tofu: stop gitignoring the lock file and the VM inventory
The root .gitignore excluded .terraform.lock.hcl and every *.tfvars, which hid two things that belong in version control: - .terraform.lock.hcl pins the provider hashes. versions.tf tracks Telmate/proxmox 3.0.2-rc05, a release candidate, so the version constraint alone is not enough if that tag is ever re-published. - terraform.tfvars held one real secret (proxmox_api_token_secret) plus the entire vms map — 7 VMs with their vmids, sizes and static IPs. That is infra definition, and it existed only on one laptop. Meanwhile the committed terraform.tfvars.example still advertised web1/db1. Split at the credential boundary: the provider auth triple stays in the gitignored terraform.tfvars, everything else moves to vms.auto.tfvars, which is committed and auto-loaded (no -var-file needed). terraform.tfvars.example is now credentials-only. `tofu plan` reports no changes. State stays ignored — it carries cloud-init attributes and should not be in git. Noted in the README that it has no remote backend, and that state manages two VMs (bastion-box, nonkeiwaisi-box) the map does not declare. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
This commit is contained in:
parent
6c1bcbed95
commit
35b3817e15
GPG key ID:
883EDBAA726BD96C
5 changed files with 130 additions and 44 deletions
24
tofu/nodito/.terraform.lock.hcl
generated
Normal file
24
tofu/nodito/.terraform.lock.hcl
generated
Normal file
|
|
@ -0,0 +1,24 @@
|
|||
# This file is maintained automatically by "tofu init".
|
||||
# Manual edits may be lost in future updates.
|
||||
|
||||
provider "registry.opentofu.org/telmate/proxmox" {
|
||||
version = "3.0.2-rc05"
|
||||
constraints = "3.0.2-rc05"
|
||||
hashes = [
|
||||
"h1:QfHovHn8h9uJXdJ+urOuiD7R46OXmdZQiRcCBaV6AD4=",
|
||||
"zh:042d748367f33aaf440698644be4f2a2875f9db31915c1ef84616f176fc6174f",
|
||||
"zh:1488781da1920d60d933c8ce926c34b5e989ffae58e3fbe437973d2b1d2faafc",
|
||||
"zh:283dd6f74627f1d1d75d616b31f8ced3f97fd5277a07c9535e85cfa765d7a321",
|
||||
"zh:378f1c2da21aeea083ac2e632db274a02c7a01e2486a40d3c813d05a21142db3",
|
||||
"zh:38d63d0961f8c32273392caaace30f50cff8ab06e5dda17f67a8827ebffeba98",
|
||||
"zh:52159782df101ec98f20faff81e8f2d9d92cb4ec903314fcddcc57ec16cdaacb",
|
||||
"zh:6ca47b90c66b1d2706cb3cbb05da8b3f90a202c4865010202b2962e2b64d217e",
|
||||
"zh:6e7b85cb2380e4dc0be694dd0e4a24927f7f66df41960eca3cfe907443d4f0b9",
|
||||
"zh:758775f733673ab5c196db6a33648458037746f94d4bef7ce148cb01474efe2d",
|
||||
"zh:7c31a3ca6d52db39da2bdd60be37af71d59d808fc206de50fe661535ea436da3",
|
||||
"zh:af16984350a2f4d77c21f66a479007801e2527543310567c99cd82eb421e249e",
|
||||
"zh:c1f965d3f96cf3f87af2c12ab9d4bde42f8ef660f8dc34ba3cfc9b20435a7269",
|
||||
"zh:c2b9022a31103919a5ffbac6ee8d7feb6c4f5f580c1766f769569c2e8e4ce7f1",
|
||||
"zh:e90162c42f1237323291e3d0de0c62701b3f89350fae18246da06702f41a6123",
|
||||
]
|
||||
}
|
||||
|
|
@ -27,16 +27,17 @@ This directory lets you declare VMs on the `nodito` Proxmox node and apply with
|
|||
- The Ansible template exists: `debian-13-cloud-init` (VMID 9001 by default).
