diff --git a/.gitignore b/.gitignore index 9ca7b8e..471cd6f 100644 --- a/.gitignore +++ b/.gitignore @@ -1,13 +1,16 @@ # OpenTofu / Terraform .terraform/ .tofu/ -.terraform.lock.hcl -.tofu.lock.hcl terraform.tfstate terraform.tfstate.* crash.log -*.tfvars -*.tfvars.json + +# Provider credentials only. Non-secret infra config (the vms map) is committed +# as *.auto.tfvars, and *.lock.hcl is committed on purpose so provider hashes +# are pinned. +terraform.tfvars +terraform.tfvars.json +*secrets.auto.tfvars venv/* .env diff --git a/tofu/nodito/.terraform.lock.hcl b/tofu/nodito/.terraform.lock.hcl new file mode 100644 index 0000000..fadff38 --- /dev/null +++ b/tofu/nodito/.terraform.lock.hcl @@ -0,0 +1,24 @@ +# This file is maintained automatically by "tofu init". +# Manual edits may be lost in future updates. + +provider "registry.opentofu.org/telmate/proxmox" { + version = "3.0.2-rc05" + constraints = "3.0.2-rc05" + hashes = [ + "h1:QfHovHn8h9uJXdJ+urOuiD7R46OXmdZQiRcCBaV6AD4=", + "zh:042d748367f33aaf440698644be4f2a2875f9db31915c1ef84616f176fc6174f", + "zh:1488781da1920d60d933c8ce926c34b5e989ffae58e3fbe437973d2b1d2faafc", + "zh:283dd6f74627f1d1d75d616b31f8ced3f97fd5277a07c9535e85cfa765d7a321", + "zh:378f1c2da21aeea083ac2e632db274a02c7a01e2486a40d3c813d05a21142db3", + "zh:38d63d0961f8c32273392caaace30f50cff8ab06e5dda17f67a8827ebffeba98", + "zh:52159782df101ec98f20faff81e8f2d9d92cb4ec903314fcddcc57ec16cdaacb", + "zh:6ca47b90c66b1d2706cb3cbb05da8b3f90a202c4865010202b2962e2b64d217e", + "zh:6e7b85cb2380e4dc0be694dd0e4a24927f7f66df41960eca3cfe907443d4f0b9", + "zh:758775f733673ab5c196db6a33648458037746f94d4bef7ce148cb01474efe2d", + "zh:7c31a3ca6d52db39da2bdd60be37af71d59d808fc206de50fe661535ea436da3", + "zh:af16984350a2f4d77c21f66a479007801e2527543310567c99cd82eb421e249e", + "zh:c1f965d3f96cf3f87af2c12ab9d4bde42f8ef660f8dc34ba3cfc9b20435a7269", + "zh:c2b9022a31103919a5ffbac6ee8d7feb6c4f5f580c1766f769569c2e8e4ce7f1", + "zh:e90162c42f1237323291e3d0de0c62701b3f89350fae18246da06702f41a6123", + ] +} diff --git a/tofu/nodito/README.md b/tofu/nodito/README.md index 3a0b18f..bff6585 100644 --- a/tofu/nodito/README.md +++ b/tofu/nodito/README.md @@ -27,16 +27,17 @@ This directory lets you declare VMs on the `nodito` Proxmox node and apply with - The Ansible template exists: `debian-13-cloud-init` (VMID 9001 by default). ### Provider Auth -Create a `terraform.tfvars` (copy from `terraform.tfvars.example`) and set: +Credentials are the only thing not in git. Copy `terraform.tfvars.example` to +`terraform.tfvars` (gitignored) and set: - `proxmox_api_url` (e.g. `https://nodito:8006/api2/json`) - `proxmox_api_token_id` (e.g. `root@pam!tofu`) - `proxmox_api_token_secret` -- `ssh_authorized_keys` (your public key content) -Alternatively, you can export env vars and reference them in a tfvars file. +Alternatively, export them as `TF_VAR_proxmox_api_token_secret` etc. ### Declare VMs -Edit `terraform.tfvars` and fill the `vms` map. Example entry: +VMs are declared in `vms.auto.tfvars`, which is committed. `*.auto.tfvars` is +loaded automatically, so it needs no `-var-file`. Example entry: ``` vms = { web1 = { @@ -54,15 +55,24 @@ All VM disks are created on `zfs_storage_name` (defaults to `proxmox-tank-1`). N ### Usage ``` tofu init -tofu plan -var-file=terraform.tfvars -tofu apply -var-file=terraform.tfvars +tofu plan +tofu apply ``` +`terraform.tfvars` and `vms.auto.tfvars` are both auto-loaded. > VMs are created once and then protected: the module sets `lifecycle.prevent_destroy = true` and ignores subsequent config changes. After the initial apply, manage day‑2 changes directly in Proxmox (or remove the lifecycle block if you need OpenTofu to own ongoing updates). ### Notes - Clones are full clones by default (`full_clone = true`). - Cloud-init injects `cloud_init_user` and `ssh_authorized_keys`. +- `.terraform.lock.hcl` is committed: it pins the provider hashes, which matters + because `versions.tf` tracks a release candidate (`3.0.2-rc05`). +- State is local (`terraform.tfstate`, gitignored) and has no remote backend, so + it exists only on the machine that last ran `tofu apply`. +- The map is not a complete inventory of nodito: state also manages + `bastion-box` (1100) and `nonkeiwaisi-box` (3300), which are not declared in + `vms.auto.tfvars`. `tofu plan` is clean today, but relaxing the `lifecycle` + block without first declaring them would put them up for destruction. - Disks use `scsi0` on ZFS with `discard` enabled. diff --git a/tofu/nodito/terraform.tfvars.example b/tofu/nodito/terraform.tfvars.example index cc88b3f..37b6d7a 100644 --- a/tofu/nodito/terraform.tfvars.example +++ b/tofu/nodito/terraform.tfvars.example @@ -1,35 +1,7 @@ -proxmox_api_url = "https://nodito:8006/api2/json" -proxmox_api_token_id = "root@pam!tofu" -proxmox_api_token_secret = "REPLACE_ME" - -proxmox_node = "nodito" -zfs_storage_name = "proxmox-tank-1" -template_name = "debian-13-cloud-init" -cloud_init_user = "counterweight" - -# paste your ~/.ssh/id_ed25519.pub or similar -ssh_authorized_keys = <