personal_infra/tofu/nodito/terraform.tfvars.example

# Provider credentials. Copy to terraform.tfvars (gitignored) and fill in.
# Everything else — the node, storage, template, SSH key and the vms map —
# is committed in vms.auto.tfvars and needs no local copy.

proxmox_api_url          = "https://nodito:8006/api2/json"
proxmox_api_token_id     = "root@pam!tofu"
proxmox_api_token_secret = "REPLACE_ME"
tofu: stop gitignoring the lock file and the VM inventory The root .gitignore excluded .terraform.lock.hcl and every *.tfvars, which hid two things that belong in version control: - .terraform.lock.hcl pins the provider hashes. versions.tf tracks Telmate/proxmox 3.0.2-rc05, a release candidate, so the version constraint alone is not enough if that tag is ever re-published. - terraform.tfvars held one real secret (proxmox_api_token_secret) plus the entire vms map — 7 VMs with their vmids, sizes and static IPs. That is infra definition, and it existed only on one laptop. Meanwhile the committed terraform.tfvars.example still advertised web1/db1. Split at the credential boundary: the provider auth triple stays in the gitignored terraform.tfvars, everything else moves to vms.auto.tfvars, which is committed and auto-loaded (no -var-file needed). terraform.tfvars.example is now credentials-only. `tofu plan` reports no changes. State stays ignored — it carries cloud-init attributes and should not be in git. Noted in the README that it has no remote backend, and that state manages two VMs (bastion-box, nonkeiwaisi-box) the map does not declare. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> 2026-09-12 18:43:14 +02:00			`# Provider credentials. Copy to terraform.tfvars (gitignored) and fill in.`
			`# Everything else — the node, storage, template, SSH key and the vms map —`
			`# is committed in vms.auto.tfvars and needs no local copy.`
tf defined vms 2025-10-31 08:54:18 +01:00
tofu: stop gitignoring the lock file and the VM inventory The root .gitignore excluded .terraform.lock.hcl and every *.tfvars, which hid two things that belong in version control: - .terraform.lock.hcl pins the provider hashes. versions.tf tracks Telmate/proxmox 3.0.2-rc05, a release candidate, so the version constraint alone is not enough if that tag is ever re-published. - terraform.tfvars held one real secret (proxmox_api_token_secret) plus the entire vms map — 7 VMs with their vmids, sizes and static IPs. That is infra definition, and it existed only on one laptop. Meanwhile the committed terraform.tfvars.example still advertised web1/db1. Split at the credential boundary: the provider auth triple stays in the gitignored terraform.tfvars, everything else moves to vms.auto.tfvars, which is committed and auto-loaded (no -var-file needed). terraform.tfvars.example is now credentials-only. `tofu plan` reports no changes. State stays ignored — it carries cloud-init attributes and should not be in git. Noted in the README that it has no remote backend, and that state manages two VMs (bastion-box, nonkeiwaisi-box) the map does not declare. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> 2026-09-12 18:43:14 +02:00			`proxmox_api_url = "https://nodito:8006/api2/json"`
			`proxmox_api_token_id = "root@pam!tofu"`
			`proxmox_api_token_secret = "REPLACE_ME"`