terraform fmt

.gitea/workflows/terraform-apply.yml

@@ -16,9 +16,8 @@ jobs:
       pull-requests: write
 
     env:
-      TF_VAR_SSH_KEY_PUBLIC: ${{ secrets.SSH_KEY_PUBLIC }}
-      TF_VAR_TS_AUTHKEY: ${{ secrets.TS_AUTHKEY }}
-      TF_VAR_proxmox_password: ${{ secrets.PROXMOX_PASSWORD }}
+      TF_VAR_TS_AUTHKEY: ${{ secrets.TAILSCALE_KEY }}
+      TF_VAR_ssh_key: ${{ secrets.SSH_PUBLIC_KEY }}
 
     steps:
       - name: Checkout repository
@@ -29,6 +28,11 @@ jobs:
         with:
           terraform_version: 1.6.6
 
+      - name: Inject sensitive secrets
+        working-directory: terraform
+        run: |
+          echo 'proxmox_password = "${{ secrets.PROXMOX_PASSWORD }}"' >> terraform.tfvars
+
       - name: Terraform Init
         working-directory: terraform
         run: terraform init

.gitea/workflows/terraform-destroy.yml

@@ -2,7 +2,9 @@ name: Gitea Destroy Terraform
 run-name: ${{ gitea.actor }} triggered a Terraform Destroy 🧨
 
 on:
-  workflow_dispatch: # Manual trigger
+  push:
+    branches:
+      - destroy
 
 jobs:
   destroy:
@@ -14,10 +16,8 @@ jobs:
       pull-requests: write
 
     env:
-      TF_VAR_SSH_KEY: ${{ secrets.TF_VAR_SSH_KEY_PUBLIC }}
-      TF_VAR_TS_AUTHKEY: ${{ secrets.TF_VAR_TS_AUTHKEY }}
-      TF_VAR_PROXMOX_PASSWORD: ${{ secrets.TF_VAR_PROXMOX_PASSWORD }}
-
+      TF_VAR_TS_AUTHKEY: ${{ secrets.TAILSCALE_KEY }}
+      TF_VAR_ssh_key: ${{ secrets.SSH_PUBLIC_KEY }}
 
     steps:
       - name: Checkout repository
@@ -28,6 +28,11 @@ jobs:
         with:
           terraform_version: 1.6.6
 
+      - name: Inject sensitive secrets
+        working-directory: terraform
+        run: |
+          echo 'proxmox_password = "${{ secrets.PROXMOX_PASSWORD }}"' >> terraform.tfvars
+
       - name: Terraform Init
         working-directory: terraform
         run: terraform init

.gitea/workflows/terraform-plan.yml

@@ -17,9 +17,10 @@ jobs:
       pull-requests: write
 
     env:
-      TF_VAR_SSH_KEY_PUBLIC: ${{ secrets.SSH_KEY_PUBLIC }}
-      TF_VAR_TS_AUTHKEY: ${{ secrets.TS_AUTHKEY }}
-      TF_VAR_proxmox_password: ${{ secrets.PROXMOX_PASSWORD }}
+      TF_VAR_TAILSCALE_KEY: ${{ secrets.TAILSCALE_KEY }}
+      TF_VAR_TS_AUTHKEY: ${{ secrets.TAILSCALE_KEY }}
+      TF_VAR_ssh_key: ${{ secrets.SSH_PUBLIC_KEY }}
+
 
     steps:
       - name: Checkout repository
@@ -30,6 +31,11 @@ jobs:
         with:
           terraform_version: 1.6.6
 
+      - name: Inject sensitive secrets
+        working-directory: terraform
+        run: |
+          echo 'proxmox_password = "${{ secrets.PROXMOX_PASSWORD }}"' >> terraform.tfvars
+
       - name: Terraform Init
         working-directory: terraform
         run: terraform init

