tofu: stop gitignoring the lock file and the VM inventory

The root .gitignore excluded .terraform.lock.hcl and every *.tfvars, which
hid two things that belong in version control:

- .terraform.lock.hcl pins the provider hashes. versions.tf tracks
  Telmate/proxmox 3.0.2-rc05, a release candidate, so the version
  constraint alone is not enough if that tag is ever re-published.

- terraform.tfvars held one real secret (proxmox_api_token_secret) plus the
  entire vms map — 7 VMs with their vmids, sizes and static IPs. That is
  infra definition, and it existed only on one laptop. Meanwhile the
  committed terraform.tfvars.example still advertised web1/db1.

Split at the credential boundary: the provider auth triple stays in the
gitignored terraform.tfvars, everything else moves to vms.auto.tfvars, which
is committed and auto-loaded (no -var-file needed). terraform.tfvars.example
is now credentials-only. `tofu plan` reports no changes.

State stays ignored — it carries cloud-init attributes and should not be in
git. Noted in the README that it has no remote backend, and that state
manages two VMs (bastion-box, nonkeiwaisi-box) the map does not declare.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

.gitignore

@@ -1,13 +1,16 @@
 # OpenTofu / Terraform
 .terraform/
 .tofu/
-.terraform.lock.hcl
-.tofu.lock.hcl
 terraform.tfstate
 terraform.tfstate.*
 crash.log
-*.tfvars
+
-*.tfvars.json
+# Provider credentials only. Non-secret infra config (the vms map) is committed
+# as *.auto.tfvars, and *.lock.hcl is committed on purpose so provider hashes
+# are pinned.
+terraform.tfvars
+terraform.tfvars.json
+*secrets.auto.tfvars
 
 venv/*
 .env

tofu/nodito/.terraform.lock.hcl

@@ -0,0 +1,24 @@
+# This file is maintained automatically by "tofu init".
+# Manual edits may be lost in future updates.
+
+provider "registry.opentofu.org/telmate/proxmox" {
+  version     = "3.0.2-rc05"
+  constraints = "3.0.2-rc05"
+  hashes = [
+    "h1:QfHovHn8h9uJXdJ+urOuiD7R46OXmdZQiRcCBaV6AD4=",
+    "zh:042d748367f33aaf440698644be4f2a2875f9db31915c1ef84616f176fc6174f",
+    "zh:1488781da1920d60d933c8ce926c34b5e989ffae58e3fbe437973d2b1d2faafc",
+    "zh:283dd6f74627f1d1d75d616b31f8ced3f97fd5277a07c9535e85cfa765d7a321",
+    "zh:378f1c2da21aeea083ac2e632db274a02c7a01e2486a40d3c813d05a21142db3",
+    "zh:38d63d0961f8c32273392caaace30f50cff8ab06e5dda17f67a8827ebffeba98",
+    "zh:52159782df101ec98f20faff81e8f2d9d92cb4ec903314fcddcc57ec16cdaacb",
+    "zh:6ca47b90c66b1d2706cb3cbb05da8b3f90a202c4865010202b2962e2b64d217e",
+    "zh:6e7b85cb2380e4dc0be694dd0e4a24927f7f66df41960eca3cfe907443d4f0b9",
+    "zh:758775f733673ab5c196db6a33648458037746f94d4bef7ce148cb01474efe2d",
+    "zh:7c31a3ca6d52db39da2bdd60be37af71d59d808fc206de50fe661535ea436da3",
+    "zh:af16984350a2f4d77c21f66a479007801e2527543310567c99cd82eb421e249e",
+    "zh:c1f965d3f96cf3f87af2c12ab9d4bde42f8ef660f8dc34ba3cfc9b20435a7269",
+    "zh:c2b9022a31103919a5ffbac6ee8d7feb6c4f5f580c1766f769569c2e8e4ce7f1",
+    "zh:e90162c42f1237323291e3d0de0c62701b3f89350fae18246da06702f41a6123",
+  ]
+}

tofu/nodito/README.md

@@ -27,16 +27,17 @@ This directory lets you declare VMs on the `nodito` Proxmox node and apply with
 - The Ansible template exists: `debian-13-cloud-init` (VMID 9001 by default).
 
 ### Provider Auth
-Create a `terraform.tfvars` (copy from `terraform.tfvars.example`) and set:
+Credentials are the only thing not in git. Copy `terraform.tfvars.example` to
+`terraform.tfvars` (gitignored) and set:
 - `proxmox_api_url` (e.g. `https://nodito:8006/api2/json`)
 - `proxmox_api_token_id` (e.g. `root@pam!tofu`)
 - `proxmox_api_token_secret`
-- `ssh_authorized_keys` (your public key content)
 
-Alternatively, you can export env vars and reference them in a tfvars file.
+Alternatively, export them as `TF_VAR_proxmox_api_token_secret` etc.
 
