more stuff

tofu/nodito/README.md

@@ -48,9 +48,8 @@ vms = {
     data_disks = [
       {
         size_gb = 50
-        # optional overrides:
-        # storage = "proxmox-tank-1"
-        # slot    = "scsi2"
+        # storage defaults to var.zfs_storage_name (proxmox-tank-1)
+        # optional: slot = "scsi2"
       }
     ]
   }
@@ -66,6 +65,8 @@ tofu plan -var-file=terraform.tfvars
 tofu apply -var-file=terraform.tfvars
 ```
 
+> VMs are created once and then protected: the module sets `lifecycle.prevent_destroy = true` and ignores subsequent config changes. After the initial apply, manage day‑2 changes directly in Proxmox (or remove the lifecycle block if you need OpenTofu to own ongoing updates).
+
 ### Notes
 - Clones are full clones by default (`full_clone = true`).
 - Cloud-init injects `cloud_init_user` and `ssh_authorized_keys`.

tofu/nodito/main.tf

@@ -28,6 +28,20 @@ resource "proxmox_vm_qemu" "vm" {
   boot     = "c"
   bootdisk = "scsi0"
 
+  lifecycle {
+    prevent_destroy = true
+    ignore_changes = [
+      name,
+      cpu,
+      memory,
+      network,
+      ipconfig0,
+      ciuser,
+      sshkeys,
+      cicustom,
+    ]
+  }
+
   serial {
     id   = 0
     type = "socket"

tofu/nodito/terraform.tfvars.example

@@ -23,8 +23,6 @@ vms = {
     data_disks = [
       {
         size_gb = 50
-        # optional: storage = "proxmox-tank-1"
-        # optional: slot    = "scsi2"
       }
     ]
   }