From 79b535bb597d66306b88dc59199ba6d56f593ccf Mon Sep 17 00:00:00 2001 From: MichaelFisher1997 Date: Fri, 27 Feb 2026 01:25:25 +0000 Subject: [PATCH 01/12] fix: code quality improvements - Remove duplicate variables (alpaca_count, llama_count) - Remove unused variables (vm_name, disk_type) - Fix outputs to use correct variable names - Fix cloud-init template to not overwrite source file - Fix hardcoded hostname in cloud-init template - Fix typo in SSH_KEY_PUBLIC description --- terraform/cloud-init.tf | 6 ++--- ...init_global.yaml => cloud_init_global.tpl} | 3 +-- terraform/outputs.tf | 5 ++--- terraform/terraform.tfvars | 4 +--- terraform/variables.tf | 22 +------------------ 5 files changed, 7 insertions(+), 33 deletions(-) rename terraform/files/{cloud_init_global.yaml => cloud_init_global.tpl} (98%) diff --git a/terraform/cloud-init.tf b/terraform/cloud-init.tf index 39f2a71..969bc9b 100644 --- a/terraform/cloud-init.tf +++ b/terraform/cloud-init.tf @@ -1,7 +1,5 @@ -### Global cloud-init template (for all VMs) - data "template_file" "cloud_init_global" { - template = file("${path.module}/files/cloud_init_global.yaml") + template = file("${path.module}/files/cloud_init_global.tpl") vars = { hostname = "generic" @@ -13,5 +11,5 @@ data "template_file" "cloud_init_global" { resource "local_file" "cloud_init_global" { content = data.template_file.cloud_init_global.rendered - filename = "${path.module}/files/cloud_init_global.yaml" + filename = "${path.module}/files/rendered/cloud_init_global.yaml" } diff --git a/terraform/files/cloud_init_global.yaml b/terraform/files/cloud_init_global.tpl similarity index 98% rename from terraform/files/cloud_init_global.yaml rename to terraform/files/cloud_init_global.tpl index 1236010..daf3b15 100644 --- a/terraform/files/cloud_init_global.yaml +++ b/terraform/files/cloud_init_global.tpl @@ -1,6 +1,5 @@ #cloud-config -#cloud-config -hostname: myvm +hostname: ${hostname} manage_etc_hosts: true resolv_conf: nameservers: diff --git a/terraform/outputs.tf b/terraform/outputs.tf index 6c767ec..148cb0f 100644 --- a/terraform/outputs.tf +++ b/terraform/outputs.tf @@ -1,6 +1,6 @@ output "alpaca_vm_ids" { value = { - for i in range(var.alpaca_count) : + for i in range(var.alpaca_vm_count) : "alpaca-${i + 1}" => proxmox_vm_qemu.alpacas[i].vmid } } @@ -11,7 +11,7 @@ output "alpaca_vm_names" { output "llama_vm_ids" { value = { - for i in range(var.llama_count) : + for i in range(var.llama_vm_count) : "llama-${i + 1}" => proxmox_vm_qemu.llamas[i].vmid } } @@ -19,4 +19,3 @@ output "llama_vm_ids" { output "llama_vm_names" { value = [for vm in proxmox_vm_qemu.llamas : vm.name] } - diff --git a/terraform/terraform.tfvars b/terraform/terraform.tfvars index 486074c..b91f2d7 100644 --- a/terraform/terraform.tfvars +++ b/terraform/terraform.tfvars @@ -1,12 +1,10 @@ target_node = "flex" clone_template = "ubuntu-cloudinit" -vm_name = "alpine-vm" cores = 1 memory = 1024 disk_size = "15G" sockets = 1 bridge = "vmbr0" -disk_type = "scsi" storage = "Flash" pm_api_url = "https://100.105.0.115:8006/api2/json" -pm_user = "terraform-prov@pve" \ No newline at end of file +pm_user = "terraform-prov@pve" diff --git a/terraform/variables.tf b/terraform/variables.tf index c05239f..737b552 100644 --- a/terraform/variables.tf +++ b/terraform/variables.tf @@ -10,10 +10,6 @@ variable "clone_template" { type = string } -variable "vm_name" { - type = string -} - variable "cores" { type = number } @@ -34,10 +30,6 @@ variable "bridge" { type = string } -variable "disk_type" { - type = string -} - variable "storage" { type = string } @@ -50,18 +42,6 @@ variable "pm_user" { type = string } -variable "alpaca_count" { - type = number - default = 1 - description = "How many Alpaca VMs to create" -} - -variable "llama_count" { - type = number - default = 1 - description = "How many Llama VMs to create" -} - variable "alpaca_vm_count" { type = number default = 1 @@ -81,5 +61,5 @@ variable "TS_AUTHKEY" { variable "SSH_KEY_PUBLIC" { type = string - description = "My Public SSH key fo ssh auth list" + description = "My Public SSH key for ssh auth list" } From c8b86c74435b96ebee501b2bf4b6cf01a984430a Mon Sep 17 00:00:00 2001 From: MichaelFisher1997 Date: Fri, 27 Feb 2026 20:02:22 +0000 Subject: [PATCH 02/12] fix: switch to API token authentication for Proxmox - Replace user/password auth with API token auth - Update provider config to use pm_api_token_id and pm_api_token_secret - Update workflow secrets to use PM_API_TOKEN_ID and PM_API_TOKEN_SECRET - Remove unused pm_user and proxmox_password variables --- .gitea/workflows/terraform-apply.yml | 3 ++- .gitea/workflows/terraform-plan.yml | 3 ++- terraform/main.tf | 8 ++++---- terraform/terraform.tfvars | 2 +- terraform/variables.tf | 15 +++++++++------ 5 files changed, 18 insertions(+), 13 deletions(-) diff --git a/.gitea/workflows/terraform-apply.yml b/.gitea/workflows/terraform-apply.yml index 4180a91..c09caa6 100644 --- a/.gitea/workflows/terraform-apply.yml +++ b/.gitea/workflows/terraform-apply.yml @@ -18,7 +18,8 @@ jobs: env: TF_VAR_SSH_KEY_PUBLIC: ${{ secrets.SSH_KEY_PUBLIC }} TF_VAR_TS_AUTHKEY: ${{ secrets.TS_AUTHKEY }} - TF_VAR_proxmox_password: ${{ secrets.PROXMOX_PASSWORD }} + TF_VAR_pm_api_token_id: ${{ secrets.PM_API_TOKEN_ID }} + TF_VAR_pm_api_token_secret: ${{ secrets.PM_API_TOKEN_SECRET }} steps: - name: Checkout repository diff --git a/.gitea/workflows/terraform-plan.yml b/.gitea/workflows/terraform-plan.yml index 51f09d0..579437e 100644 --- a/.gitea/workflows/terraform-plan.yml +++ b/.gitea/workflows/terraform-plan.yml @@ -19,7 +19,8 @@ jobs: env: TF_VAR_SSH_KEY_PUBLIC: ${{ secrets.SSH_KEY_PUBLIC }} TF_VAR_TS_AUTHKEY: ${{ secrets.TS_AUTHKEY }} - TF_VAR_proxmox_password: ${{ secrets.PROXMOX_PASSWORD }} + TF_VAR_pm_api_token_id: ${{ secrets.PM_API_TOKEN_ID }} + TF_VAR_pm_api_token_secret: ${{ secrets.PM_API_TOKEN_SECRET }} steps: - name: Checkout repository diff --git a/terraform/main.tf b/terraform/main.tf index bfca2ee..fc6134d 100644 --- a/terraform/main.tf +++ b/terraform/main.tf @@ -8,10 +8,10 @@ terraform { } provider "proxmox" { - pm_api_url = var.pm_api_url - pm_user = var.pm_user - pm_password = var.proxmox_password - pm_tls_insecure = true + pm_api_url = var.pm_api_url + pm_api_token_id = var.pm_api_token_id + pm_api_token_secret = var.pm_api_token_secret + pm_tls_insecure = true } resource "proxmox_vm_qemu" "alpacas" { diff --git a/terraform/terraform.tfvars b/terraform/terraform.tfvars index b91f2d7..6d6354e 100644 --- a/terraform/terraform.tfvars +++ b/terraform/terraform.tfvars @@ -7,4 +7,4 @@ sockets = 1 bridge = "vmbr0" storage = "Flash" pm_api_url = "https://100.105.0.115:8006/api2/json" -pm_user = "terraform-prov@pve" +pm_api_token_id = "terraform-prov@pve!mytoken" diff --git a/terraform/variables.tf b/terraform/variables.tf index 737b552..c4f1b2c 100644 --- a/terraform/variables.tf +++ b/terraform/variables.tf @@ -1,5 +1,12 @@ -variable "proxmox_password" { - type = string +variable "pm_api_token_id" { + type = string + description = "Proxmox API token ID (format: user@realm!tokenid)" +} + +variable "pm_api_token_secret" { + type = string + sensitive = true + description = "Proxmox API token secret" } variable "target_node" { @@ -38,10 +45,6 @@ variable "pm_api_url" { type = string } -variable "pm_user" { - type = string -} - variable "alpaca_vm_count" { type = number default = 1 From c6fc9edcc48b15eef9547b17d19bf503fa254634 Mon Sep 17 00:00:00 2001 From: MichaelFisher1997 Date: Fri, 27 Feb 2026 20:06:23 +0000 Subject: [PATCH 03/12] fix: terraform fmt formatting --- terraform/main.tf | 6 +++--- terraform/terraform.tfvars | 20 ++++++++++---------- 2 files changed, 13 insertions(+), 13 deletions(-) diff --git a/terraform/main.tf b/terraform/main.tf index fc6134d..2e1a6cf 100644 --- a/terraform/main.tf +++ b/terraform/main.tf @@ -8,10 +8,10 @@ terraform { } provider "proxmox" { - pm_api_url = var.pm_api_url - pm_api_token_id = var.pm_api_token_id + pm_api_url = var.pm_api_url + pm_api_token_id = var.pm_api_token_id pm_api_token_secret = var.pm_api_token_secret - pm_tls_insecure = true + pm_tls_insecure = true } resource "proxmox_vm_qemu" "alpacas" { diff --git a/terraform/terraform.tfvars b/terraform/terraform.tfvars index 6d6354e..c4d93bf 100644 --- a/terraform/terraform.tfvars +++ b/terraform/terraform.tfvars @@ -1,10 +1,10 @@ -target_node = "flex" -clone_template = "ubuntu-cloudinit" -cores = 1 -memory = 1024 -disk_size = "15G" -sockets = 1 -bridge = "vmbr0" -storage = "Flash" -pm_api_url = "https://100.105.0.115:8006/api2/json" -pm_api_token_id = "terraform-prov@pve!mytoken" +target_node = "flex" +clone_template = "ubuntu-cloudinit" +cores = 1 +memory = 1024 +disk_size = "15G" +sockets = 1 +bridge = "vmbr0" +storage = "Flash" +pm_api_url = "https://100.105.0.115:8006/api2/json" +pm_api_token_id = "terraform-prov@pve!mytoken" From 5633d182769f88f10d2cda128d300a17ceae7503 Mon Sep 17 00:00:00 2001 From: MichaelFisher1997 Date: Fri, 27 Feb 2026 20:22:44 +0000 Subject: [PATCH 04/12] fix: terraform fmt alignment --- terraform/main.tf | 8 ++++---- terraform/terraform.tfvars | 20 ++++++++++---------- 2 files changed, 14 insertions(+), 14 deletions(-) diff --git a/terraform/main.tf b/terraform/main.tf index 2e1a6cf..c08cbdd 100644 --- a/terraform/main.tf +++ b/terraform/main.tf @@ -8,10 +8,10 @@ terraform { } provider "proxmox" { - pm_api_url = var.pm_api_url - pm_api_token_id = var.pm_api_token_id - pm_api_token_secret = var.pm_api_token_secret - pm_tls_insecure = true + pm_api_url = var.pm_api_url + pm_api_token_id = var.pm_api_token_id + pm_api_token_secret = var.pm_api_token_secret + pm_tls_insecure = true } resource "proxmox_vm_qemu" "alpacas" { diff --git a/terraform/terraform.tfvars b/terraform/terraform.tfvars index c4d93bf..c63b2ab 100644 --- a/terraform/terraform.tfvars +++ b/terraform/terraform.tfvars @@ -1,10 +1,10 @@ -target_node = "flex" -clone_template = "ubuntu-cloudinit" -cores = 1 -memory = 1024 -disk_size = "15G" -sockets = 1 -bridge = "vmbr0" -storage = "Flash" -pm_api_url = "https://100.105.0.115:8006/api2/json" -pm_api_token_id = "terraform-prov@pve!mytoken" +target_node = "flex" +clone_template = "ubuntu-cloudinit" +cores = 1 +memory = 1024 +disk_size = "15G" +sockets = 1 +bridge = "vmbr0" +storage = "Flash" +pm_api_url = "https://100.105.0.115:8006/api2/json" +pm_api_token_id = "terraform-prov@pve!mytoken" From 4a123e0fb6e532f305cbe4512e895d88167f0fb2 Mon Sep 17 00:00:00 2001 From: MichaelFisher1997 Date: Fri, 27 Feb 2026 20:27:20 +0000 Subject: [PATCH 05/12] fix: apply terraform fmt --- terraform/main.tf | 8 ++++---- terraform/terraform.tfvars | 20 ++++++++++---------- 2 files changed, 14 insertions(+), 14 deletions(-) diff --git a/terraform/main.tf b/terraform/main.tf index c08cbdd..fc6134d 100644 --- a/terraform/main.tf +++ b/terraform/main.tf @@ -8,10 +8,10 @@ terraform { } provider "proxmox" { - pm_api_url = var.pm_api_url - pm_api_token_id = var.pm_api_token_id - pm_api_token_secret = var.pm_api_token_secret - pm_tls_insecure = true + pm_api_url = var.pm_api_url + pm_api_token_id = var.pm_api_token_id + pm_api_token_secret = var.pm_api_token_secret + pm_tls_insecure = true } resource "proxmox_vm_qemu" "alpacas" { diff --git a/terraform/terraform.tfvars b/terraform/terraform.tfvars index c63b2ab..c5223ab 100644 --- a/terraform/terraform.tfvars +++ b/terraform/terraform.tfvars @@ -1,10 +1,10 @@ -target_node = "flex" -clone_template = "ubuntu-cloudinit" -cores = 1 -memory = 1024 -disk_size = "15G" -sockets = 1 -bridge = "vmbr0" -storage = "Flash" -pm_api_url = "https://100.105.0.115:8006/api2/json" -pm_api_token_id = "terraform-prov@pve!mytoken" +target_node = "flex" +clone_template = "ubuntu-cloudinit" +cores = 1 +memory = 1024 +disk_size = "15G" +sockets = 1 +bridge = "vmbr0" +storage = "Flash" +pm_api_url = "https://100.105.0.115:8006/api2/json" +pm_api_token_id = "terraform-prov@pve!mytoken" From 9c1476b6bf22155d56e71fa5d401f5391352053b Mon Sep 17 00:00:00 2001 From: MichaelFisher1997 Date: Fri, 27 Feb 2026 20:36:44 +0000 Subject: [PATCH 06/12] fix: use PM_API_TOKEN_ID/SECRET env vars directly - Remove token from Terraform variables (provider reads from env) - Update workflows to set PM_API_TOKEN_ID and PM_API_TOKEN_SECRET directly - Provider now reads credentials from environment variables --- .gitea/workflows/terraform-apply.yml | 4 ++-- .gitea/workflows/terraform-plan.yml | 4 ++-- terraform/main.tf | 6 ++---- terraform/terraform.tfvars | 19 +++++++++---------- terraform/variables.tf | 11 ----------- 5 files changed, 15 insertions(+), 29 deletions(-) diff --git a/.gitea/workflows/terraform-apply.yml b/.gitea/workflows/terraform-apply.yml index c09caa6..0bfc563 100644 --- a/.gitea/workflows/terraform-apply.yml +++ b/.gitea/workflows/terraform-apply.yml @@ -18,8 +18,8 @@ jobs: env: TF_VAR_SSH_KEY_PUBLIC: ${{ secrets.SSH_KEY_PUBLIC }} TF_VAR_TS_AUTHKEY: ${{ secrets.TS_AUTHKEY }} - TF_VAR_pm_api_token_id: ${{ secrets.PM_API_TOKEN_ID }} - TF_VAR_pm_api_token_secret: ${{ secrets.PM_API_TOKEN_SECRET }} + PM_API_TOKEN_ID: ${{ secrets.PM_API_TOKEN_ID }} + PM_API_TOKEN_SECRET: ${{ secrets.PM_API_TOKEN_SECRET }} steps: - name: Checkout repository diff --git a/.gitea/workflows/terraform-plan.yml b/.gitea/workflows/terraform-plan.yml index 579437e..27266d9 100644 --- a/.gitea/workflows/terraform-plan.yml +++ b/.gitea/workflows/terraform-plan.yml @@ -19,8 +19,8 @@ jobs: env: TF_VAR_SSH_KEY_PUBLIC: ${{ secrets.SSH_KEY_PUBLIC }} TF_VAR_TS_AUTHKEY: ${{ secrets.TS_AUTHKEY }} - TF_VAR_pm_api_token_id: ${{ secrets.PM_API_TOKEN_ID }} - TF_VAR_pm_api_token_secret: ${{ secrets.PM_API_TOKEN_SECRET }} + PM_API_TOKEN_ID: ${{ secrets.PM_API_TOKEN_ID }} + PM_API_TOKEN_SECRET: ${{ secrets.PM_API_TOKEN_SECRET }} steps: - name: Checkout repository diff --git a/terraform/main.tf b/terraform/main.tf index fc6134d..7bd3884 100644 --- a/terraform/main.tf +++ b/terraform/main.tf @@ -8,10 +8,8 @@ terraform { } provider "proxmox" { - pm_api_url = var.pm_api_url - pm_api_token_id = var.pm_api_token_id - pm_api_token_secret = var.pm_api_token_secret - pm_tls_insecure = true + pm_api_url = var.pm_api_url + pm_tls_insecure = true } resource "proxmox_vm_qemu" "alpacas" { diff --git a/terraform/terraform.tfvars b/terraform/terraform.tfvars index c5223ab..f176df7 100644 --- a/terraform/terraform.tfvars +++ b/terraform/terraform.tfvars @@ -1,10 +1,9 @@ -target_node = "flex" -clone_template = "ubuntu-cloudinit" -cores = 1 -memory = 1024 -disk_size = "15G" -sockets = 1 -bridge = "vmbr0" -storage = "Flash" -pm_api_url = "https://100.105.0.115:8006/api2/json" -pm_api_token_id = "terraform-prov@pve!mytoken" +target_node = "flex" +clone_template = "ubuntu-cloudinit" +cores = 1 +memory = 1024 +disk_size = "15G" +sockets = 1 +bridge = "vmbr0" +storage = "Flash" +pm_api_url = "https://100.105.0.115:8006/api2/json" diff --git a/terraform/variables.tf