 ### Declare VMs
-Edit `terraform.tfvars` and fill the `vms` map. Example entry:
+VMs are declared in `vms.auto.tfvars`, which is committed. `*.auto.tfvars` is
+loaded automatically, so it needs no `-var-file`. Example entry:
 ```
 vms = {
   web1 = {
@@ -54,15 +55,24 @@ All VM disks are created on `zfs_storage_name` (defaults to `proxmox-tank-1`). N
 ### Usage
 ```
 tofu init
-tofu plan -var-file=terraform.tfvars
+tofu plan
-tofu apply -var-file=terraform.tfvars
+tofu apply
 ```
+`terraform.tfvars` and `vms.auto.tfvars` are both auto-loaded.
 
 > VMs are created once and then protected: the module sets `lifecycle.prevent_destroy = true` and ignores subsequent config changes. After the initial apply, manage day‑2 changes directly in Proxmox (or remove the lifecycle block if you need OpenTofu to own ongoing updates).
 
 ### Notes
 - Clones are full clones by default (`full_clone = true`).
 - Cloud-init injects `cloud_init_user` and `ssh_authorized_keys`.
+- `.terraform.lock.hcl` is committed: it pins the provider hashes, which matters
+  because `versions.tf` tracks a release candidate (`3.0.2-rc05`).
+- State is local (`terraform.tfstate`, gitignored) and has no remote backend, so
+  it exists only on the machine that last ran `tofu apply`.
+- The map is not a complete inventory of nodito: state also manages
+  `bastion-box` (1100) and `nonkeiwaisi-box` (3300), which are not declared in
+  `vms.auto.tfvars`. `tofu plan` is clean today, but relaxing the `lifecycle`
+  block without first declaring them would put them up for destruction.
 - Disks use `scsi0` on ZFS with `discard` enabled.
 
 

tofu/nodito/terraform.tfvars.example

@@ -1,35 +1,7 @@
+# Provider credentials. Copy to terraform.tfvars (gitignored) and fill in.
+# Everything else — the node, storage, template, SSH key and the vms map —
+# is committed in vms.auto.tfvars and needs no local copy.
+
 proxmox_api_url          = "https://nodito:8006/api2/json"
 proxmox_api_token_id     = "root@pam!tofu"
 proxmox_api_token_secret = "REPLACE_ME"
-
-proxmox_node = "nodito"
-zfs_storage_name = "proxmox-tank-1"
-template_name = "debian-13-cloud-init"
-cloud_init_user = "counterweight"
-
-# paste your ~/.ssh/id_ed25519.pub or similar
-ssh_authorized_keys = <<EOKEY
-ssh-ed25519 AAAA... your-key
-EOKEY
-
-vms = {
-  web1 = {
-    name         = "web1"
-    vmid         = 1101
-    cores        = 2
-    memory_mb    = 2048
-    disk_size_gb = 20
-    ipconfig0    = "ip=dhcp"
-  }
-
-  db1 = {
-    name         = "db1"
-    vmid         = 1102
-    cores        = 4
-    memory_mb    = 4096
-    disk_size_gb = 40
-    ipconfig0    = "ip=dhcp"
-  }
-}
-
-

tofu/nodito/vms.auto.tfvars

@@ -0,0 +1,77 @@
+# Non-secret nodito infrastructure config. Auto-loaded by tofu (*.auto.tfvars),
+# so no -var-file is needed. Provider credentials live in terraform.tfvars,
+# which is gitignored.
+
+proxmox_node     = "nodito"
+zfs_storage_name = "proxmox-tank-1"
+template_name    = "debian-13-cloud-init"
+cloud_init_user  = "counterweight"
+
+# Public key injected into every VM via cloud-init.
+ssh_authorized_keys = <<EOKEY
+ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOVC68uU7dTpZ8mDleakoBX6crnBdKNuvg6qeD73t+6L counterweightoperator@counterstation
+EOKEY
+
+# Note that the resources set here are designed for startup.
+# Some of these services are resource hungry at first, but
+# can be powered down after their bootstrap finishes.
+vms = {
+  "small-backups-box" = {
+    vmid         = 1200
+    name         = "small-backups-box"
+    cores        = 1
+    memory_mb    = 512
+    disk_size_gb = 100
+    ipconfig0    = "ip=dhcp"
+  },
+  "knots-box" = {
+    vmid         = 2100
+    name         = "knots-box"
+    cores        = 4
+    memory_mb    = 16384
+    disk_size_gb = 10
+    ipconfig0    = "ip=dhcp"
+  },
+  "fulcrum-box" = {
+    vmid         = 2200
+    name         = "fulcrum-box"
+    cores        = 1
+    memory_mb    = 2048
+    disk_size_gb = 10
+    ipconfig0    = "ip=dhcp"
+  },
+  "mempool-box" = {
+    vmid         = 2300
+    name         = "mempool-box"
+    cores        = 2
+    memory_mb    = 4096
+    disk_size_gb = 30
+    ipconfig0    = "ip=dhcp"
+  },
+  "memos-box" = {
+    vmid         = 8100
+    name         = "memos-box"
+    cores        = 1
+    memory_mb    = 1024
+    disk_size_gb = 10
+    ipconfig0    = "ip=dhcp"
+  },
+  "forgejo-runner-box" = {
+    vmid         = 3100
+    name         = "forgejo-runner-box"
+    cores        = 4
+    memory_mb    = 4096
+    disk_size_gb = 50
+    ipconfig0    = "ip=dhcp"
+  },
+  "arbret-staging-box" = {
+    vmid         = 3200
+    name         = "arbret-staging-box"
+    cores        = 2 
+    memory_mb    = 2048
+    disk_size_gb = 20
+    ipconfig0    = "ip=dhcp"
+  }
+}
+
+