feat(staging): implement ephemeral staging VM provisioning and TrueNAS snapshot clone workflow

terraform/staging-env/main.tf

@@ -0,0 +1,96 @@
+terraform {
+  required_providers {
+    proxmox = {
+      source  = "bpg/proxmox"
+      version = "~> 0.61.0"
+    }
+  }
+}
+
+variable "vm_id" {
+  description = "The ID of the VM to create (should be unique per PR)"
+  type        = number
+}
+
+variable "pr_number" {
+  description = "The Pull Request number for this staging environment"
+  type        = string
+}
+
+variable "staging_age_key" {
+  description = "The private age key for decrypting staging secrets. Injected via Cloud-Init."
+  type        = string
+  sensitive   = true
+}
+
+provider "proxmox" {
+  # Relies on PROXMOX_VE_ENDPOINT and PROXMOX_VE_API_TOKEN environment variables
+}
+
+resource "proxmox_virtual_environment_vm" "staging_vm" {
+  name        = "staging-pr-${var.pr_number}"
+  description = "Ephemeral staging environment for PR #${var.pr_number}"
+  node_name   = "pve"
+  vm_id       = var.vm_id
+
+  # Clone from the latest golden image template
+  clone {
+    vm_id = 9000
+    full  = true
+  }
+
+  agent {
+    enabled = true
+  }
+
+  cpu {
+    cores = 2
+  }
+
+  memory {
+    dedicated = 2048
+  }
+
+  network_device {
+    bridge = "vmbr0"
+    # Assign a specific VLAN tag for staging isolation if configured on your switch
+    # vlan_id = 50 
+  }
+
+  # Cloud-Init configuration to inject the staging age key and set up networking
+  initialization {
+    ip_config {
+      ipv4 {
+        address = "dhcp"
+      }
+    }
+
+    user_data_file_id = proxmox_virtual_environment_file.cloud_config.id
+  }
+}
+
+resource "proxmox_virtual_environment_file" "cloud_config" {
+  content_type = "snippets"
+  datastore_id = "local-zfs"
+  node_name    = "pve"
+
+  source_raw {
+    data = <<-EOF
+    #cloud-config
+    write_files:
+      - path: /var/lib/sops-nix/key.txt
+        permissions: '0600'
+        content: |
+          ${indent(10, var.staging_age_key)}
+    runcmd:
+      - echo "Staging age key injected successfully."
+    EOF
+
+    file_name = "staging-pr-${var.pr_number}-cloud-init.yaml"
+  }
+}
+
+output "staging_vm_ip" {
+  value       = proxmox_virtual_environment_vm.staging_vm.ipv4_addresses[1][0] # Adjust index based on actual returned interfaces
+  description = "The IP address of the newly spun up staging VM."
+}