counterweight
35b3817e15
The root .gitignore excluded .terraform.lock.hcl and every *.tfvars, which hid two things that belong in version control: - .terraform.lock.hcl pins the provider hashes. versions.tf tracks Telmate/proxmox 3.0.2-rc05, a release candidate, so the version constraint alone is not enough if that tag is ever re-published. - terraform.tfvars held one real secret (proxmox_api_token_secret) plus the entire vms map — 7 VMs with their vmids, sizes and static IPs. That is infra definition, and it existed only on one laptop. Meanwhile the committed terraform.tfvars.example still advertised web1/db1. Split at the credential boundary: the provider auth triple stays in the gitignored terraform.tfvars, everything else moves to vms.auto.tfvars, which is committed and auto-loaded (no -var-file needed). terraform.tfvars.example is now credentials-only. `tofu plan` reports no changes. State stays ignored — it carries cloud-init attributes and should not be in git. Noted in the README that it has no remote backend, and that state manages two VMs (bastion-box, nonkeiwaisi-box) the map does not declare. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
7 lines
356 B
Text
7 lines
356 B
Text
# Provider credentials. Copy to terraform.tfvars (gitignored) and fill in.
|
|
# Everything else — the node, storage, template, SSH key and the vms map —
|
|
# is committed in vms.auto.tfvars and needs no local copy.
|
|
|
|
proxmox_api_url = "https://nodito:8006/api2/json"
|
|
proxmox_api_token_id = "root@pam!tofu"
|
|
proxmox_api_token_secret = "REPLACE_ME"
|