OpenStaticFish/TerraHome-pre-k8s
1
0
Fork 0
Code Pull Requests Activity
130 Commits 3 Branches 1 Tag
master
Commit Graph
68 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
micqdf ba1884bbc5 Merge pull request 'chore: disable VM tailscale bootstrap for now' (#32) from stage into master 
Reviewed-on: micqdf/TerraHome#32
 2026-02-28 13:47:11 +00:00
micqdf c516c8ba35 chore: disable VM tailscale bootstrap for now 
Remove tailscale auth/bootstrap from cloud-init and workflows, keeping VM provisioning focused on core network behind pfSense while preserving SSH key cloud-init setup.
 2026-02-28 13:46:11 +00:00
micqdf 8b8bab77b0 Merge pull request 'fix: make cloud-init tailscale bootstrap resilient' (#31) from stage into master 
Reviewed-on: micqdf/TerraHome#31
 2026-02-28 13:31:07 +00:00
micqdf 93bba9fbfc fix: make cloud-init tailscale bootstrap resilient 
Add retry loop for tailscale up during first boot and fallback without tag advertisement when tag auth is unavailable, so nodes still join tailnet.
 2026-02-28 13:24:24 +00:00
micqdf 6ef807e59c Merge pull request 'refactor: move tailscale join fully into cloud-init' (#30) from stage into master 
Reviewed-on: micqdf/TerraHome#30
 2026-02-28 13:20:48 +00:00
micqdf 8887a8bb87 refactor: move tailscale join fully into cloud-init 
Remove guest-agent enrollment workflow, pass TS auth key through Terraform variables/secrets, and run tailscale up with tag:k8s during cloud-init bootstrap alongside SSH key injection.
 2026-02-28 13:13:34 +00:00
micqdf 32b1fcec58 Merge pull request 'fix: use POST for Proxmox guest agent ping endpoint' (#29) from stage into master 
Reviewed-on: micqdf/TerraHome#29
 2026-02-28 13:03:18 +00:00
micqdf c87bb16f10 fix: use POST for Proxmox guest agent ping endpoint 
Proxmox returns 501 for GET /agent/ping; switch to POST so tailscale enrollment can detect guest-agent readiness.
 2026-02-28 13:02:02 +00:00
micqdf a891109ee9 Merge pull request 'stage' (#28) from stage into master 
Reviewed-on: micqdf/TerraHome#28
 2026-02-28 12:58:11 +00:00
micqdf 0ea9888854 fix: include SSH key variable in destroy workflow 
Pass SSH_KEY_PUBLIC in secrets.auto.tfvars so terraform destroy plan no longer prompts for required cloud-init variable.
 2026-02-28 12:56:51 +00:00
micqdf 3261b18f37 improve: fail fast and surface guest-agent API errors 
Reduce agent wait timeout and print HTTP/auth errors during enrollment so hangs are visible and permission issues are diagnosable.
 2026-02-28 12:52:15 +00:00
micqdf 2d455929bd Merge pull request 'stage' (#27) from stage into master 
Reviewed-on: micqdf/TerraHome#27
 2026-02-28 12:48:21 +00:00
micqdf 9740e9c6fb fix: strip newlines from SSH_KEY_PUBLIC secret in workflows 
Normalize SSH public key secret before writing secrets.auto.tfvars so wrapped/multiline key pastes do not break Terraform parsing.
 2026-02-28 12:46:25 +00:00
micqdf f12e15e566 Merge remote-tracking branch 'origin/master' into stage 2026-02-28 12:45:15 +00:00
micqdf b3521d6c02 chore: remove baked SSH key from template user 
Rely on cloud-init SSH key injection from secrets for access rotation instead of storing an authorized key in the template config.
 2026-02-28 12:45:04 +00:00
micqdf 17834b3aa7 update: rotate SSH access via cloud-init secret 
Inject SSH public key through Terraform/cloud-init from Gitea secret so access can be rotated without rebuilding the template image.