|
||||
|
||||
### Provider Auth
|
||||
Create a `terraform.tfvars` (copy from `terraform.tfvars.example`) and set:
|
||||
Credentials are the only thing not in git. Copy `terraform.tfvars.example` to
|
||||
`terraform.tfvars` (gitignored) and set:
|
||||
- `proxmox_api_url` (e.g. `https://nodito:8006/api2/json`)
|
||||
- `proxmox_api_token_id` (e.g. `root@pam!tofu`)
|
||||
- `proxmox_api_token_secret`
|
||||
- `ssh_authorized_keys` (your public key content)
|
||||
|
||||
Alternatively, you can export env vars and reference them in a tfvars file.
|
||||
Alternatively, export them as `TF_VAR_proxmox_api_token_secret` etc.
|
||||
|
||||
### Declare VMs
|
||||
Edit `terraform.tfvars` and fill the `vms` map. Example entry:
|
||||
VMs are declared in `vms.auto.tfvars`, which is committed. `*.auto.tfvars` is
|
||||
loaded automatically, so it needs no `-var-file`. Example entry:
|
||||
```
|
||||
vms = {
|
||||
web1 = {
|
||||
|
|
@ -54,15 +55,24 @@ All VM disks are created on `zfs_storage_name` (defaults to `proxmox-tank-1`). N
|
|||
### Usage
|
||||
```
|
||||
tofu init
|
||||
tofu plan -var-file=terraform.tfvars
|
||||
tofu apply -var-file=terraform.tfvars
|
||||
tofu plan
|
||||
tofu apply
|
||||
```
|
||||
`terraform.tfvars` and `vms.auto.tfvars` are both auto-loaded.
|
||||
|
||||
> VMs are created once and then protected: the module sets `lifecycle.prevent_destroy = true` and ignores subsequent config changes. After the initial apply, manage day‑2 changes directly in Proxmox (or remove the lifecycle block if you need OpenTofu to own ongoing updates).
|
||||
|
||||
### Notes
|
||||
- Clones are full clones by default (`full_clone = true`).
|
||||
- Cloud-init injects `cloud_init_user` and `ssh_authorized_keys`.
|
||||
- `.terraform.lock.hcl` is committed: it pins the provider hashes, which matters
|
||||
because `versions.tf` tracks a release candidate (`3.0.2-rc05`).
|
||||
- State is local (`terraform.tfstate`, gitignored) and has no remote backend, so
|
||||
it exists only on the machine that last ran `tofu apply`.
|
||||
- The map is not a complete inventory of nodito: state also manages
|
||||
`bastion-box` (1100) and `nonkeiwaisi-box` (3300), which are not declared in
|
||||
`vms.auto.tfvars`. `tofu plan` is clean today, but relaxing the `lifecycle`
|
||||
block without first declaring them would put them up for destruction.
|
||||
- Disks use `scsi0` on ZFS with `discard` enabled.
|
||||
|
||||
|
||||
|
|
|
|||
|
|
@ -1,35 +1,7 @@
|
|||
proxmox_api_url = "https://nodito:8006/api2/json"
|
||||
proxmox_api_token_id = "root@pam!tofu"
|
||||
proxmox_api_token_secret = "REPLACE_ME"
|
||||
|
||||
proxmox_node = "nodito"
|
||||
zfs_storage_name = "proxmox-tank-1"
|
||||
template_name = "debian-13-cloud-init"
|
||||
cloud_init_user = "counterweight"
|
||||
|
||||
# paste your ~/.ssh/id_ed25519.pub or similar
|
||||
ssh_authorized_keys = <<EOKEY
|
||||
ssh-ed25519 AAAA... your-key
|
||||
EOKEY
|
||||
|
||||
vms = {
|
||||
web1 = {
|
||||
name = "web1"
|
||||
vmid = 1101
|
||||
cores = 2
|
||||
memory_mb = 2048
|
||||
disk_size_gb = 20
|
||||
ipconfig0 = "ip=dhcp"
|
||||
}
|
||||
|
||||
db1 = {
|
||||
name = "db1"
|
||||
vmid = 1102
|
||||
cores = 4
|
||||
memory_mb = 4096
|
||||
disk_size_gb = 40
|
||||
ipconfig0 = "ip=dhcp"