.gitignore

@@ -1,6 +1,2 @@
 ./terraform/.terraform
 terraform/.terraform/
-terraform/test-apply.sh
-terraform/test-plan.sh
-terraform/test-destroy.sh
-terraform/tfplan

terraform/.terraform.lock.hcl

@@ -20,6 +20,25 @@ provider "registry.terraform.io/hashicorp/local" {
   ]
 }
 
+provider "registry.terraform.io/hashicorp/null" {
+  version = "3.2.3"
+  hashes = [
+    "h1:+AnORRgFbRO6qqcfaQyeX80W0eX3VmjadjnUFUJTiXo=",
+    "zh:22d062e5278d872fe7aed834f5577ba0a5afe34a3bdac2b81f828d8d3e6706d2",
+    "zh:23dead00493ad863729495dc212fd6c29b8293e707b055ce5ba21ee453ce552d",
+    "zh:28299accf21763ca1ca144d8f660688d7c2ad0b105b7202554ca60b02a3856d3",
+    "zh:55c9e8a9ac25a7652df8c51a8a9a422bd67d784061b1de2dc9fe6c3cb4e77f2f",
+    "zh:756586535d11698a216291c06b9ed8a5cc6a4ec43eee1ee09ecd5c6a9e297ac1",
+    "zh:78d5eefdd9e494defcb3c68d282b8f96630502cac21d1ea161f53cfe9bb483b3",
+    "zh:9d5eea62fdb587eeb96a8c4d782459f4e6b73baeece4d04b4a40e44faaee9301",
+    "zh:a6355f596a3fb8fc85c2fb054ab14e722991533f87f928e7169a486462c74670",
+    "zh:b5a65a789cff4ada58a5baffc76cb9767dc26ec6b45c00d2ec8b1b027f6db4ed",
+    "zh:db5ab669cf11d0e9f81dc380a6fdfcac437aea3d69109c7aef1a5426639d2d65",
+    "zh:de655d251c470197bcbb5ac45d289595295acb8f829f6c781d4a75c8c8b7c7dd",
+    "zh:f5c68199f2e6076bce92a12230434782bf768103a427e9bb9abee99b116af7b5",
+  ]
+}
+
 provider "registry.terraform.io/hashicorp/template" {
   version = "2.2.0"
   hashes = [

terraform/cloud-init.tf

@@ -1,17 +1,70 @@
-### Global cloud-init template (for all VMs)
-
-data "template_file" "cloud_init_global" {
-  template = file("${path.module}/files/cloud_init_global.yaml")
+### Alpaca cloud-init template
+data "template_file" "cloud_init_alpaca" {
+  count    = var.alpaca_vm_count
+  template = file("${path.module}/files/cloud_init.yaml")
 
   vars = {
-    hostname       = "generic"
-    domain         = "home.arpa"
-    TS_AUTHKEY     = var.TS_AUTHKEY
-    SSH_KEY_PUBLIC = var.SSH_KEY_PUBLIC
+    ssh_key    = var.ssh_key
+    hostname   = "alpaca-${count.index + 1}"
+    domain     = "home.arpa"
+    TS_AUTHKEY = var.TS_AUTHKEY
   }
 }
 
