counterweight
35b3817e15
The root .gitignore excluded .terraform.lock.hcl and every *.tfvars, which hid two things that belong in version control: - .terraform.lock.hcl pins the provider hashes. versions.tf tracks Telmate/proxmox 3.0.2-rc05, a release candidate, so the version constraint alone is not enough if that tag is ever re-published. - terraform.tfvars held one real secret (proxmox_api_token_secret) plus the entire vms map — 7 VMs with their vmids, sizes and static IPs. That is infra definition, and it existed only on one laptop. Meanwhile the committed terraform.tfvars.example still advertised web1/db1. Split at the credential boundary: the provider auth triple stays in the gitignored terraform.tfvars, everything else moves to vms.auto.tfvars, which is committed and auto-loaded (no -var-file needed). terraform.tfvars.example is now credentials-only. `tofu plan` reports no changes. State stays ignored — it carries cloud-init attributes and should not be in git. Noted in the README that it has no remote backend, and that state manages two VMs (bastion-box, nonkeiwaisi-box) the map does not declare. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
23 lines
No EOL
556 B
Text
23 lines
No EOL
556 B
Text
# OpenTofu / Terraform
|
|
.terraform/
|
|
.tofu/
|
|
terraform.tfstate
|
|
terraform.tfstate.*
|
|
crash.log
|
|
|
|
# Provider credentials only. Non-secret infra config (the vms map) is committed
|
|
# as *.auto.tfvars, and *.lock.hcl is committed on purpose so provider hashes
|
|
# are pinned.
|
|
terraform.tfvars
|
|
terraform.tfvars.json
|
|
*secrets.auto.tfvars
|
|
|
|
venv/*
|
|
.env
|
|
|
|
# Secrets are ansible-vault encrypted and ARE committed.
|
|
# Anything matching *_secrets.plain.yml is a working decryption — never commit those.
|
|
*_secrets.plain.yml
|
|
|
|
# Vault password — never commit
|
|
ansible/.vault_pass |