 2026-02-28 12:36:20 +00:00
micqdf 017d5ce00d Merge pull request 'stage' (#26) from stage into master 
Reviewed-on: micqdf/TerraHome#26
 2026-02-28 12:14:24 +00:00
micqdf 6fada2f32a refactor: use direct tailscale auth-key enrollment 
Stop writing auth keys to guest files and enroll nodes by running tailscale up directly via Proxmox guest agent with VM-name hostnames.
 2026-02-28 12:12:58 +00:00
micqdf 510ba707ad fix: stabilize tailscale enrollment without cloud-init rollback 
Create /etc/tailscale before writing runtime key, add progress logging and unbuffered output in enroll script, and shorten guest-agent wait to fail faster when enrollment cannot run.
 2026-02-28 12:09:40 +00:00
micqdf a2d61d6972 Merge pull request 'fix: make tailscale enrollment resilient when guest agent is unavailable' (#25) from stage into master 
Reviewed-on: micqdf/TerraHome#25
 2026-02-28 11:36:29 +00:00
micqdf 6fbc4dd80f fix: make tailscale enrollment resilient when guest agent is unavailable 
Increase guest-agent wait window and treat agent-unavailable as warning by default, while keeping strict failure optional via TAILSCALE_ENROLL_STRICT secret.
 2026-02-28 10:34:46 +00:00
micqdf 5acb8370cc Merge pull request 'fix: parse terraform output JSON robustly in enroll step' (#24) from stage into master 
Reviewed-on: micqdf/TerraHome#24
 2026-02-28 02:29:06 +00:00
micqdf f207f774de fix: parse terraform output JSON robustly in enroll step 
Handle setup-terraform wrapper prefixes by decoding from first JSON object before reading VM outputs.
 2026-02-28 02:21:57 +00:00
micqdf 1a309cbe4f Merge pull request 'feat: enroll tailscale via Proxmox guest agent by VMID' (#23) from stage into master 
Reviewed-on: micqdf/TerraHome#23
 2026-02-28 02:16:58 +00:00
micqdf 83d277d144 feat: enroll tailscale via Proxmox guest agent by VMID 
Replace SSH/IP-based enrollment with Proxmox API guest-agent execution using Terraform outputs, set per-VM hostnames from resource names, and reset cloned tailscale state before join for unique node identities.
 2026-02-28 02:14:39 +00:00
micqdf 5e1fd2e9f3 Merge pull request 'fix: make tailscale enrollment clone-safe and hostname-aware' (#22) from stage into master 
Reviewed-on: micqdf/TerraHome#22
 2026-02-28 02:02:49 +00:00
micqdf 3335020db5 fix: make tailscale enrollment clone-safe and hostname-aware 
Reset cloned tailscale state before first join, remove one-shot marker dependency, and allow workflow host entries in host=hostname format so nodes join with VM-aligned tailscale names.
 2026-02-28 02:01:48 +00:00
micqdf 9ce06671c9 Merge pull request 'fix: align VM boot disk and add Terraform safety workflows' (#21) from stage into master 
Reviewed-on: micqdf/TerraHome#21
 2026-02-28 01:26:59 +00:00
micqdf a7f68c0c4b fix: tolerate extra output in destroy guard parser 
Parse the first JSON object from terraform show output to avoid failures when extra non-JSON lines are present.
 2026-02-28 01:23:07 +00:00
micqdf d1a7ccc98c chore: serialize Terraform workflows to prevent races 
Add global workflow concurrency group with queueing enabled so plan/apply/destroy runs do not overlap and contend for shared remote state.
 2026-02-28 01:17:51 +00:00
micqdf afe19041d9 fix: make destroy guard parse tfplan JSON robustly 
Use terraform show with no-color and resilient JSON extraction to avoid parser failures when workflow output includes non-JSON noise.
 2026-02-28 01:16:19 +00:00
micqdf c9be2a2fc8 fix: align VM boot disk and add Terraform safety workflows 
Switch VM boot order/disks to scsi0 to match cloned NixOS template boot layout, add destroy guards to plan/apply workflows, and replace destroy workflow with a confirmed manual dispatch nuke flow that uses remote B2 state.
