revert: insecure to false

change: set insecure to true
add: proxmox project with terraform_user.yml
2025-12-15 19:38:03 +00:00 · 2025-12-13 21:35:26 +00:00 · 2025-12-12 20:45:24 +00:00 · 2025-12-11 19:50:04 +00:00 · 2025-12-06 16:52:01 +00:00 · 2025-12-05 21:24:21 +00:00
15 changed files with 213 additions and 45 deletions
--- a/README.md
+++ b/README.md
@@ -1,3 +1,20 @@
-# Homelab
+# 🧪 Homelab

-Hello world !
+> ⚠️ **Work in Progress** – This repository is actively evolving as I automate and expand my homelab.
+
+Welcome to my homelab repository! This is where I manage and document the infrastructure powering my personal lab environment using modern DevOps tools and best practices.
+
+## 🚀 Goals
+
+- Automate VM and infrastructure deployment with **Terraform**
+- Configure systems and services using **Ansible**
+- Deploy and manage Kubernetes with **Flux CD** using a **GitOps** approach
+- Keep everything **declarative**, **reproducible**, and **version-controlled**
+
+## 📌 Notes
+
+This repository is intended for **educational and experimental purposes**. Feel free to explore, fork, and adapt ideas for your own homelab setup.
+
+---
+
+Stay tuned — more coming soon! 🚧
--- a/ansible/ansiform/inventories/terraform.yml
+++ b/ansible/ansiform/inventories/terraform.yml
--- a/ansible/ansiform/playbooks/deploy_tf.yml
+++ b/ansible/ansiform/playbooks/deploy_tf.yml
--- a/ansible/ansiform/playbooks/install_nginx.yml
+++ b/ansible/ansiform/playbooks/install_nginx.yml
@@ -0,0 +1,35 @@
+---
+- name: Demo Playbook - Install Nginx and Serve Hostname Page
+  hosts: all
+  become: true
+
+  tasks:
+    - name: Ensure apt cache is updated
+      ansible.builtin.apt:
+        update_cache: true
+        cache_valid_time: 3600
+
+    - name: Install nginx
+      ansible.builtin.apt:
+        name: nginx
+        state: present
+
+    - name: Create index.html with hostname
+      ansible.builtin.copy:
+        dest: /var/www/html/index.html
+        content: |
+          <html>
+          <head><title>Demo</title></head>
+          <body>
+              <h1>Hostname: {{ inventory_hostname }}</h1>
+          </body>
+          </html>
+        owner: www-data
+        group: www-data
+        mode: "0644"
+
+    - name: Ensure nginx is running
+      ansible.builtin.service:
+        name: nginx
+        state: started
+        enabled: true
--- a/ansible/ansiform/roles/terraform_vm/defaults/main.yml
+++ b/ansible/ansiform/roles/terraform_vm/defaults/main.yml
--- a/ansible/ansiform/roles/terraform_vm/tasks/main.yml
+++ b/ansible/ansiform/roles/terraform_vm/tasks/main.yml
--- a/ansible/proxmox/terraform_user.yml
+++ b/ansible/proxmox/terraform_user.yml
@@ -0,0 +1,20 @@
+---
+- name: Create Terraform local user for Proxmox
+  hosts: nodes
+  become: true
+  tasks:
+  
+    - name: Create terraform user
+      ansible.builtin.user:
+        name: "{{ terraform_user }}"
+        password: "{{ terraform_password | password_hash('sha512') }}"
+        shell: /bin/bash
+
+    - name: Create sudoers file for terraform user
+      ansible.builtin.copy:
+        dest: /etc/sudoers.d/{{ terraform_user }}
+        mode: '0440'
+        content: |
+          {{ terraform_user }} ALL=(root) NOPASSWD: /sbin/pvesm
+          {{ terraform_user }} ALL=(root) NOPASSWD: /sbin/qm
+          {{ terraform_user }} ALL=(root) NOPASSWD: /usr/bin/tee /var/lib/vz/*
--- a/terraform/modules/pve_vm/main.tf
+++ b/terraform/modules/pve_vm/main.tf
@@ -1,93 +1,107 @@
+# Retrieve VM templates available in Proxmox that match the specified name
 data "proxmox_virtual_environment_vms" "template" {
  filter {
    name   = "name"
-    values = ["${var.vm_template}"]
+    values = ["${var.vm_template}"] # The name of the template to clone from
  }
 }