-resource "local_file" "cloud_init_global" {
-  content  = data.template_file.cloud_init_global.rendered
-  filename = "${path.module}/files/cloud_init_global.yaml"
+
+resource "local_file" "cloud_init_alpaca" {
+  count    = var.alpaca_vm_count
+  content  = data.template_file.cloud_init_alpaca[count.index].rendered
+  filename = "${path.module}/files/cloud_init_alpaca_${count.index + 1}.yaml"
 }
+
+resource "null_resource" "upload_cloud_init_alpaca" {
+  count = var.alpaca_vm_count
+
+  connection {
+    type = "ssh"
+    user = "root"
+    host = var.target_node
+  }
+
+  provisioner "file" {
+    source      = local_file.cloud_init_alpaca[count.index].filename
+    destination = "/var/lib/vz/snippets/cloud_init_alpaca_${count.index + 1}.yaml"
+  }
+}
+
+### Llama cloud-init template
+data "template_file" "cloud_init_llama" {
+  count    = var.llama_vm_count
+  template = file("${path.module}/files/cloud_init.yaml")
+
+  vars = {
+    ssh_key    = var.ssh_key
+    hostname   = "llama-${count.index + 1}"
+    domain     = "home.arpa"
+    TS_AUTHKEY = var.TS_AUTHKEY
+  }
+}
+
+
+resource "local_file" "cloud_init_llama" {
+  count    = var.llama_vm_count
+  content  = data.template_file.cloud_init_llama[count.index].rendered
+  filename = "${path.module}/files/cloud_init_llama_${count.index + 1}.yaml"
+}
+
+resource "null_resource" "upload_cloud_init_llama" {
+  count = var.llama_vm_count
+
+  connection {
+    type = "ssh"
+    user = "root"
+    host = var.target_node
+  }
+
+  provisioner "file" {
+    source      = local_file.cloud_init_llama[count.index].filename
+    destination = "/var/lib/vz/snippets/cloud_init_llama_${count.index + 1}.yaml"
+  }
+}
+

terraform/files/cloud_init.yaml

@@ -1,9 +1,10 @@
 #cloud-config
 hostname: ${hostname}
 fqdn: ${hostname}.${domain}
+ssh_authorized_keys:
+  - ${ssh_key}
 
 runcmd:
   - curl -fsSL https://tailscale.com/install.sh | sh
   - tailscale up --auth-key=${TS_AUTHKEY}
-  - tailscale set --ssh
 

terraform/files/cloud_init_base.yaml

@@ -1,6 +0,0 @@
-#cloud-config
-runcmd:
-  - curl -fsSL https://tailscale.com/install.sh | sh
-  - tailscale up --auth-key=${TS_AUTHKEY}
-  - tailscale set --ssh
-

terraform/files/cloud_init_global.yaml

@@ -1,48 +0,0 @@
-#cloud-config
-#cloud-config
-hostname: myvm
-manage_etc_hosts: true
-resolv_conf:
-  nameservers:
-    - 8.8.8.8
-    - 1.1.1.1
-
-package_update: true
-package_upgrade: true
-
-# APT fails to acquire GPG keys if package dirmngr is missing
-bootcmd:
-  - [ cloud-init-per, once, dirmngr-aptupdate, apt-get, update ]
-  - [ cloud-init-per, once, dirmngr-aptinstall, apt-get, install, dirmngr, -y ]
-  - [ cloud-init-per, once, dirmngr-aptinstall, apt-get, install, gnupg2, -y ]
-
-packages:
-  - jq
-  - curl
-  - qemu-guest-agent
-
-users:
-- name: stuart
-  groups: sudo
-  shell: /bin/bash
-  sudo: ['ALL=(ALL) NOPASSWD:ALL']
-  ssh_authorized_keys:
-    - ${SSH_KEY_PUBLIC}
-
-preserve_hostname: false
-fqdn: ${hostname}.${domain}
-
-#cloud-config
-# The above header must generally appear on the first line of a cloud config
-# file, but all other lines that begin with a # are optional comments.
-
-runcmd:
-  # One-command install, from https://tailscale.com/download/
-  - ['sh', '-c', 'curl -fsSL https://tailscale.com/install.sh | sh']
-  # Set sysctl settings for IP forwarding (useful when configuring an exit node)
-  - ['sh', '-c', "echo 'net.ipv4.ip_forward = 1' | sudo tee -a /etc/sysctl.d/99-tailscale.conf && echo 'net.ipv6.conf.all.forwarding = 1' | sudo tee -a /etc/sysctl.d/99-tailscale.conf && sudo sysctl -p /etc/sysctl.d/99-tailscale.conf" ]
-  # Generate an auth key from your Admin console
-  # https://login.tailscale.com/admin/settings/keys
-  # and replace the placeholder below
-  - ['tailscale', 'up', '--auth-key=${TS_AUTHKEY}']
-

terraform/main.tf

@@ -20,37 +20,23 @@ resource "proxmox_vm_qemu" "alpacas" {
   vmid        = 500 + count.index + 1
   target_node = var.target_node
   clone       = var.clone_template
-  full_clone  = true
-  os_type     = "cloud-init"
+  full_clone  = false
   agent       = 1
 