 2026-02-28 01:10:31 +00:00
micqdf 5fc58dfc98 Merge pull request 'stage' (#20) from stage into master 
Reviewed-on: micqdf/TerraHome#20
 2026-02-28 01:01:31 +00:00
micqdf 1c4a27bca3 Merge branch 'master' into stage 2026-02-28 01:00:47 +00:00
micqdf 47f950d667 fix: update S3 backend config for Terraform init 
Use non-deprecated s3 endpoint settings, switch to use_path_style, and trim newline characters from B2 credentials when generating backend.hcl in CI.
 2026-02-28 00:56:12 +00:00
micqdf b0768db7a7 feat: store Terraform state in Backblaze B2 
Configure an s3 backend and initialize Terraform in CI with backend config from Gitea secrets so state persists across runs and apply operations stay consistent.
 2026-02-28 00:52:40 +00:00
micqdf c0dd091b51 chore: align template base with live VM config 
Set NixOS stateVersion to 25.05 and include neovim in the default utility package set.
 2026-02-28 00:44:08 +00:00
micqdf 595df12b3e update: automate tailscale enrollment from Gitea secrets 
Add a first-boot tailscale enrollment service to the NixOS template and wire terraform-apply to inject TS auth key at runtime from secrets, so keys are not baked into templates or repo files.
 2026-02-28 00:33:14 +00:00
micqdf 735e9df9f1 Merge pull request 'stage' (#19) from stage into master 
Reviewed-on: micqdf/TerraHome#19
 2026-02-28 00:13:24 +00:00
micqdf e714a56980 update: switch Terraform to NixOS template workflow 
- Point clone_template to nixos-template and trim cloud-init to Nix-safe hostname/DNS only
- Remove SSH/Tailscale cloud-init variables and workflow secret dependencies
- Add reusable NixOS template-base config with bootloader, Tailscale, fish, and utility packages
 2026-02-28 00:06:25 +00:00
micqdf 4247d16c24 fix: upgrade proxmox provider for Proxmox 9 permissions 
Move Telmate provider to 3.0.2-rc07, which includes Proxmox 9 permission compatibility and avoids requiring deprecated VM.Monitor.
 2026-02-27 21:04:44 +00:00
micqdf 59fbbb07df fix: load static token id and validate token secret 
- Store non-sensitive Proxmox token id in terraform.tfvars
- Inject only token secret via workflow-generated secrets.auto.tfvars
- Add variable validations for token id format and non-empty token secret
- Add workflow debug output for token secret length and selected token id
 2026-02-27 21:00:44 +00:00
micqdf c3a0ef251c debug: show secret lengths to verify they are set 2026-02-27 20:56:41 +00:00
micqdf 841abb8fe3 fix: create secrets.auto.tfvars dynamically in workflow 
- Generate secrets.auto.tfvars file during workflow run
- Terraform automatically loads *.auto.tfvars files
- This bypasses any issues with TF_VAR_ environment variables
 2026-02-27 20:48:41 +00:00
micqdf 364dc6b35b fix: use TF_VAR_ prefix for token credentials 
- Restore pm_api_token_id and pm_api_token_secret variables
- Use TF_VAR_pm_api_token_id and TF_VAR_pm_api_token_secret env vars
- This is the standard Terraform way to pass variables via environment
 2026-02-27 20:43:39 +00:00
micqdf 9c1476b6bf fix: use PM_API_TOKEN_ID/SECRET env vars directly 
- Remove token from Terraform variables (provider reads from env)
- Update workflows to set PM_API_TOKEN_ID and PM_API_TOKEN_SECRET directly
- Provider now reads credentials from environment variables
 2026-02-27 20:36:44 +00:00
