Merge pull request 'stage' (#19) from stage into master

Reviewed-on: #19

.gitea/workflows/terraform-apply.yml

@@ -1,5 +1,4 @@
-name: Gitea Actions Demo
+name: Terraform Apply
-run-name: ${{ gitea.actor }} is deploying with Terraform 🚀
 
 on:
   push:
@@ -11,19 +10,17 @@ jobs:
     name: "Terraform Apply"
     runs-on: ubuntu-latest
 
-    permissions:
-      contents: read
-      pull-requests: write
-
-    env:
-      TF_VAR_SSH_KEY_PUBLIC: ${{ secrets.SSH_KEY_PUBLIC }}
-      TF_VAR_TS_AUTHKEY: ${{ secrets.TS_AUTHKEY }}
-      TF_VAR_proxmox_password: ${{ secrets.PROXMOX_PASSWORD }}
-
     steps:
       - name: Checkout repository
         uses: actions/checkout@v4
 
+      - name: Create secrets.tfvars
+        working-directory: terraform
+        run: |
+          cat > secrets.auto.tfvars << EOF
+          pm_api_token_secret = "${{ secrets.PM_API_TOKEN_SECRET }}"
+          EOF
+
       - name: Set up Terraform
         uses: hashicorp/setup-terraform@v2
         with:
@@ -40,4 +37,3 @@ jobs:
       - name: Terraform Apply
         working-directory: terraform
         run: terraform apply -auto-approve
-

.gitea/workflows/terraform-plan.yml

@@ -1,5 +1,4 @@
-name: Gitea Actions Demo
+name: Terraform Plan
-run-name: ${{ gitea.actor }} is testing out Gitea Actions 🚀
 
 on:
   push:
@@ -12,19 +11,22 @@ jobs:
     name: "Terraform Plan"
     runs-on: ubuntu-latest
 
-    permissions:
-      contents: read
-      pull-requests: write
-
-    env:
-      TF_VAR_SSH_KEY_PUBLIC: ${{ secrets.SSH_KEY_PUBLIC }}
-      TF_VAR_TS_AUTHKEY: ${{ secrets.TS_AUTHKEY }}
-      TF_VAR_proxmox_password: ${{ secrets.PROXMOX_PASSWORD }}
-
     steps:
       - name: Checkout repository
         uses: actions/checkout@v4
 
+      - name: Create secrets.tfvars
+        working-directory: terraform
+        run: |
+          echo "PM_API_TOKEN_SECRET length: $(echo -n '${{ secrets.PM_API_TOKEN_SECRET }}' | wc -c)"
+          cat > secrets.auto.tfvars << EOF
+          pm_api_token_secret = "${{ secrets.PM_API_TOKEN_SECRET }}"
+          EOF
+          echo "Created secrets.auto.tfvars:"
+          cat secrets.auto.tfvars | sed 's/=.*/=***/'
+          echo "Using token ID from terraform.tfvars:"
+          grep '^pm_api_token_id' terraform.tfvars
+
       - name: Set up Terraform
         uses: hashicorp/setup-terraform@v2
         with:
@@ -51,4 +53,3 @@ jobs:
         with:
           name: terraform-plan
           path: terraform/tfplan
-

nixos/template-base/README.md

@@ -0,0 +1,27 @@
+# NixOS Proxmox Template Base
+
+This folder contains a minimal NixOS base config you can copy into a new
+template VM build.
+
+## Files
+
+- `flake.nix`: pins `nixos-24.11` and exposes one host config.
+- `configuration.nix`: base settings for Proxmox guest use.
+
+## Before first apply
+
+1. Replace `REPLACE_WITH_YOUR_SSH_PUBLIC_KEY` in `configuration.nix`.
+2. Add `hardware-configuration.nix` from the VM install:
+   - `nixos-generate-config --root /`
+   - copy `/etc/nixos/hardware-configuration.nix` next to `configuration.nix`
+
+## Build/apply example inside the VM
+
+```bash
+sudo nixos-rebuild switch --flake .#template
+```
+
+## Notes
+
+- This is intentionally minimal and avoids cloud-init assumptions.
+- If you want host-specific settings, create additional modules and import them.

