refactor: extract generic workload-layer from node configs

opentofu/workload-layer/production/main.tf

@@ -0,0 +1,80 @@
+terraform {
+  required_providers {
+    proxmox = {
+      source  = "bpg/proxmox"
+      version = "~> 0.61.0"
+    }
+  }
+}
+
+provider "proxmox" {
+  # Endpoint and credentials will be picked up from environment variables 
+  # or passed via the bootstrap script.
+  # PROXMOX_VE_ENDPOINT
+  # PROXMOX_VE_USERNAME 
+  # PROXMOX_VE_PASSWORD
+  # PROXMOX_VE_INSECURE=true
+}
+
+module "proxmox_node" {
+  source = "../../modules/proxmox-node"
+  node_name = "mikoshi"
+  zfs_pool_name = "data"
+}
+
+output "control_center_api_token" {
+  value       = module.proxmox_node.control_center_api_token
+  sensitive   = true
+  description = "The secret API token for control-center@pve."
+}
+
+resource "proxmox_virtual_environment_vm" "control_center" {
+  depends_on = [module.proxmox_node]
+  
+  name        = "izanagi"
+  description = "Managed by OpenTofu - GitOps Control Center"
+  tags        = ["infrastructure", "gitops"]
+  node_name   = "mikoshi"
+  vm_id       = 100001000
+
+  on_boot = true
+  
+  pool_id = "core"
+
+  cpu {
+    cores = 2
+    type  = "x86-64-v2-AES"
+  }
+
+  memory {
+    dedicated = 2048
+  }
+
+  agent {
+    enabled = true
+  }
+
+  network_device {
+    bridge = "vmbr0"
+  }
+
+  clone {
+    vm_id = 9000
+    full  = true
+  }
+
+  # Cloud-Init for initial SSH access and SOPS age key injection
+  initialization {
+    ip_config {
+      ipv4 {
+        address = "dhcp"
+      }
+    }
+    user_account {
+      username = "gh0st"
+      keys     = [
+        "sk-ssh-ed25519@openssh.com AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAIHOoTp+e6qWGn4Sco5CZ6G0zrX5NAQBpLlDVirncJ/HqAAAABHNzaDo="
+      ]
+    }
+  }
+}

opentofu/workload-layer/staging/main.tf

@@ -0,0 +1,131 @@
+terraform {
+  required_providers {
+    proxmox = {
+      source  = "bpg/proxmox"
+      version = "~> 0.61.0"
+    }
+    truenas = {
+      source  = "deevus/truenas"
+      version = "~> 0.1.0"
+    }
+  }
+}
+
+variable "vm_id" {
+  description = "The ID of the VM to create (should be unique per PR)"
+  type        = number
+}
+
+variable "pr_number" {
+  description = "The Pull Request number for this staging environment"
+  type        = string
+}
+
+variable "truenas_snapshot_id" {
+  description = "The ID of the TrueNAS snapshot to clone"
+  type        = string
+}
+
+provider "proxmox" {
+  # Relies on PROXMOX_VE_ENDPOINT and PROXMOX_VE_API_TOKEN environment variables
+}
+
+provider "truenas" {
+  # Relies on TRUENAS_API_KEY and TRUENAS_BASE_URL environment variables
+}
+
+resource "truenas_dataset" "staging_clone" {
+  pool        = "tank"
+  path        = "production/staging-pr-${var.pr_number}"
+  snapshot_id = var.truenas_snapshot_id
+}
+
+resource "proxmox_virtual_environment_vm" "staging_vm" {
+  name        = "staging-pr-${var.pr_number}"
+  description = "Ephemeral staging environment for PR #${var.pr_number}"
+  node_name   = "pve"
+  vm_id       = var.vm_id
+
+  # Clone from the latest golden image template
+  clone {
+    vm_id = 9000
+    full  = true
+  }
+
+  agent {
+    enabled = true
+  }
+
+  cpu {
+    cores = 2
+  }
+
+  memory {
+    dedicated = 2048
+  }
+
+  network_device {
+    bridge   = "vmbr0"
+    firewall = true
+  }
+
+  # Cloud-Init configuration to inject the staging age key and set up networking
+
+    initialization {
+    ip_config {
+      ipv4 {
+        address = "dhcp"
+      }
+    }
+
+    user_data_file_id = "local:snippets/staging-key.yaml"
+  }
+}
+
+
+
+resource "proxmox_virtual_environment_firewall_options" "staging_vm_fw_options" {
+  vm_id      = proxmox_virtual_environment_vm.staging_vm.vm_id
+  node_name  = proxmox_virtual_environment_vm.staging_vm.node_name
+  enable     = true
+  policy_in  = "ACCEPT" 
+  policy_out = "DROP"
+}
+
+resource "proxmox_virtual_environment_firewall_rules" "staging_vm_rules" {
+  vm_id     = proxmox_virtual_environment_vm.staging_vm.vm_id
+  node_name = proxmox_virtual_environment_vm.staging_vm.node_name
+
+  rule {
+    action  = "ACCEPT"
+    type    = "out"
+    dest    = "192.168.0.11"
+    comment = "Allow traffic to TrueNAS"
+  }
+
+  rule {
+    action  = "ACCEPT"
+    type    = "out"
+    dest    = "192.168.0.1"
+    comment = "Allow traffic to Gateway/DNS"
+  }
+
+  rule {
+    action  = "DROP"
+    type    = "out"
+    dest    = "192.168.0.0/24"
+    comment = "Drop traffic to local homelab"
+  }
+
+  rule {
+    action  = "ACCEPT"
+    type    = "out"
+    dest    = "0.0.0.0/0"
+    comment = "Allow outbound internet traffic"
+  }
+}
+
+output "staging_vm_ip" {
+  value       = proxmox_virtual_environment_vm.staging_vm.ipv4_addresses[1][0] # Adjust index based on actual returned interfaces
+  description = "The IP address of the newly spun up staging VM."
+}