The root .gitignore excluded .terraform.lock.hcl and every *.tfvars, which
hid two things that belong in version control:
- .terraform.lock.hcl pins the provider hashes. versions.tf tracks
Telmate/proxmox 3.0.2-rc05, a release candidate, so the version
constraint alone is not enough if that tag is ever re-published.
- terraform.tfvars held one real secret (proxmox_api_token_secret) plus the
entire vms map — 7 VMs with their vmids, sizes and static IPs. That is
infra definition, and it existed only on one laptop. Meanwhile the
committed terraform.tfvars.example still advertised web1/db1.
Split at the credential boundary: the provider auth triple stays in the
gitignored terraform.tfvars, everything else moves to vms.auto.tfvars, which
is committed and auto-loaded (no -var-file needed). terraform.tfvars.example
is now credentials-only. `tofu plan` reports no changes.
State stays ignored — it carries cloud-init attributes and should not be in
git. Noted in the README that it has no remote backend, and that state
manages two VMs (bastion-box, nonkeiwaisi-box) the map does not declare.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