nixos/template-base/configuration.nix

@@ -0,0 +1,60 @@
+{ lib, pkgs, ... }:
+
+{
+  imports =
+    lib.optional (builtins.pathExists ./hardware-configuration.nix)
+      ./hardware-configuration.nix;
+
+  networking.hostName = "nixos-template";
+  networking.useDHCP = lib.mkDefault true;
+  networking.nameservers = [ "1.1.1.1" "8.8.8.8" ];
+
+  boot.loader.systemd-boot.enable = lib.mkForce false;
+  boot.loader.grub = {
+    enable = true;
+    device = "/dev/sda";
+  };
+
+  services.qemuGuest.enable = true;
+  services.openssh.enable = true;
+  services.tailscale.enable = true;
+  services.openssh.settings = {
+    PasswordAuthentication = false;
+    KbdInteractiveAuthentication = false;
+    PermitRootLogin = "prohibit-password";
+  };
+
+  programs.fish.enable = true;
+
+  users.users.micqdf = {
+    isNormalUser = true;
+    extraGroups = [ "wheel" ];
+    shell = pkgs.fish;
+    openssh.authorizedKeys.keys = [
+      "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDyfhho9WSqK2OWxizt45Q5KHgox3uVWDnbvMBJaDnRph6CZeKmzaS60/+HN/o7MtIm+q86TfdYeWJVt4erPEvrYN8AWfvCWi+hP2Y0l18wS8GEA+efEXyQ5CLCefraXvIneORObKetzO73bq0HytDRXDowc4J0NcbEFB7ncf2RqVTC6QRlNPRD3jHLkUeKXVmyteNgTtGdMz4MFHCC7xtzgL7kEuuHDEWuVhPkK+dkeGBejq+RzkYcd8v37L7NjFZCK91jANBVcQnTLQVUVVlMovVPyoaROn4N8KpIhb85SYZIJGUEKMhmCowb2NnZLJNC07qn8sz1dmNZO635aquuWMhZTevCySJjvIuMxDSffhBaAjkK1aVixMCW3jyzbpFIEG6FOj27TpcMnen6a0j0AecdCKgXI/Ezb08pj9qmVppAvJPyYoqN4OwHNHGWb8U2X3GghFesei8ZmBgch12RkIaXYxVzkNqv3FG4kAMFMEnGe4e6aqAAuDzUIkcjsPl2XrNJp+pxnPWDc7EMTKPUuKIcteXVDgCVgufQjPBO5/DgUyygLTzt8py9sZyyFDsqRAZ6E3IzBpxyWfUOoN81mUL6G31pZ/1b3YKpNs7DuqvP/aXIvb94o8KsLPQeoG7L2ulcOWX7I0yhlAgd8QUjhNoNq3mK/sQylq9Zy63GhQ=="
+    ];
+    # optional while testing noVNC login:
+    # initialPassword = "changeme123";
+  };
+
+  security.sudo.wheelNeedsPassword = false;
+
+  environment.systemPackages = with pkgs; [
+    btop
+    curl
+    dig
+    eza
+    fd
+    fzf
+    git
+    htop
+    jq
+    ripgrep
+    tree
+    unzip
+    vim
+    wget
+  ];
+
+  system.stateVersion = "24.11";
+}

nixos/template-base/flake.nix

@@ -0,0 +1,14 @@
+{
+  description = "Base NixOS config for Proxmox template";
+
+  inputs = {
+    nixpkgs.url = "github:NixOS/nixpkgs/nixos-24.11";
+  };
+
+  outputs = { nixpkgs, ... }: {
+    nixosConfigurations.template = nixpkgs.lib.nixosSystem {
+      system = "x86_64-linux";
+      modules = [ ./configuration.nix ];
+    };
+  };
+}

terraform/.terraform.lock.hcl

@@ -2,21 +2,21 @@
 # Manual edits may be lost in future updates.
 