-  sockets   = var.sockets
-  cores     = var.cores
-  memory    = var.memory
-  scsihw    = "virtio-scsi-pci"
-  boot      = "order=virtio0"
-  bootdisk  = "virtio0"
-  ipconfig0 = "ip=dhcp"
-  cicustom  = "user=local:snippets/cloud_init_global.yaml"
+  sockets    = var.sockets
+  cores      = var.cores
+  memory     = var.memory
+  scsihw     = "virtio-scsi-pci"
+  boot       = "order=scsi0"
+  ipconfig0  = "ip=dhcp"
+  cicustom   = "user=local:snippets/cloud_init_alpaca_${count.index + 1}.yaml"
+  depends_on = [null_resource.upload_cloud_init_alpaca]
 
-
-  disks {
-    virtio {
-      virtio0 {
-        disk {
-          size    = var.disk_size
-          storage = var.storage
-        }
-      }
-    }
-
-    ide {
-      ide2 {
-        cloudinit {
-          storage = var.storage
-        }
-      }
-    }
+  disk {
+    slot    = "scsi0"
+    type    = "disk"
+    storage = var.storage
+    size    = var.disk_size
   }
 
   network {
@@ -67,39 +53,25 @@ resource "proxmox_vm_qemu" "llamas" {
   vmid        = 600 + count.index + 1
   target_node = var.target_node
   clone       = var.clone_template
-  full_clone  = true
-  os_type     = "cloud-init"
+  full_clone  = false
   agent       = 1
 
-  sockets   = var.sockets
-  cores     = var.cores
-  memory    = var.memory
-  scsihw    = "virtio-scsi-pci"
-  boot      = "order=virtio0"
-  bootdisk  = "virtio0"
-  ipconfig0 = "ip=dhcp"
-  cicustom  = "user=local:snippets/cloud_init_global.yaml"
+  sockets    = var.sockets
+  cores      = var.cores
+  memory     = var.memory
+  scsihw     = "virtio-scsi-pci"
+  boot       = "order=scsi0"
+  ipconfig0  = "ip=dhcp"
+  cicustom   = "user=local:snippets/cloud_init_llama_${count.index + 1}.yaml"
+  depends_on = [null_resource.upload_cloud_init_llama]
 
-  disks {
-    virtio {
-      virtio0 {
-        disk {
-          size    = var.disk_size
-          storage = var.storage
-        }
-      }
-    }
-
-    ide {
-      ide2 {
-        cloudinit {
-          storage = var.storage
-        }
-      }
-    }
+  disk {
+    slot    = "scsi0"
+    type    = "disk"
+    storage = var.storage
+    size    = var.disk_size
   }
 
-
   network {
     id     = 0
     model  = "virtio"

terraform/terraform.tfvars

@@ -1,12 +1,13 @@
 target_node    = "flex"
-clone_template = "ubuntu-cloudinit"
+clone_template = "Alpine-TemplateV2"
 vm_name        = "alpine-vm"
-cores          = 1
-memory         = 1024
+cores          = 2
+memory         = 2048
 disk_size      = "15G"
 sockets        = 1
 bridge         = "vmbr0"
 disk_type      = "scsi"
 storage        = "Flash"
 pm_api_url     = "https://100.105.0.115:8006/api2/json"
-pm_user        = "terraform-prov@pve"
+pm_user        = "terraform-prov@pve"
+

terraform/variables.tf

@@ -79,7 +79,9 @@ variable "TS_AUTHKEY" {
   description = "Tailscale auth key used in cloud-init"
 }
 
-variable "SSH_KEY_PUBLIC" {
+
+variable "ssh_key" {
   type        = string
-  description = "My Public SSH key fo ssh auth list"
+  description = "Public SSH key used by cloud-init"
 }
+