122 lines
3.8 KiB
HCL
122 lines
3.8 KiB
HCL
terraform {
|
|
required_providers {
|
|
proxmox = {
|
|
source = "bpg/proxmox"
|
|
version = "~> 0.61.0"
|
|
}
|
|
}
|
|
}
|
|
|
|
# Bare Metal Host Configurations (SSH Provisioning)
|
|
|
|
# We use a null_resource to run imperative commands on the Debian host
|
|
# that are not currently supported by the bpg/proxmox provider.
|
|
resource "null_resource" "bare_metal_setup" {
|
|
triggers = {
|
|
node = var.node_name
|
|
data_disk_id = var.data_disk_id
|
|
pool_name = var.zfs_pool_name
|
|
}
|
|
|
|
connection {
|
|
type = "ssh"
|
|
user = "root"
|
|
# Assuming running locally on the node during bootstrap, or via SSH if run from a laptop.
|
|
# We default to local host if run from Control Center, but for flexibility we use the endpoint.
|
|
host = var.node_name
|
|
agent = true
|
|
}
|
|
|
|
provisioner "remote-exec" {
|
|
inline = [
|
|
# Set laptop lid switch to ignore (prevents sleeping when closed)
|
|
"sed -i 's/^#\\?HandleLidSwitch=.*/HandleLidSwitch=ignore/' /etc/systemd/logind.conf",
|
|
"systemctl restart systemd-logind",
|
|
|
|
# Format the ZFS pool if it doesn't already exist
|
|
"zpool list ${var.zfs_pool_name} || zpool create -f ${var.zfs_pool_name} /dev/disk/by-id/${var.data_disk_id}",
|
|
|
|
# Register the ZFS pool in Proxmox if it's not already registered
|
|
"pvesm status -storage ${var.zfs_pool_name} || pvesm add zfspool ${var.zfs_pool_name} --pool ${var.zfs_pool_name} --content images,rootdir"
|
|
]
|
|
}
|
|
}
|
|
|
|
# Resource Pools
|
|
|
|
# Creates logical groups for organizing and securing VMs.
|
|
resource "proxmox_virtual_environment_pool" "core" {
|
|
pool_id = "core"
|
|
comment = "Critical, public-facing services (reverse proxy, DNS)"
|
|
}
|
|
|
|
resource "proxmox_virtual_environment_pool" "production" {
|
|
pool_id = "production"
|
|
comment = "Stable services with backup strategies"
|
|
}
|
|
|
|
resource "proxmox_virtual_environment_pool" "dev" {
|
|
pool_id = "dev"
|
|
comment = "Persistent but non-production services, run 24/7"
|
|
}
|
|
|
|
resource "proxmox_virtual_environment_pool" "staging" {
|
|
pool_id = "staging"
|
|
comment = "Ephemeral test VMs managed by Pull-Based PR webhooks"
|
|
}
|
|
|
|
# API Tokens for Control Center
|
|
|
|
# Creates a restricted user for the Control Center VM to manage the cluster.
|
|
resource "proxmox_virtual_environment_role" "control_center_role" {
|
|
role_id = "ControlCenter"
|
|
|
|
privileges = [
|
|
"VM.Allocate",
|
|
"VM.Audit",
|
|
"VM.Clone",
|
|
"VM.Config.CDROM",
|
|
"VM.Config.CPU",
|
|
"VM.Config.Disk",
|
|
"VM.Config.HWType",
|
|
"VM.Config.Memory",
|
|
"VM.Config.Network",
|
|
"VM.Config.Options",
|
|
"VM.Monitor",
|
|
"VM.PowerMgmt",
|
|
"Datastore.AllocateSpace",
|
|
"Datastore.Audit",
|
|
"SDN.Use"
|
|
]
|
|
}
|
|
|
|
resource "proxmox_virtual_environment_user" "control_center_user" {
|
|
user_id = "control-center@pve"
|
|
comment = "Managed by OpenTofu - Used by Control Center for GitOps"
|
|
}
|
|
|
|
# Grant full VM access to the control center
|
|
resource "proxmox_virtual_environment_acl" "control_center_vms" {
|
|
user_id = proxmox_virtual_environment_user.control_center_user.user_id
|
|
role_id = proxmox_virtual_environment_role.control_center_role.role_id
|
|
path = "/vms"
|
|
}
|
|
|
|
# Grant datastore access
|
|
resource "proxmox_virtual_environment_acl" "control_center_storage" {
|
|
user_id = proxmox_virtual_environment_user.control_center_user.user_id
|
|
role_id = proxmox_virtual_environment_role.control_center_role.role_id
|
|
path = "/storage/${var.zfs_pool_name}"
|
|
}
|
|
|
|
resource "proxmox_virtual_environment_user_token" "control_center_token" {
|
|
user_id = proxmox_virtual_environment_user.control_center_user.user_id
|
|
token_name = "gitops"
|
|
comment = "Stored only on the Control Center VM"
|
|
}
|
|
|
|
output "control_center_api_token" {
|
|
value = proxmox_virtual_environment_user_token.control_center_token.value
|
|
sensitive = true
|
|
description = "The secret API token for control-center@pve. This will be injected into the Control Center SOPS config."
|
|
}
|