 provider "registry.terraform.io/hashicorp/local" {
-  version = "2.5.2"
+  version = "2.7.0"
   hashes = [
-    "h1:JlMZD6nYqJ8sSrFfEAH0Vk/SL8WLZRmFaMUF9PJK5wM=",
+    "h1:2RYa3j7m/0WmET2fqotY4CHxE1Hpk0fgn47/126l+Og=",
-    "zh:136299545178ce281c56f36965bf91c35407c11897f7082b3b983d86cb79b511",
+    "zh:261fec71bca13e0a7812dc0d8ae9af2b4326b24d9b2e9beab3d2400fab5c5f9a",
-    "zh:3b4486858aa9cb8163378722b642c57c529b6c64bfbfc9461d940a84cd66ebea",
+    "zh:308da3b5376a9ede815042deec5af1050ec96a5a5410a2206ae847d82070a23e",
-    "zh:4855ee628ead847741aa4f4fc9bed50cfdbf197f2912775dd9fe7bc43fa077c0",
+    "zh:3d056924c420464dc8aba10e1915956b2e5c4d55b11ffff79aa8be563fbfe298",
-    "zh:4b8cd2583d1edcac4011caafe8afb7a95e8110a607a1d5fb87d921178074a69b",
+    "zh:643256547b155459c45e0a3e8aab0570db59923c68daf2086be63c444c8c445b",
-    "zh:52084ddaff8c8cd3f9e7bcb7ce4dc1eab00602912c96da43c29b4762dc376038",
-    "zh:71562d330d3f92d79b2952ffdda0dad167e952e46200c767dd30c6af8d7c0ed3",
     "zh:78d5eefdd9e494defcb3c68d282b8f96630502cac21d1ea161f53cfe9bb483b3",
-    "zh:805f81ade06ff68fa8b908d31892eaed5c180ae031c77ad35f82cb7a74b97cf4",
+    "zh:7aa4d0b853f84205e8cf79f30c9b2c562afbfa63592f7231b6637e5d7a6b5b27",
-    "zh:8b6b3ebeaaa8e38dd04e56996abe80db9be6f4c1df75ac3cccc77642899bd464",
+    "zh:7dc251bbc487d58a6ab7f5b07ec9edc630edb45d89b761dba28e0e2ba6b1c11f",
-    "zh:ad07750576b99248037b897de71113cc19b1a8d0bc235eb99173cc83d0de3b1b",
+    "zh:7ee0ca546cd065030039168d780a15cbbf1765a4c70cd56d394734ab112c93da",
-    "zh:b9f1c3bfadb74068f5c205292badb0661e17ac05eb23bfe8bd809691e4583d0e",
+    "zh:b1d5d80abb1906e6c6b3685a52a0192b4ca6525fe090881c64ec6f67794b1300",
-    "zh:cc4cbcd67414fefb111c1bf7ab0bc4beb8c0b553d01719ad17de9a047adff4d1",
+    "zh:d81ea9856d61db3148a4fc6c375bf387a721d78fc1fea7a8823a027272a47a78",
+    "zh:df0a1f0afc947b8bfc88617c1ad07a689ce3bd1a29fd97318392e6bdd32b230b",
+    "zh:dfbcad800240e0c68c43e0866f2a751cff09777375ec701918881acf67a268da",
   ]
 }
 
@@ -38,23 +38,23 @@ provider "registry.terraform.io/hashicorp/template" {
 }
 
 provider "registry.terraform.io/telmate/proxmox" {
-  version     = "3.0.1-rc8"
+  version     = "3.0.2-rc07"
-  constraints = "3.0.1-rc8"
+  constraints = "3.0.2-rc07"
   hashes = [
-    "h1:W5X4T5AZUaqO++aAequNECUKJaXLC5upcws6Vp7mkBk=",
+    "h1:zp5hpQJQ4t4zROSLqdltVpBO+Riy9VugtfFbpyTw1aM=",
-    "zh:0272f1600251abf9b139c2683f83cde0a907ac762f5ead058b84de18ddc1d78e",
+    "zh:2ee860cd0a368b3eaa53f4a9ea46f16dab8a97929e813ea6ef55183f8112c2ca",
-    "zh:328e708a8063a133516612b17c8983a9372fa42766530925d1d37aeb1daa30ec",
+    "zh:415965fd915bae2040d7f79e45f64d6e3ae61149c10114efeac1b34687d7296c",
-    "zh:3449150e4d57f79af6f9583e93e3a5ab84fb475bc594de75b968534f57af2871",
+    "zh:6584b2055df0e32062561c615e3b6b2c291ca8c959440adda09ef3ec1e1436bd",
-    "zh:58d803a0203241214f673c80350d43ce1a5ce57b21b83ba08d0d08e8c389dcc4",
+    "zh:65dcfad71928e0a8dd9befc22524ed686be5020b0024dc5cca5184c7420eeb6b",
-    "zh:59e3e99afc1ea404e530100725403c1610d682cfd27eeeaf35190c119b76a4db",
+    "zh:7253dc29bd265d33f2791ac4f779c5413f16720bb717de8e6c5fcb2c858648ea",
-    "zh:666cb7d299824152714202e8fda000c2e37346f2ae6d0a0e3c6f6bd68ef5d9ca",
+    "zh:7ec8993da10a47606670f9f67cfd10719a7580641d11c7aa761121c4a2bd66fb",
-    "zh:6a1290b85e7bf953664b21b2a1ea554923a060f2a8347d8d5bb3d2b5157f85d2",
+    "zh:999a3f7a9dcf517967fc537e6ec930a8172203642fb01b8e1f78f908373db210",
-    "zh:72230960c49fe7050a5e80ee10fa24cdac94dbab82744bccb6aa251741eb5aa9",
+    "zh:a50e6df7280eb6584a5fd2456e3f5b6df13b2ec8a7fa4605511e438e1863be42",
-    "zh:91f655c41f5af9a9fdcf6104c3d0a553eaa0fb3390af81051e744f30accd5b52",
+    "zh:b25b329a1e42681c509d027fee0365414f0cc5062b65690cfc3386aab16132ae",
-    "zh:aa08a22bf737d5840573bb6030617ab6bba2a292f4b9c88b20477cdcfb9676a9",
+    "zh:c028877fdb438ece48f7bc02b65bbae9ca7b7befbd260e519ccab6c0cbb39f26",
-    "zh:b72012cc284cad488207532b6668c58999c972d837b5f486db1d7466d686d5fd",
+    "zh:cf0eaa3ea9fcc6d62793637947f1b8d7c885b6ad74695ab47e134e4ff132190f",
-    "zh:e24f934249a6ab4d3705c1398226d4d9df1e81ef8a36592389be02bc35cc661f",
+    "zh:d5ade3fae031cc629b7c512a7b60e46570f4c41665e88a595d7efd943dde5ab2",
-    "zh:e9e6bcef8b6a6b5ff2317168c2c23e4c55ae23f883ba158d2c4fd6324a0413e5",
+    "zh:f388c15ad1ecfc09e7361e3b98bae9b627a3a85f7b908c9f40650969c949901c",
-    "zh:ffa1e742a8c50babd8dbfcd6884740f9bea8453ec4d832717ff006a4fbfffa91",
+    "zh:f415cc6f735a3971faae6ac24034afdb9ee83373ef8de19a9631c187d5adc7db",
   ]
 }