b/terraform/variables.tf index c4f1b2c..2d44f83 100644 --- a/terraform/variables.tf +++ b/terraform/variables.tf @@ -1,14 +1,3 @@ -variable "pm_api_token_id" { - type = string - description = "Proxmox API token ID (format: user@realm!tokenid)" -} - -variable "pm_api_token_secret" { - type = string - sensitive = true - description = "Proxmox API token secret" -} - variable "target_node" { type = string } From 364dc6b35baeb67bba875c528633e547e23a829b Mon Sep 17 00:00:00 2001 From: MichaelFisher1997 Date: Fri, 27 Feb 2026 20:43:39 +0000 Subject: [PATCH 07/12] fix: use TF_VAR_ prefix for token credentials - Restore pm_api_token_id and pm_api_token_secret variables - Use TF_VAR_pm_api_token_id and TF_VAR_pm_api_token_secret env vars - This is the standard Terraform way to pass variables via environment --- .gitea/workflows/terraform-apply.yml | 4 ++-- .gitea/workflows/terraform-plan.yml | 4 ++-- terraform/main.tf | 6 ++++-- terraform/variables.tf | 11 +++++++++++ 4 files changed, 19 insertions(+), 6 deletions(-) diff --git a/.gitea/workflows/terraform-apply.yml b/.gitea/workflows/terraform-apply.yml index 0bfc563..c09caa6 100644 --- a/.gitea/workflows/terraform-apply.yml +++ b/.gitea/workflows/terraform-apply.yml @@ -18,8 +18,8 @@ jobs: env: TF_VAR_SSH_KEY_PUBLIC: ${{ secrets.SSH_KEY_PUBLIC }} TF_VAR_TS_AUTHKEY: ${{ secrets.TS_AUTHKEY }} - PM_API_TOKEN_ID: ${{ secrets.PM_API_TOKEN_ID }} - PM_API_TOKEN_SECRET: ${{ secrets.PM_API_TOKEN_SECRET }} + TF_VAR_pm_api_token_id: ${{ secrets.PM_API_TOKEN_ID }} + TF_VAR_pm_api_token_secret: ${{ secrets.PM_API_TOKEN_SECRET }} steps: - name: Checkout repository diff --git a/.gitea/workflows/terraform-plan.yml b/.gitea/workflows/terraform-plan.yml index 27266d9..579437e 100644 --- a/.gitea/workflows/terraform-plan.yml +++ b/.gitea/workflows/terraform-plan.yml @@ -19,8 +19,8 @@ jobs: env: TF_VAR_SSH_KEY_PUBLIC: ${{ secrets.SSH_KEY_PUBLIC }} TF_VAR_TS_AUTHKEY: ${{ secrets.TS_AUTHKEY }} - PM_API_TOKEN_ID: ${{ secrets.PM_API_TOKEN_ID }} - PM_API_TOKEN_SECRET: ${{ secrets.PM_API_TOKEN_SECRET }} + TF_VAR_pm_api_token_id: ${{ secrets.PM_API_TOKEN_ID }} + TF_VAR_pm_api_token_secret: ${{ secrets.PM_API_TOKEN_SECRET }} steps: - name: Checkout repository diff --git a/terraform/main.tf b/terraform/main.tf index 7bd3884..fc6134d 100644 --- a/terraform/main.tf +++ b/terraform/main.tf @@ -8,8 +8,10 @@ terraform { } provider "proxmox" { - pm_api_url = var.pm_api_url - pm_tls_insecure = true + pm_api_url = var.pm_api_url + pm_api_token_id = var.pm_api_token_id + pm_api_token_secret = var.pm_api_token_secret + pm_tls_insecure = true } resource "proxmox_vm_qemu" "alpacas" { diff --git a/terraform/variables.tf b/terraform/variables.tf index 2d44f83..c4f1b2c 100644 --- a/terraform/variables.tf +++ b/terraform/variables.tf @@ -1,3 +1,14 @@ +variable "pm_api_token_id" { + type = string + description = "Proxmox API token ID (format: user@realm!tokenid)" +} + +variable "pm_api_token_secret" { + type = string + sensitive = true + description = "Proxmox API token secret" +} + variable "target_node" { type = string } From 841abb8fe3ff6fc40e881119ee3eeec24750cb76 Mon Sep 17 00:00:00 2001 From: MichaelFisher1997 Date: Fri, 27 Feb 2026 20:48:41 +0000 Subject: [PATCH 08/12] fix: create secrets.auto.tfvars dynamically in workflow - Generate secrets.auto.tfvars file during workflow run - Terraform automatically loads *.auto.tfvars files - This bypasses any issues with TF_VAR_ environment variables --- .gitea/workflows/terraform-apply.yml | 24 +++++++++++------------- .gitea/workflows/terraform-plan.yml | 24 +++++++++++------------- 2 files changed, 22 insertions(+), 26 deletions(-) diff --git a/.gitea/workflows/terraform-apply.yml b/.gitea/workflows/terraform-apply.yml index c09caa6..c27a8ff 100644 --- a/.gitea/workflows/terraform-apply.yml +++ b/.gitea/workflows/terraform-apply.yml @@ -1,5 +1,4 @@ -name: Gitea Actions Demo -run-name: ${{ gitea.actor }} is deploying with Terraform 🚀 +name: Terraform Apply on: push: @@ -11,20 +10,20 @@ jobs: name: "Terraform Apply" runs-on: ubuntu-latest - permissions: - contents: read - pull-requests: write - - env: - TF_VAR_SSH_KEY_PUBLIC: ${{ secrets.SSH_KEY_PUBLIC }} - TF_VAR_TS_AUTHKEY: ${{ secrets.TS_AUTHKEY }} - TF_VAR_pm_api_token_id: ${{ secrets.PM_API_TOKEN_ID }} - TF_VAR_pm_api_token_secret: ${{ secrets.PM_API_TOKEN_SECRET }} - steps: - name: Checkout repository uses: actions/checkout@v4 + - name: Create secrets.tfvars + working-directory: terraform + run: | + cat > secrets.auto.tfvars << EOF + pm_api_token_id = "${{ secrets.PM_API_TOKEN_ID }}" + pm_api_token_secret = "${{ secrets.PM_API_TOKEN_SECRET }}" + SSH_KEY_PUBLIC = "${{ secrets.SSH_KEY_PUBLIC }}" + TS_AUTHKEY = "${{ secrets.TS_AUTHKEY }}" + EOF + - name: Set up Terraform uses: hashicorp/setup-terraform@v2 with: @@ -41,4 +40,3 @@ jobs: - name: Terraform Apply working-directory: terraform run: terraform apply -auto-approve - diff --git a/.gitea/workflows/terraform-plan.yml