terraform {
  required_providers {
    proxmox = {
      source  = "bpg/proxmox"
      version = "~> 0.61.0"
    }
  }
}

provider "proxmox" {
  # Endpoint and credentials will be picked up from environment variables 
  # or passed via the bootstrap script.
  # PROXMOX_VE_ENDPOINT
  # PROXMOX_VE_USERNAME 
  # PROXMOX_VE_PASSWORD
  # PROXMOX_VE_INSECURE=true
}

module "proxmox_node" {
  source = "../../modules/proxmox-node"
  node_name = "mikoshi"
  data_disk_id = "nvme-KXG80ZNV2T04_NVMe_KIOXIA_2048GB_241C11Y5EHAK"
  zfs_pool_name = "data"
}

output "control_center_api_token" {
  value       = module.proxmox_node.control_center_api_token
  sensitive   = true
  description = "The secret API token for control-center@pve."
}

resource "proxmox_virtual_environment_vm" "control_center" {
  depends_on = [module.proxmox_node]
  
  name        = "izanagi"
  description = "Managed by OpenTofu - GitOps Control Center"
  tags        = ["infrastructure", "gitops"]
  node_name   = "mikoshi"
  vm_id       = 100001000

  on_boot = true
  
  pool_id = "core"

  cpu {
    cores = 2
    type  = "x86-64-v2-AES"
  }

  memory {
    dedicated = 2048
  }

  agent {
    enabled = true
  }

  network_device {
    bridge = "vmbr0"
  }

  clone {
    vm_id = 9000
    full  = true
  }

  # Cloud-Init for initial SSH access and SOPS age key injection
  initialization {
    ip_config {
      ipv4 {
        address = "dhcp"
      }
    }
    user_account {
      username = "gh0st"
      keys     = [
        "sk-ssh-ed25519@openssh.com AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAIHOoTp+e6qWGn4Sco5CZ6G0zrX5NAQBpLlDVirncJ/HqAAAABHNzaDo="
      ]
    }
  }
}