terraform/cloud-init.tf

@@ -1,17 +1,13 @@
-### Global cloud-init template (for all VMs)
-
 data "template_file" "cloud_init_global" {
-  template = file("${path.module}/files/cloud_init_global.yaml")
+  template = file("${path.module}/files/cloud_init_global.tpl")
 
   vars = {
     hostname = "generic"
     domain   = "home.arpa"
-    TS_AUTHKEY     = var.TS_AUTHKEY
-    SSH_KEY_PUBLIC = var.SSH_KEY_PUBLIC
   }
 }
 
 resource "local_file" "cloud_init_global" {
   content  = data.template_file.cloud_init_global.rendered
-  filename = "${path.module}/files/cloud_init_global.yaml"
+  filename = "${path.module}/files/rendered/cloud_init_global.yaml"
 }

terraform/files/cloud_init_global.tpl

@@ -0,0 +1,10 @@
+#cloud-config
+hostname: ${hostname}
+manage_etc_hosts: true
+resolv_conf:
+  nameservers:
+    - 8.8.8.8
+    - 1.1.1.1
+
+preserve_hostname: false
+fqdn: ${hostname}.${domain}

terraform/files/cloud_init_global.yaml

@@ -1,48 +0,0 @@
-#cloud-config
-#cloud-config
-hostname: myvm
-manage_etc_hosts: true
-resolv_conf:
-  nameservers:
-    - 8.8.8.8
-    - 1.1.1.1
-
-package_update: true
-package_upgrade: true
-
-# APT fails to acquire GPG keys if package dirmngr is missing
-bootcmd:
-  - [ cloud-init-per, once, dirmngr-aptupdate, apt-get, update ]
-  - [ cloud-init-per, once, dirmngr-aptinstall, apt-get, install, dirmngr, -y ]
-  - [ cloud-init-per, once, dirmngr-aptinstall, apt-get, install, gnupg2, -y ]
-
-packages:
-  - jq
-  - curl
-  - qemu-guest-agent
-
-users:
-- name: stuart
-  groups: sudo
-  shell: /bin/bash
-  sudo: ['ALL=(ALL) NOPASSWD:ALL']
-  ssh_authorized_keys:
-    - ${SSH_KEY_PUBLIC}
-
-preserve_hostname: false
-fqdn: ${hostname}.${domain}
-
-#cloud-config
-# The above header must generally appear on the first line of a cloud config
-# file, but all other lines that begin with a # are optional comments.
-
-runcmd:
-  # One-command install, from https://tailscale.com/download/
-  - ['sh', '-c', 'curl -fsSL https://tailscale.com/install.sh | sh']
-  # Set sysctl settings for IP forwarding (useful when configuring an exit node)
-  - ['sh', '-c', "echo 'net.ipv4.ip_forward = 1' | sudo tee -a /etc/sysctl.d/99-tailscale.conf && echo 'net.ipv6.conf.all.forwarding = 1' | sudo tee -a /etc/sysctl.d/99-tailscale.conf && sudo sysctl -p /etc/sysctl.d/99-tailscale.conf" ]
-  # Generate an auth key from your Admin console
-  # https://login.tailscale.com/admin/settings/keys
-  # and replace the placeholder below
-  - ['tailscale', 'up', '--auth-key=${TS_AUTHKEY}']
-