b/.gitea/workflows/terraform-plan.yml index 579437e..3247c01 100644 --- a/.gitea/workflows/terraform-plan.yml +++ b/.gitea/workflows/terraform-plan.yml @@ -1,5 +1,4 @@ -name: Gitea Actions Demo -run-name: ${{ gitea.actor }} is testing out Gitea Actions 🚀 +name: Terraform Plan on: push: @@ -12,20 +11,20 @@ jobs: name: "Terraform Plan" runs-on: ubuntu-latest - permissions: - contents: read - pull-requests: write - - env: - TF_VAR_SSH_KEY_PUBLIC: ${{ secrets.SSH_KEY_PUBLIC }} - TF_VAR_TS_AUTHKEY: ${{ secrets.TS_AUTHKEY }} - TF_VAR_pm_api_token_id: ${{ secrets.PM_API_TOKEN_ID }} - TF_VAR_pm_api_token_secret: ${{ secrets.PM_API_TOKEN_SECRET }} - steps: - name: Checkout repository uses: actions/checkout@v4 + - name: Create secrets.tfvars + working-directory: terraform + run: | + cat > secrets.auto.tfvars << EOF + pm_api_token_id = "${{ secrets.PM_API_TOKEN_ID }}" + pm_api_token_secret = "${{ secrets.PM_API_TOKEN_SECRET }}" + SSH_KEY_PUBLIC = "${{ secrets.SSH_KEY_PUBLIC }}" + TS_AUTHKEY = "${{ secrets.TS_AUTHKEY }}" + EOF + - name: Set up Terraform uses: hashicorp/setup-terraform@v2 with: @@ -52,4 +51,3 @@ jobs: with: name: terraform-plan path: terraform/tfplan - From c3a0ef251c958b27b78b531592e31030772ed106 Mon Sep 17 00:00:00 2001 From: MichaelFisher1997 Date: Fri, 27 Feb 2026 20:56:41 +0000 Subject: [PATCH 09/12] debug: show secret lengths to verify they are set --- .gitea/workflows/terraform-plan.yml | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/.gitea/workflows/terraform-plan.yml b/.gitea/workflows/terraform-plan.yml index 3247c01..3838bff 100644 --- a/.gitea/workflows/terraform-plan.yml +++ b/.gitea/workflows/terraform-plan.yml @@ -18,12 +18,16 @@ jobs: - name: Create secrets.tfvars working-directory: terraform run: | + echo "PM_API_TOKEN_ID length: $(echo -n '${{ secrets.PM_API_TOKEN_ID }}' | wc -c)" + echo "PM_API_TOKEN_SECRET length: $(echo -n '${{ secrets.PM_API_TOKEN_SECRET }}' | wc -c)" cat > secrets.auto.tfvars << EOF pm_api_token_id = "${{ secrets.PM_API_TOKEN_ID }}" pm_api_token_secret = "${{ secrets.PM_API_TOKEN_SECRET }}" SSH_KEY_PUBLIC = "${{ secrets.SSH_KEY_PUBLIC }}" TS_AUTHKEY = "${{ secrets.TS_AUTHKEY }}" EOF + echo "Created secrets.auto.tfvars:" + cat secrets.auto.tfvars | sed 's/=.*/=***/' - name: Set up Terraform uses: hashicorp/setup-terraform@v2 From 59fbbb07dfd7130d6f7fcf0fcbc0792b76a9a56f Mon Sep 17 00:00:00 2001 From: MichaelFisher1997 Date: Fri, 27 Feb 2026 21:00:44 +0000 Subject: [PATCH 10/12] fix: load static token id and validate token secret - Store non-sensitive Proxmox token id in terraform.tfvars - Inject only token secret via workflow-generated secrets.auto.tfvars - Add variable validations for token id format and non-empty token secret - Add workflow debug output for token secret length and selected token id --- .gitea/workflows/terraform-apply.yml | 1 - .gitea/workflows/terraform-plan.yml | 4 ++-- terraform/terraform.tfvars | 19 ++++++++++--------- terraform/variables.tf | 10 ++++++++++ 4 files changed, 22 insertions(+), 12 deletions(-) diff --git a/.gitea/workflows/terraform-apply.yml b/.gitea/workflows/terraform-apply.yml index c27a8ff..f319a29 100644 --- a/.gitea/workflows/terraform-apply.yml +++ b/.gitea/workflows/terraform-apply.yml @@ -18,7 +18,6 @@ jobs: working-directory: terraform run: | cat > secrets.auto.tfvars << EOF - pm_api_token_id = "${{ secrets.PM_API_TOKEN_ID }}" pm_api_token_secret = "${{ secrets.PM_API_TOKEN_SECRET }}" SSH_KEY_PUBLIC = "${{ secrets.SSH_KEY_PUBLIC }}" TS_AUTHKEY = "${{ secrets.TS_AUTHKEY }}" diff --git a/.gitea/workflows/terraform-plan.yml b/.gitea/workflows/terraform-plan.yml index 3838bff..48c6427 100644 --- a/.gitea/workflows/terraform-plan.yml +++ b/.gitea/workflows/terraform-plan.yml @@ -18,16 +18,16 @@ jobs: - name: Create secrets.tfvars working-directory: terraform run: | - echo "PM_API_TOKEN_ID length: $(echo -n '${{ secrets.PM_API_TOKEN_ID }}' | wc -c)" echo "PM_API_TOKEN_SECRET length: $(echo -n '${{ secrets.PM_API_TOKEN_SECRET }}' | wc -c)" cat > secrets.auto.tfvars << EOF - pm_api_token_id = "${{ secrets.PM_API_TOKEN_ID }}" pm_api_token_secret = "${{ secrets.PM_API_TOKEN_SECRET }}" SSH_KEY_PUBLIC = "${{ secrets.SSH_KEY_PUBLIC }}" TS_AUTHKEY = "${{ secrets.TS_AUTHKEY }}" EOF echo "Created secrets.auto.tfvars:" cat secrets.auto.tfvars | sed 's/=.*/=***/' + echo "Using token ID from terraform.tfvars:" + grep '^pm_api_token_id' terraform.tfvars - name: Set up Terraform uses: hashicorp/setup-terraform@v2 diff --git a/terraform/terraform.tfvars b/terraform/terraform.tfvars index f176df7..c5223ab 100644 --- a/terraform/terraform.tfvars +++ b/terraform/terraform.tfvars @@ -1,9 +1,10 @@ -target_node = "flex" -clone_template = "ubuntu-cloudinit" -cores = 1 -memory = 1024 -disk_size = "15G" -sockets = 1 -bridge = "vmbr0" -storage = "Flash" -pm_api_url = "https://100.105.0.115:8006/api2/json" +target_node = "flex" +clone_template = "ubuntu-cloudinit" +cores = 1 +memory = 1024 +disk_size = "15G" +sockets = 1 +bridge = "vmbr0" +storage = "Flash" +pm_api_url = "https://100.105.0.115:8006/api2/json" +pm_api_token_id = "terraform-prov@pve!mytoken" diff --git a/terraform/variables.tf b/terraform/variables.tf index c4f1b2c..42e3073 100644 --- a/terraform/variables.tf +++ b/terraform/variables.tf @@ -1,12 +1,22 @@ variable "pm_api_token_id" { type = string description = "Proxmox API token ID (format: user@realm!tokenid)" + + validation { + condition = can(regex(".