+# Create a cloud-init configuration file as a Proxmox snippet
 resource "proxmox_virtual_environment_file" "cloud_config" {
-  content_type = "snippets"
-  datastore_id = "local"
-  node_name    = var.node_name
+  content_type = "snippets"        # Cloud-init files are stored as snippets in Proxmox
+  datastore_id = "local"           # Local datastore used to store the snippet
+  node_name    = var.node_name     # The Proxmox node where the file will be uploaded
+
  source_raw {
-    file_name = "${var.vm_name}.cloud-config.yaml"
+    file_name = "${var.vm_name}.cloud-config.yaml" # The name of the snippet file
    data      = <<-EOF
    #cloud-config
    hostname: ${var.vm_name}
    package_update: true
    package_upgrade: true
    packages:
-      - qemu-guest-agent
+      - qemu-guest-agent           # Ensures the guest agent is installed
    users:
      - default
      - name: ${var.vm_user}
        groups: sudo
        shell: /bin/bash
-        ssh-authorized-keys:
-          - "${var.vm_user_sshkey}"
+        ssh-authorized-keys: ${jsonencode(var.vm_user_sshkeys)} # Inject user's SSH key
        sudo: ALL=(ALL) NOPASSWD:ALL
    runcmd:
      - systemctl enable qemu-guest-agent 
-      - reboot
+      - reboot                     # Reboot the VM after provisioning
    EOF
  }
 }

+# Define and provision a new VM by cloning the template and applying initialization
 resource "proxmox_virtual_environment_vm" "vm" {
-  name      = var.vm_name
-  node_name = var.node_name
-  tags      = var.vm_tags
+  name      = var.vm_name           # VM name
+  node_name = var.node_name         # Proxmox node to deploy the VM
+  tags      = var.vm_tags           # Optional VM tags for categorization
+
  agent {
-    enabled = true
+    enabled = true                  # Enable the QEMU guest agent
  }
-  stop_on_destroy = true
+
+  stop_on_destroy = true            # Ensure VM is stopped gracefully when destroyed
+
  clone {
-    vm_id     = data.proxmox_virtual_environment_vms.template.vms[0].vm_id
-    node_name = data.proxmox_virtual_environment_vms.template.vms[0].node_name
+    vm_id     = data.proxmox_virtual_environment_vms.template.vms[0].vm_id     # ID of the source template
+    node_name = data.proxmox_virtual_environment_vms.template.vms[0].node_name # Node of the source template
  }
-  bios    = var.vm_bios
-  machine = var.vm_machine
+
+  bios    = var.vm_bios             # BIOS type (e.g., seabios or ovmf)
+  machine = var.vm_machine          # Machine type (e.g., q35)
+
  cpu {
-    cores = var.vm_cpu
-    type  = "host"
+    cores = var.vm_cpu              # Number of CPU cores
+    type  = "host"                  # Use host CPU type for best compatibility/performance
  }
+
  memory {
-    dedicated = var.vm_ram
+    dedicated = var.vm_ram          # RAM in MB
  }
+
  disk {
-    datastore_id = var.node_datastore
-    interface    = "scsi0"
-    size         = 4
+    datastore_id = var.node_datastore  # Datastore to hold the disk
+    interface    = "scsi0"             # Primary disk interface
+    size         = var.vm_disk_size    # Disk size in GB
  }
+
  initialization {
-    user_data_file_id = proxmox_virtual_environment_file.cloud_config.id
+    user_data_file_id = proxmox_virtual_environment_file.cloud_config.id # Link the cloud-init file
    datastore_id      = var.node_datastore
-    interface         = "scsi1"
+    interface         = "scsi1"             # Separate interface for cloud-init
    ip_config {
      ipv4 {
-        address = "dhcp"
+        address = "dhcp"            # Get IP via DHCP
      }
    }
  }
+
  network_device {
-    bridge  = "vmbr0"
-    vlan_id = var.vm_vlan
+    bridge  = "vlan${var.vm_vlan}"  # VNet used with VLAN ID
  }
+
  operating_system {
-    type = "l26"
+    type = "l26"                    # Linux 2.6+ kernel
  }
+
  vga {
-    type = "std"
+    type = "std"                    # Standard VGA type
  }
+
  lifecycle {
-    ignore_changes = [
+    ignore_changes = [              # Ignore initialization section after first depoloyment for idempotency
      initialization
    ]
  }
 }

