diff --git a/external/README.md b/external/README.md
index 98b51e04..1e4632aa 100644
--- a/external/README.md
+++ b/external/README.md
@@ -1,13 +1,30 @@
 # External resources
 
+> WIP documents
+
 This layer will deploy resources that require external dependencies using the following provisioners:
 
-Terraform:
+- Terraform:
+  - Create external resources
+  - Add external secrets to namespaces
+  - Create an ApplicationSet
+- ArgoCD (via the ApplicationSet created by Terraform):
+  - Deploy Helm charts in the subdirectories
 
-- Create external resources
-- Add external secrets to namespaces
-- Create an ApplicationSet
+## Setup
 
-ArgoCD (via the ApplicationSet created by Terraform):
+- Create Terraform Cloud workspace
+- Run `terraform login`
+- Create Cloudflare key at <https://dash.cloudflare.com/profile/api-tokens>
+- Create Backblaze key at <https://secure.backblaze.com/app_keys.htm>
 
-- Deploy Helm charts in the subdirectories
+```sh
+export CLOUDFLARE_API_TOKEN='xxx'
+export B2_APPLICATION_KEY_ID='xxx'
+export B2_APPLICATION_KEY='xxx'
+export KUBE_CONFIG_PATH="$PWD/../metal/kubeconfig.yaml"
+```
+
+```sh
+terraform apply
+```
diff --git a/external/cloudflare.tf b/external/cloudflare.tf
index 7c36fa41..a9db46b2 100644
--- a/external/cloudflare.tf
+++ b/external/cloudflare.tf
@@ -1,6 +1,6 @@
 provider "cloudflare" {
   # Environment variables
-  # CLOUDFLARE_API_KEY
+  # CLOUDFLARE_API_TOKEN
 }
 
 data "cloudflare_zone" "khuedoan_com" {