+!.+", trimspace(var.pm_api_token_id))) + error_message = "pm_api_token_id must be in format user@realm!tokenid." + } } variable "pm_api_token_secret" { type = string sensitive = true description = "Proxmox API token secret" + + validation { + condition = length(trimspace(var.pm_api_token_secret)) > 0 + error_message = "pm_api_token_secret cannot be empty. Check your Gitea secret PM_API_TOKEN_SECRET." + } } variable "target_node" { From 4247d16c24739df1f108808db9ddd91780790252 Mon Sep 17 00:00:00 2001 From: MichaelFisher1997 Date: Fri, 27 Feb 2026 21:04:44 +0000 Subject: [PATCH 11/12] fix: upgrade proxmox provider for Proxmox 9 permissions Move Telmate provider to 3.0.2-rc07, which includes Proxmox 9 permission compatibility and avoids requiring deprecated VM.Monitor. --- terraform/.terraform.lock.hcl | 60 +++++++++++++++++------------------ terraform/main.tf | 3 +- 2 files changed, 31 insertions(+), 32 deletions(-) diff --git a/terraform/.terraform.lock.hcl b/terraform/.terraform.lock.hcl index 6d24976..3c6f15f 100644 --- a/terraform/.terraform.lock.hcl +++ b/terraform/.terraform.lock.hcl @@ -2,21 +2,21 @@ # Manual edits may be lost in future updates. provider "registry.terraform.io/hashicorp/local" { - version = "2.5.2" + version = "2.7.0" hashes = [ - "h1:JlMZD6nYqJ8sSrFfEAH0Vk/SL8WLZRmFaMUF9PJK5wM=", - "zh:136299545178ce281c56f36965bf91c35407c11897f7082b3b983d86cb79b511", - "zh:3b4486858aa9cb8163378722b642c57c529b6c64bfbfc9461d940a84cd66ebea", - "zh:4855ee628ead847741aa4f4fc9bed50cfdbf197f2912775dd9fe7bc43fa077c0", - "zh:4b8cd2583d1edcac4011caafe8afb7a95e8110a607a1d5fb87d921178074a69b", - "zh:52084ddaff8c8cd3f9e7bcb7ce4dc1eab00602912c96da43c29b4762dc376038", - "zh:71562d330d3f92d79b2952ffdda0dad167e952e46200c767dd30c6af8d7c0ed3", + "h1:2RYa3j7m/0WmET2fqotY4CHxE1Hpk0fgn47/126l+Og=", + "zh:261fec71bca13e0a7812dc0d8ae9af2b4326b24d9b2e9beab3d2400fab5c5f9a", + "zh:308da3b5376a9ede815042deec5af1050ec96a5a5410a2206ae847d82070a23e", + "zh:3d056924c420464dc8aba10e1915956b2e5c4d55b11ffff79aa8be563fbfe298", + "zh:643256547b155459c45e0a3e8aab0570db59923c68daf2086be63c444c8c445b", "zh:78d5eefdd9e494defcb3c68d282b8f96630502cac21d1ea161f53cfe9bb483b3", - "zh:805f81ade06ff68fa8b908d31892eaed5c180ae031c77ad35f82cb7a74b97cf4", - "zh:8b6b3ebeaaa8e38dd04e56996abe80db9be6f4c1df75ac3cccc77642899bd464", - "zh:ad07750576b99248037b897de71113cc19b1a8d0bc235eb99173cc83d0de3b1b", - "zh:b9f1c3bfadb74068f5c205292badb0661e17ac05eb23bfe8bd809691e4583d0e", - "zh:cc4cbcd67414fefb111c1bf7ab0bc4beb8c0b553d01719ad17de9a047adff4d1", + "zh:7aa4d0b853f84205e8cf79f30c9b2c562afbfa63592f7231b6637e5d7a6b5b27", + "zh:7dc251bbc487d58a6ab7f5b07ec9edc630edb45d89b761dba28e0e2ba6b1c11f", + "zh:7ee0ca546cd065030039168d780a15cbbf1765a4c70cd56d394734ab112c93da", + "zh:b1d5d80abb1906e6c6b3685a52a0192b4ca6525fe090881c64ec6f67794b1300", + "zh:d81ea9856d61db3148a4fc6c375bf387a721d78fc1fea7a8823a027272a47a78", + "zh:df0a1f0afc947b8bfc88617c1ad07a689ce3bd1a29fd97318392e6bdd32b230b", + "zh:dfbcad800240e0c68c43e0866f2a751cff09777375ec701918881acf67a268da", ] } @@ -38,23 +38,23 @@ provider "registry.terraform.io/hashicorp/template" { } provider "registry.terraform.io/telmate/proxmox" { - version = "3.0.1-rc8" - constraints = "3.0.1-rc8" + version = "3.0.2-rc07" + constraints = "3.0.2-rc07" hashes = [ - "h1:W5X4T5AZUaqO++aAequNECUKJaXLC5upcws6Vp7mkBk=", - "zh:0272f1600251abf9b139c2683f83cde0a907ac762f5ead058b84de18ddc1d78e", - "zh:328e708a8063a133516612b17c8983a9372fa42766530925d1d37aeb1daa30ec", - "zh:3449150e4d57f79af6f9583e93e3a5ab84fb475bc594de75b968534f57af2871", - "zh:58d803a0203241214f673c80350d43ce1a5ce57b21b83ba08d0d08e8c389dcc4", - "zh:59e3e99afc1ea404e530100725403c1610d682cfd27eeeaf35190c119b76a4db", - "zh:666cb7d299824152714202e8fda000c2e37346f2ae6d0a0e3c6f6bd68ef5d9ca", - "zh:6a1290b85e7bf953664b21b2a1ea554923a060f2a8347d8d5bb3d2b5157f85d2", - "zh:72230960c49fe7050a5e80ee10fa24cdac94dbab82744bccb6aa251741eb5aa9", - "zh:91f655c41f5af9a9fdcf6104c3d0a553eaa0fb3390af81051e744f30accd5b52", - "zh:aa08a22bf737d5840573bb6030617ab6bba2a292f4b9c88b20477cdcfb9676a9", - "zh:b72012cc284cad488207532b6668c58999c972d837b5f486db1d7466d686d5fd", - "zh:e24f934249a6ab4d3705c1398226d4d9df1e81ef8a36592389be02bc35cc661f", - "zh:e9e6bcef8b6a6b5ff2317168c2c23e4c55ae23f883ba158d2c4fd6324a0413e5", - "zh:ffa1e742a8c50babd8dbfcd6884740f9bea8453ec4d832717ff006a4fbfffa91", + "h1:zp5hpQJQ4t4zROSLqdltVpBO+Riy9VugtfFbpyTw1aM=", + "zh:2ee860cd0a368b3eaa53f4a9ea46f16dab8a97929e813ea6ef55