micqdf 4a123e0fb6 fix: apply terraform fmt 2026-02-27 20:27:20 +00:00
micqdf 5633d18276 fix: terraform fmt alignment 2026-02-27 20:22:44 +00:00
micqdf c6fc9edcc4 fix: terraform fmt formatting 2026-02-27 20:06:23 +00:00
micqdf c8b86c7443 fix: switch to API token authentication for Proxmox 
- Replace user/password auth with API token auth
- Update provider config to use pm_api_token_id and pm_api_token_secret
- Update workflow secrets to use PM_API_TOKEN_ID and PM_API_TOKEN_SECRET
- Remove unused pm_user and proxmox_password variables
 2026-02-27 20:02:22 +00:00
micqdf 79b535bb59 fix: code quality improvements 
- Remove duplicate variables (alpaca_count, llama_count)
- Remove unused variables (vm_name, disk_type)
- Fix outputs to use correct variable names
- Fix cloud-init template to not overwrite source file
- Fix hardcoded hostname in cloud-init template
- Fix typo in SSH_KEY_PUBLIC description
 2026-02-27 01:25:25 +00:00
micqdf 84e45b4c61 Merge pull request 'stage' (#18) from stage into master 
Reviewed-on: micqdf/TerraHome#18
 2025-04-18 11:14:21 +00:00
micqdf bada1b69da Merge pull request 'stage' (#17) from stage into master 
Reviewed-on: micqdf/TerraHome#17
 2025-04-18 10:43:01 +00:00
micqdf 8d9eea6728 Merge pull request 'terraform fmt' (#16) from stage into master 
Reviewed-on: micqdf/TerraHome#16
 2025-04-17 21:54:27 +00:00
micqdf 8d49e447e6 Merge pull request 'terraform fmt' (#15) from stage into master 
Reviewed-on: micqdf/TerraHome#15
 2025-04-17 21:40:34 +00:00
micqdf d634e124a3 Merge pull request 'stage' (#14) from stage into master 
Reviewed-on: micqdf/TerraHome#14
 2025-04-17 21:29:51 +00:00
micqdf 70139b2693 Merge pull request 'terraform fmt' (#13) from stage into master 
Reviewed-on: micqdf/TerraHome#13
 2025-04-17 21:18:18 +00:00
micqdf 1b6eca0f69 Merge pull request 'stage' (#12) from stage into master 
Reviewed-on: micqdf/TerraHome#12
 2025-04-17 21:00:27 +00:00
micqdf 3e55a72767 Merge pull request 'stage' (#11) from stage into master 
Reviewed-on: micqdf/TerraHome#11
 2025-04-17 20:27:27 +00:00
micqdf b26ff582a4 Merge pull request 'terraform fmt' (#10) from stage into master 
Reviewed-on: micqdf/TerraHome#10
 2025-04-17 18:24:08 +00:00
micqdf 114bfb9772 Merge pull request 'stage' (#8) from stage into master 
Reviewed-on: micqdf/TerraHome#8
 2025-04-17 16:12:34 +00:00
micqdf 5509e14066 Merge pull request 'stage' (#7) from stage into master 
Reviewed-on: micqdf/TerraHome#7
 2025-04-17 15:15:02 +00:00
micqdf df088a7903 Merge pull request 'terraform apply' (#6) from stage into master 
Reviewed-on: micqdf/TerraHome#6
 2025-04-17 14:06:19 +00:00
micqdf dcec6c3648 Merge pull request 'stage' (#5) from stage into master 
Reviewed-on: micqdf/TerraHome#5
 2025-04-17 12:46:36 +00:00
micqdf a0ee1b8a4b Merge pull request 'terraform apply' (#4) from stage into master 
Reviewed-on: micqdf/TerraHome#4
 2025-04-17 12:19:34 +00:00
micqdf 39d4e2ac65 Merge pull request 'terraform apply' (#3) from stage into master 
Reviewed-on: micqdf/TerraHome#3
 2025-04-17 10:22:41 +00:00
micqdf 6d06cfac02 Merge pull request 'terraform apply' (#2) from stage into master 
Reviewed-on: micqdf/TerraHome#2
 2025-04-17 10:11:32 +00:00
micqdf e669353638 Merge pull request 'terraform apply' (#1) from stage into master 
Reviewed-on: micqdf/TerraHome#1
 2025-04-17 10:04:50 +00:00