89 lines
2.5 KiB
HCL
89 lines
2.5 KiB
HCL
terraform {
|
|
required_providers {
|
|
proxmox = {
|
|
source = "bpg/proxmox"
|
|
version = "~> 0.61.0"
|
|
}
|
|
}
|
|
}
|
|
|
|
|
|
|
|
# Resource Pools
|
|
|
|
# Creates logical groups for organizing and securing VMs.
|
|
resource "proxmox_virtual_environment_pool" "core" {
|
|
pool_id = "core"
|
|
comment = "Critical, public-facing services (reverse proxy, DNS)"
|
|
}
|
|
|
|
resource "proxmox_virtual_environment_pool" "production" {
|
|
pool_id = "production"
|
|
comment = "Stable services with backup strategies"
|
|
}
|
|
|
|
resource "proxmox_virtual_environment_pool" "dev" {
|
|
pool_id = "dev"
|
|
comment = "Persistent but non-production services, run 24/7"
|
|
}
|
|
|
|
resource "proxmox_virtual_environment_pool" "staging" {
|
|
pool_id = "staging"
|
|
comment = "Ephemeral test VMs managed by Pull-Based PR webhooks"
|
|
}
|
|
|
|
# API Tokens for Control Center
|
|
|
|
# Creates a restricted user for the Control Center VM to manage the cluster.
|
|
resource "proxmox_virtual_environment_role" "control_center_role" {
|
|
role_id = "ControlCenter"
|
|
|
|
privileges = [
|
|
"VM.Allocate",
|
|
"VM.Audit",
|
|
"VM.Clone",
|
|
"VM.Config.CDROM",
|
|
"VM.Config.CPU",
|
|
"VM.Config.Disk",
|
|
"VM.Config.HWType",
|
|
"VM.Config.Memory",
|
|
"VM.Config.Network",
|
|
"VM.Config.Options",
|
|
"VM.Monitor",
|
|
"VM.PowerMgmt",
|
|
"Datastore.AllocateSpace",
|
|
"Datastore.Audit",
|
|
"SDN.Use"
|
|
]
|
|
}
|
|
|
|
resource "proxmox_virtual_environment_user" "control_center_user" {
|
|
user_id = "control-center@pve"
|
|
comment = "Managed by OpenTofu - Used by Control Center for GitOps"
|
|
}
|
|
|
|
# Grant full VM access to the control center
|
|
resource "proxmox_virtual_environment_acl" "control_center_vms" {
|
|
user_id = proxmox_virtual_environment_user.control_center_user.user_id
|
|
role_id = proxmox_virtual_environment_role.control_center_role.role_id
|
|
path = "/vms"
|
|
}
|
|
|
|
# Grant datastore access
|
|
resource "proxmox_virtual_environment_acl" "control_center_storage" {
|
|
user_id = proxmox_virtual_environment_user.control_center_user.user_id
|
|
role_id = proxmox_virtual_environment_role.control_center_role.role_id
|
|
path = "/storage/${var.zfs_pool_name}"
|
|
}
|
|
|
|
resource "proxmox_virtual_environment_user_token" "control_center_token" {
|
|
user_id = proxmox_virtual_environment_user.control_center_user.user_id
|
|
token_name = "gitops"
|
|
comment = "Stored only on the Control Center VM"
|
|
}
|
|
|
|
output "control_center_api_token" {
|
|
value = proxmox_virtual_environment_user_token.control_center_token.value
|
|
sensitive = true
|
|
description = "The secret API token for control-center@pve. This will be injected into the Control Center SOPS config."
|
|
}
|