183f8112c2ca", + "zh:415965fd915bae2040d7f79e45f64d6e3ae61149c10114efeac1b34687d7296c", + "zh:6584b2055df0e32062561c615e3b6b2c291ca8c959440adda09ef3ec1e1436bd", + "zh:65dcfad71928e0a8dd9befc22524ed686be5020b0024dc5cca5184c7420eeb6b", + "zh:7253dc29bd265d33f2791ac4f779c5413f16720bb717de8e6c5fcb2c858648ea", + "zh:7ec8993da10a47606670f9f67cfd10719a7580641d11c7aa761121c4a2bd66fb", + "zh:999a3f7a9dcf517967fc537e6ec930a8172203642fb01b8e1f78f908373db210", + "zh:a50e6df7280eb6584a5fd2456e3f5b6df13b2ec8a7fa4605511e438e1863be42", + "zh:b25b329a1e42681c509d027fee0365414f0cc5062b65690cfc3386aab16132ae", + "zh:c028877fdb438ece48f7bc02b65bbae9ca7b7befbd260e519ccab6c0cbb39f26", + "zh:cf0eaa3ea9fcc6d62793637947f1b8d7c885b6ad74695ab47e134e4ff132190f", + "zh:d5ade3fae031cc629b7c512a7b60e46570f4c41665e88a595d7efd943dde5ab2", + "zh:f388c15ad1ecfc09e7361e3b98bae9b627a3a85f7b908c9f40650969c949901c", + "zh:f415cc6f735a3971faae6ac24034afdb9ee83373ef8de19a9631c187d5adc7db", ] } diff --git a/terraform/main.tf b/terraform/main.tf index fc6134d..55e812f 100644 --- a/terraform/main.tf +++ b/terraform/main.tf @@ -2,7 +2,7 @@ terraform { required_providers { proxmox = { source = "Telmate/proxmox" - version = "3.0.1-rc8" + version = "3.0.2-rc07" } } } @@ -106,4 +106,3 @@ resource "proxmox_vm_qemu" "llamas" { bridge = var.bridge } } - From e714a56980174a8cdc968f4b2d0df315eab8a0b7 Mon Sep 17 00:00:00 2001 From: MichaelFisher1997 Date: Sat, 28 Feb 2026 00:06:25 +0000 Subject: [PATCH 12/12] update: switch Terraform to NixOS template workflow - Point clone_template to nixos-template and trim cloud-init to Nix-safe hostname/DNS only - Remove SSH/Tailscale cloud-init variables and workflow secret dependencies - Add reusable NixOS template-base config with bootloader, Tailscale, fish, and utility packages --- .gitea/workflows/terraform-apply.yml | 2 - .gitea/workflows/terraform-plan.yml | 2 - nixos/template-base/README.md | 27 ++++++++++++ nixos/template-base/configuration.nix | 60 +++++++++++++++++++++++++++ nixos/template-base/flake.nix | 14 +++++++ terraform/cloud-init.tf | 6 +-- terraform/files/cloud_init_global.tpl | 37 ----------------- terraform/terraform.tfvars | 2 +- terraform/variables.tf | 10 ----- 9 files changed, 104 insertions(+), 56 deletions(-) create mode 100644 nixos/template-base/README.md create mode 100644 nixos/template-base/configuration.nix create mode 100644 nixos/template-base/flake.nix diff --git a/.gitea/workflows/terraform-apply.yml b/.gitea/workflows/terraform-apply.yml index f319a29..5a49a78 100644 --- a/.gitea/workflows/terraform-apply.yml +++ b/.gitea/workflows/terraform-apply.yml @@ -19,8 +19,6 @@ jobs: run: | cat > secrets.auto.tfvars << EOF pm_api_token_secret = "${{ secrets.PM_API_TOKEN_SECRET }}" - SSH_KEY_PUBLIC = "${{ secrets.SSH_KEY_PUBLIC }}" - TS_AUTHKEY = "${{ secrets.TS_AUTHKEY }}" EOF - name: Set up Terraform diff --git a/.gitea/workflows/terraform-plan.yml b/.gitea/workflows/terraform-plan.yml index 48c6427..35637d1 100644 --- a/.gitea/workflows/terraform-plan.yml +++ b/.gitea/workflows/terraform-plan.yml @@ -21,8 +21,6 @@ jobs: echo "PM_API_TOKEN_SECRET length: $(echo -n '${{ secrets.PM_API_TOKEN_SECRET }}' | wc -c)" cat > secrets.auto.tfvars << EOF pm_api_token_secret = "${{ secrets.PM_API_TOKEN_SECRET }}" - SSH_KEY_PUBLIC = "${{ secrets.SSH_KEY_PUBLIC }}" - TS_AUTHKEY = "${{ secrets.TS_AUTHKEY }}" EOF echo "Created secrets.auto.tfvars:" cat secrets.auto.tfvars | sed 's/=.*/=***/' diff --git a/nixos/template-base/README.md b/nixos/template-base/README.md new file mode 100644 index 0000000..6270ea5 --- /dev/null +++ b/nixos/template-base/README.md @@ -0,0 +1,27 @@ +# NixOS Proxmox Template Base + +This folder contains a minimal NixOS base config you can copy into a new +template VM build. + +## Files + +- `flake.nix`: pins `nixos-24.11` and exposes one host config. +- `configuration.nix`: base settings for Proxmox guest use. + +## Before first apply + +1. Replace `REPLACE_WITH_YOUR_SSH_PUBLIC_KEY` in `configuration.nix`. +2. Add `hardware-configuration.nix` from the VM install: + - `nixos-generate-config --root /` + - copy `/etc/nixos/hardware-configuration.nix` next to `configuration.nix` + +## Build/apply example inside the VM + +```bash +sudo nixos-rebuild switch --flake .