71 lines
2.1 KiB
HCL
71 lines
2.1 KiB
HCL
terraform {
|
|
required_providers {
|
|
proxmox = {
|
|
source = "bpg/proxmox"
|
|
version = "~> 0.61.0"
|
|
}
|
|
}
|
|
}
|
|
|
|
# This bootstrap state must be run manually ONCE with the root@pam credentials
|
|
# to establish the restricted terraform@pve user for the rest of the CI pipeline.
|
|
provider "proxmox" {
|
|
# Configuration can be passed via environment variables:
|
|
# PROXMOX_VE_ENDPOINT=https://your-proxmox-ip:8006/
|
|
# PROXMOX_VE_USERNAME=root@pam
|
|
# PROXMOX_VE_PASSWORD=your-root-password
|
|
# PROXMOX_VE_INSECURE=true # If using self-signed certs
|
|
}
|
|
|
|
resource "proxmox_virtual_environment_role" "terraform_prov" {
|
|
role_id = "TerraformProv"
|
|
|
|
privileges = [
|
|
"VM.Allocate",
|
|
"VM.Audit",
|
|
"VM.Clone",
|
|
"VM.Config.CDROM",
|
|
"VM.Config.CPU",
|
|
"VM.Config.Disk",
|
|
"VM.Config.HWType",
|
|
"VM.Config.Memory",
|
|
"VM.Config.Network",
|
|
"VM.Config.Options",
|
|
"VM.Monitor",
|
|
"VM.PowerMgmt",
|
|
"Datastore.AllocateSpace",
|
|
"Datastore.Audit",
|
|
"SDN.Use"
|
|
]
|
|
}
|
|
|
|
resource "proxmox_virtual_environment_user" "terraform_user" {
|
|
user_id = "terraform@pve"
|
|
comment = "Managed by Terraform (proxmox-bootstrap) for GitOps CI/CD"
|
|
}
|
|
|
|
resource "proxmox_virtual_environment_acl" "terraform_vms" {
|
|
user_id = proxmox_virtual_environment_user.terraform_user.user_id
|
|
role_id = proxmox_virtual_environment_role.terraform_prov.role_id
|
|
path = "/vms"
|
|
}
|
|
|
|
resource "proxmox_virtual_environment_acl" "terraform_storage" {
|
|
user_id = proxmox_virtual_environment_user.terraform_user.user_id
|
|
role_id = proxmox_virtual_environment_role.terraform_prov.role_id
|
|
# Update this path to match your actual local-zfs or TrueNAS mounted storage
|
|
path = "/storage/local-zfs"
|
|
}
|
|
|
|
resource "proxmox_virtual_environment_user_token" "terraform_token" {
|
|
user_id = proxmox_virtual_environment_user.terraform_user.user_id
|
|
token_id = "tf-automation"
|
|
privsep = false
|
|
comment = "Token for Forgejo CI/CD to provision VMs"
|
|
}
|
|
|
|
output "terraform_api_token" {
|
|
value = proxmox_virtual_environment_user_token.terraform_token.value
|
|
sensitive = true
|
|
description = "The secret API token for terraform@pve. Save this to Forgejo Secrets as PROXMOX_VE_API_TOKEN."
|
|
}
|