|
||||
}
|
||||
}
|
||||
|
||||
# Provider credentials. Copy to terraform.tfvars (gitignored) and fill in.
|
||||
# Everything else — the node, storage, template, SSH key and the vms map —
|
||||
# is committed in vms.auto.tfvars and needs no local copy.
|
||||
|
||||
proxmox_api_url = "https://nodito:8006/api2/json"
|
||||
proxmox_api_token_id = "root@pam!tofu"
|
||||
proxmox_api_token_secret = "REPLACE_ME"
|
||||
|
|
|
|||
77
tofu/nodito/vms.auto.tfvars
Normal file
77
tofu/nodito/vms.auto.tfvars
Normal file
|
|
@ -0,0 +1,77 @@
|
|||
# Non-secret nodito infrastructure config. Auto-loaded by tofu (*.auto.tfvars),
|
||||
# so no -var-file is needed. Provider credentials live in terraform.tfvars,
|
||||
# which is gitignored.
|
||||
|
||||
proxmox_node = "nodito"
|
||||
zfs_storage_name = "proxmox-tank-1"
|
||||
template_name = "debian-13-cloud-init"
|
||||
cloud_init_user = "counterweight"
|
||||
|
||||
# Public key injected into every VM via cloud-init.
|
||||
ssh_authorized_keys = <<EOKEY
|
||||
ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOVC68uU7dTpZ8mDleakoBX6crnBdKNuvg6qeD73t+6L counterweightoperator@counterstation
|
||||
EOKEY
|
||||
|
||||
# Note that the resources set here are designed for startup.
|
||||
# Some of these services are resource hungry at first, but
|
||||
# can be powered down after their bootstrap finishes.
|
||||
vms = {
|
||||
"small-backups-box" = {
|
||||
vmid = 1200
|
||||
name = "small-backups-box"
|
||||
cores = 1
|
||||
memory_mb = 512
|
||||
disk_size_gb = 100
|
||||
ipconfig0 = "ip=dhcp"
|
||||
},
|
||||
"knots-box" = {
|
||||
vmid = 2100
|
||||
name = "knots-box"
|
||||
cores = 4
|
||||
memory_mb = 16384
|
||||
disk_size_gb = 10
|
||||
ipconfig0 = "ip=dhcp"
|
||||
},
|
||||
"fulcrum-box" = {
|
||||
vmid = 2200
|
||||
name = "fulcrum-box"
|
||||
cores = 1
|
||||
memory_mb = 2048
|
||||
disk_size_gb = 10
|
||||
ipconfig0 = "ip=dhcp"
|
||||
},
|
||||
"mempool-box" = {
|
||||
vmid = 2300
|
||||
name = "mempool-box"
|
||||
cores = 2
|
||||
memory_mb = 4096
|
||||
disk_size_gb = 30
|
||||
ipconfig0 = "ip=dhcp"
|
||||
},
|
||||
"memos-box" = {
|
||||
vmid = 8100
|
||||
name = "memos-box"
|
||||
cores = 1
|
||||
memory_mb = 1024
|
||||
disk_size_gb = 10
|
||||
ipconfig0 = "ip=dhcp"
|
||||
},
|
||||
"forgejo-runner-box" = {
|
||||
vmid = 3100
|
||||
name = "forgejo-runner-box"
|
||||
cores = 4
|
||||
memory_mb = 4096
|
||||
disk_size_gb = 50
|
||||
ipconfig0 = "ip=dhcp"
|
||||
},
|
||||
"arbret-staging-box" = {
|
||||
vmid = 3200
|
||||
name = "arbret-staging-box"
|
||||
cores = 2
|
||||
memory_mb = 2048
|
||||
disk_size_gb = 20
|
||||
ipconfig0 = "ip=dhcp"
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
Loading…
Add table
Add a link
Reference in a new issue