terraform/main.tf

@@ -2,15 +2,15 @@ terraform {
   required_providers {
     proxmox = {
       source  = "Telmate/proxmox"
-      version = "3.0.1-rc8"
+      version = "3.0.2-rc07"
     }
   }
 }
 
 provider "proxmox" {
   pm_api_url          = var.pm_api_url
-  pm_user         = var.pm_user
+  pm_api_token_id     = var.pm_api_token_id
-  pm_password     = var.proxmox_password
+  pm_api_token_secret = var.pm_api_token_secret
   pm_tls_insecure     = true
 }
 
@@ -106,4 +106,3 @@ resource "proxmox_vm_qemu" "llamas" {
     bridge = var.bridge
   }
 }
-

terraform/outputs.tf

@@ -1,6 +1,6 @@
 output "alpaca_vm_ids" {
   value = {
-    for i in range(var.alpaca_count) :
+    for i in range(var.alpaca_vm_count) :
     "alpaca-${i + 1}" => proxmox_vm_qemu.alpacas[i].vmid
   }
 }
@@ -11,7 +11,7 @@ output "alpaca_vm_names" {
 
 output "llama_vm_ids" {
   value = {
-    for i in range(var.llama_count) :
+    for i in range(var.llama_vm_count) :
     "llama-${i + 1}" => proxmox_vm_qemu.llamas[i].vmid
   }
 }
@@ -19,4 +19,3 @@ output "llama_vm_ids" {
 output "llama_vm_names" {
   value = [for vm in proxmox_vm_qemu.llamas : vm.name]
 }
-

terraform/terraform.tfvars

@@ -1,12 +1,10 @@
 target_node     = "flex"
-clone_template = "ubuntu-cloudinit"
+clone_template  = "nixos-template"
-vm_name        = "alpine-vm"
 cores           = 1
 memory          = 1024
 disk_size       = "15G"
 sockets         = 1
 bridge          = "vmbr0"
-disk_type      = "scsi"
 storage         = "Flash"
 pm_api_url      = "https://100.105.0.115:8006/api2/json"
-pm_user        = "terraform-prov@pve"
+pm_api_token_id = "terraform-prov@pve!mytoken"

terraform/variables.tf

@@ -1,5 +1,22 @@
-variable "proxmox_password" {
+variable "pm_api_token_id" {
   type        = string
+  description = "Proxmox API token ID (format: user@realm!tokenid)"
+
+  validation {
+    condition     = can(regex(".+!.+", trimspace(var.pm_api_token_id)))
+    error_message = "pm_api_token_id must be in format user@realm!tokenid."
+  }
+}
+
+variable "pm_api_token_secret" {
+  type        = string
+  sensitive   = true
+  description = "Proxmox API token secret"
+
+  validation {
+    condition     = length(trimspace(var.pm_api_token_secret)) > 0
+    error_message = "pm_api_token_secret cannot be empty. Check your Gitea secret PM_API_TOKEN_SECRET."
+  }
 }
 
 variable "target_node" {
@@ -10,10 +27,6 @@ variable "clone_template" {
   type = string
 }
 
-variable "vm_name" {
-  type = string
-}
-
 variable "cores" {
   type = number
 }
@@ -34,10 +47,6 @@ variable "bridge" {
   type = string
 }
 
-variable "disk_type" {
-  type = string
-}
-
 variable "storage" {
   type = string
 }
@@ -46,22 +55,6 @@ variable "pm_api_url" {
   type = string
 }
 
-variable "pm_user" {
-  type = string
-}
-
-variable "alpaca_count" {
-  type        = number
-  default     = 1
-  description = "How many Alpaca VMs to create"
-}
-
-variable "llama_count" {
-  type        = number
-  default     = 1
-  description = "How many Llama VMs to create"
-}
-
 variable "alpaca_vm_count" {
   type        = number
   default     = 1
@@ -73,13 +66,3 @@ variable "llama_vm_count" {
   default     = 1
   description = "How many Llama VMs to create"
 }
-
-variable "TS_AUTHKEY" {
-  type        = string
-  description = "Tailscale auth key used in cloud-init"
-}
-
-variable "SSH_KEY_PUBLIC" {
-  type        = string
-  description = "My Public SSH key fo ssh auth list"
-}