#template +``` + +## Notes + +- This is intentionally minimal and avoids cloud-init assumptions. +- If you want host-specific settings, create additional modules and import them. diff --git a/nixos/template-base/configuration.nix b/nixos/template-base/configuration.nix new file mode 100644 index 0000000..867d6c0 --- /dev/null +++ b/nixos/template-base/configuration.nix @@ -0,0 +1,60 @@ +{ lib, pkgs, ... }: + +{ + imports = + lib.optional (builtins.pathExists ./hardware-configuration.nix) + ./hardware-configuration.nix; + + networking.hostName = "nixos-template"; + networking.useDHCP = lib.mkDefault true; + networking.nameservers = [ "1.1.1.1" "8.8.8.8" ]; + + boot.loader.systemd-boot.enable = lib.mkForce false; + boot.loader.grub = { + enable = true; + device = "/dev/sda"; + }; + + services.qemuGuest.enable = true; + services.openssh.enable = true; + services.tailscale.enable = true; + services.openssh.settings = { + PasswordAuthentication = false; + KbdInteractiveAuthentication = false; + PermitRootLogin = "prohibit-password"; + }; + + programs.fish.enable = true; + + users.users.micqdf = { + isNormalUser = true; + extraGroups = [ "wheel" ]; + shell = pkgs.fish; + openssh.authorizedKeys.keys = [ + "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDyfhho9WSqK2OWxizt45Q5KHgox3uVWDnbvMBJaDnRph6CZeKmzaS60/+HN/o7MtIm+q86TfdYeWJVt4erPEvrYN8AWfvCWi+hP2Y0l18wS8GEA+efEXyQ5CLCefraXvIneORObKetzO73bq0HytDRXDowc4J0NcbEFB7ncf2RqVTC6QRlNPRD3jHLkUeKXVmyteNgTtGdMz4MFHCC7xtzgL7kEuuHDEWuVhPkK+dkeGBejq+RzkYcd8v37L7NjFZCK91jANBVcQnTLQVUVVlMovVPyoaROn4N8KpIhb85SYZIJGUEKMhmCowb2NnZLJNC07qn8sz1dmNZO635aquuWMhZTevCySJjvIuMxDSffhBaAjkK1aVixMCW3jyzbpFIEG6FOj27TpcMnen6a0j0AecdCKgXI/Ezb08pj9qmVppAvJPyYoqN4OwHNHGWb8U2X3GghFesei8ZmBgch12RkIaXYxVzkNqv3FG4kAMFMEnGe4e6aqAAuDzUIkcjsPl2XrNJp+pxnPWDc7EMTKPUuKIcteXVDgCVgufQjPBO5/DgUyygLTzt8py9sZyyFDsqRAZ6E3IzBpxyWfUOoN81mUL6G31pZ/1b3YKpNs7DuqvP/aXIvb94o8KsLPQeoG7L2ulcOWX7I0yhlAgd8QUjhNoNq3mK/sQylq9Zy63GhQ==" + ]; + # optional while testing noVNC login: + # initialPassword = "changeme123"; + }; + + security.sudo.wheelNeedsPassword = false; + + environment.systemPackages = with pkgs; [ + btop + curl + dig + eza + fd + fzf + git + htop + jq + ripgrep + tree + unzip + vim + wget + ]; + + system.stateVersion = "24.11"; +} diff --git a/nixos/template-base/flake.nix b/nixos/template-base/flake.nix new file mode 100644 index 0000000..821c6e7 --- /dev/null +++ b/nixos/template-base/flake.nix @@ -0,0 +1,14 @@ +{ + description = "Base NixOS config for Proxmox template"; + + inputs = { + nixpkgs.url = "github:NixOS/nixpkgs/nixos-24.11"; + }; + + outputs = { nixpkgs, ... }: { + nixosConfigurations.template = nixpkgs.lib.nixosSystem { + system = "x86_64-linux"; + modules = [ ./configuration.nix ]; + }; + }; +} diff --git a/terraform/cloud-init.tf b/terraform/cloud-init.tf index 969bc9b..7d55fa0 100644 --- a/terraform/cloud-init.tf +++ b/terraform/cloud-init.tf @@ -2,10 +2,8 @@ data "template_file" "cloud_init_global" { template = file("${path.module}/files/cloud_init_global.tpl") vars = { - hostname = "generic" - domain = "home.arpa" - TS_AUTHKEY = var.TS_AUTHKEY - SSH_KEY_PUBLIC = var.SSH_KEY_PUBLIC + hostname = "generic" + domain = "home.arpa" } } diff --git a/terraform/files/cloud_init_global.tpl b/terraform/files/cloud_init_global.tpl index daf3b15..0d9a2ac 100644 --- a/terraform/files/cloud_init_global.tpl +++ b/terraform/files/cloud_init_global.tpl @@ -6,42 +6,5 @@ resolv_conf: - 8.8.8.8 - 1.1.1.1 -package_update: true -package_upgrade: true - -# APT fails to acquire GPG keys if package dirmngr is missing -bootcmd: - - [ cloud-init-per, once, dirmngr-aptupdate, apt-get, update ] - - [ cloud-init-per, once, dirmngr-aptinstall, apt-get, install, dirmngr, -y ] - - [ cloud-init-per, once, dirmngr-aptinstall, apt-get, install, gnupg2, -y ] - -packages: - - jq - - curl - - qemu-guest-agent - -users: -- name: stuart - groups: sudo - shell: /bin/bash - sudo: ['ALL=(ALL) NOPASSWD:ALL'] - ssh_authorized_keys: - - ${SSH_KEY_PUBLIC} - preserve_hostname: false fqdn: ${hostname}.${domain} - -#cloud-config -# The above header must generally appear on the first line of a cloud config -# file, but all other lines that begin with a # are optional comments. - -runcmd: - # One-command install, from https://tailscale.com/download/ - - ['sh', '-c', 'curl -fsSL https://tailscale.com/install.sh | sh'] - # Set sysctl settings for IP forwarding (useful when configuring an exit node) - - ['sh', '-c', "echo 'net.ipv4.ip_forward = 1' | sudo tee -a /etc/sysctl.d/99-tailscale.conf && echo 'net.ipv6.conf.all.forwarding = 1' | sudo tee -a /etc/sysctl.d/99-tailscale.conf && sudo sysctl -p /etc/sysctl.d/99-tailscale.conf" ] - # Generate an auth key from your Admin console - # https://login.tailscale.com/admin/settings/keys - # and replace the placeholder below - - ['tailscale', 'up', '--auth-key=${TS_AUTHKEY}'] - diff --git a/terraform/terraform.tfvars b/terraform/terraform.tfvars index c5223ab..1f92a4c 100644 --- a/terraform/terraform.tfvars +++ b/terraform/terraform.tfvars @@ -1,5 +1,5 @@ target_node = "flex" -clone_template = "ubuntu-cloudinit" +clone_template = "nixos-template" cores = 1 memory = 1024 disk_size = "15G" diff --git a/terraform/variables.tf b/terraform/variables.tf index 42e3073..6f94768 100644 --- a/terraform/variables.tf +++ b/terraform/variables.tf @@ -66,13 +66,3 @@ variable "llama_vm_count" { default = 1 description = "How many Llama VMs to create" } - -variable "TS_AUTHKEY" { - type = string - description = "Tailscale auth key used in cloud-init" -} - -variable "SSH_KEY_PUBLIC" { - type = string - description = "My Public SSH key for ssh auth list" -}