps/terraform/.terraform.lock.hcl b/apps/terraform/.terraform.lock.hcl
new file mode 100644
index 0000000..5ff1941
--- /dev/null
+++ b/apps/terraform/.terraform.lock.hcl
@@ -0,0 +1,19 @@
+# This file is maintained automatically by "terraform init".
+# Manual edits may be lost in future updates.
+
+provider "registry.terraform.io/cloudflare/cloudflare" {
+  version     = "5.17.0"
+  constraints = "~> 5.0"
+  hashes = [
+    "h1:QDpQDZMMreh2Z8Pm3WxCe2I1d4NEOyvZvNGoY8+BDqo=",
+    "zh:33e24de8ecccb52b5588893cdfbd2b8942c86a8a855d32892d4be04b4ca8e064",
+    "zh:37bf1f79496650dbb7f6d6241ef54fbf3e1e6f0dbbc644806c0c78acfcdbc57c",
+    "zh:5c5f10424c93f0278cc8b497b3c942e1b17f114d87ed72aa21077e6f1f1e0379",
+    "zh:68bc559574f1a32d0497d22c15f9c07a26a04a0bff17a3f3776ee647e301d3d5",
+    "zh:90c1b92209c1f6435cb5c10a67d0e43b8730624124ce427fde3e529c1ec133aa",
+    "zh:9fdc1b8824ba004aad5bd943430aed523a50f7930ad0f7f04627fdb65d476460",
+    "zh:e3e4684a581a02b76dbd64bc40db25aec6df59e5de6afb266b7178ac4f9044cd",
+    "zh:f809ab383cca0a5f83072981c64208cbd7fa67e986a86ee02dd2c82333221e32",
+    "zh:fd28bd284a69c6bdd6df8e34367cfcba7eea04adc245c1c19f6909ff056d8ad4",
+  ]
+}
diff --git a/apps/terraform/main.tf b/apps/terraform/main.tf
new file mode 100644
index 0000000..7166579
--- /dev/null
+++ b/apps/terraform/main.tf
@@ -0,0 +1,20 @@
+terraform {
+  backend "s3" {
+    bucket       = "terraform-state"
+    key          = "media"
+    region       = "auto"
+    use_lockfile = true
+    skip_credentials_validation = true
+    skip_region_validation = true
+    skip_requesting_account_id = true
+  }
+
+  required_providers {
+    cloudflare = {
+      source  = "cloudflare/cloudflare"
+      version = "~> 5"
+    }
+  }
+}
+
+provider "cloudflare" {}
diff --git a/apps/terraform/r2.tf b/apps/terraform/r2.tf
new file mode 100644
index 0000000..28983d6
--- /dev/null
+++ b/apps/terraform/r2.tf
@@ -0,0 +1,4 @@
+resource "cloudflare_r2_bucket" "media" {
+  account_id = var.cloudflare_account_id
+  name       = "media"
+}
diff --git a/apps/terraform/variables.tf b/apps/terraform/variables.tf
new file mode 100644
index 0000000..c8cdc51
--- /dev/null
+++ b/apps/terraform/variables.tf
@@ -0,0 +1,4 @@
+variable "cloudflare_account_id" {
+  type = string
+  sensitive = true
+}