+# Output the assigned IP address of the VM after provisioning
 output "vm_ip" {
-  value       = proxmox_virtual_environment_vm.vm.ipv4_addresses[1][0]
+  value       = proxmox_virtual_environment_vm.vm.ipv4_addresses[1][0] # Second network interface's first IP
  description = "VM IP"
-}
-
+}
--- a/terraform/modules/pve_vm/variables.tf
+++ b/terraform/modules/pve_vm/variables.tf
@@ -26,10 +26,13 @@ variable "vm_user" {
  default     = "vez"
 }

-variable "vm_user_sshkey" {
-  description = "Admin user SSH key of the VM"
-  type        = string
-  default     = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAID62LmYRu1rDUha3timAIcA39LtcIOny1iAgFLnxoBxm vez@bastion"
+variable "vm_user_sshkeys" {
+  description = "Admin user SSH keys of the VM"
+  type        = list(string)
+  default     = [
+    "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAID62LmYRu1rDUha3timAIcA39LtcIOny1iAgFLnxoBxm vez@bastion",
+    "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHovfHKpqTvwj5zrcSuSZALa8iiH6qBvE5dyJCz9eQ2k vez@surface"
+  ]
 }

 variable "vm_cpu" {
@@ -44,6 +47,12 @@ variable "vm_ram" {
  default     = 2048
 }

+variable "vm_disk_size" {
+  description = "Size of the disk (GB) of the VM"
+  type        = number
+  default     = 10
+}
+
 variable "vm_bios" {
  description = "Type of BIOS used for the VM"
  type        = string
--- a/terraform/projects/multiple-vm/main.tf
+++ b/terraform/projects/multiple-vm/main.tf
@@ -19,7 +19,7 @@ locals {
      for node in data.proxmox_virtual_environment_nodes.pve_nodes.names : [
        for role, config in local.vm_attr : {
          node_name = node
-          vm_name   = "${role}-${node}"
+          vm_name   = "${node}-${role}"
          vm_cpu    = config.cpu
          vm_ram    = config.ram
          vm_vlan   = config.vlan
--- a/terraform/projects/semaphore-vms/main.tf
+++ b/terraform/projects/semaphore-vms/main.tf
@@ -0,0 +1,33 @@
+module "pve_vm" {
+  source    = "../../modules/pve_vm"
+  for_each  = local.vm_list
+
+  node_name = each.value.node_name
+  vm_name   = each.value.vm_name
+  vm_cpu    = each.value.vm_cpu
+  vm_ram    = each.value.vm_ram
+  vm_vlan   = each.value.vm_vlan
+}
+
+locals {
+  # Ordered list of VM hostnames
+  sem_hosts = ["sem01", "sem02", "sem03"]
+
+  # Create a map: host -> node
+  vm_list = {
+    for idx, host in local.sem_hosts :
+    host => {
+      node_name = data.proxmox_virtual_environment_nodes.pve_nodes.names[idx]
+      vm_name   = host
+      vm_cpu    = 1
+      vm_ram    = 2048
+      vm_vlan   = 66
+    }
+  }
+}
+
+data "proxmox_virtual_environment_nodes" "pve_nodes" {}
+
+output "vm_ip" {
+  value = { for k, v in module.pve_vm : k => v.vm_ip }
+}
--- a/terraform/projects/semaphore-vms/provider.tf
+++ b/terraform/projects/semaphore-vms/provider.tf
@@ -0,0 +1,19 @@
+terraform {
+  required_providers {
+    proxmox = {
+      source = "bpg/proxmox"
+    }
+  }
+}
+
+provider "proxmox" {
+  endpoint  = var.proxmox_endpoint
+  api_token = var.proxmox_api_token
+  insecure  = false
+  ssh {
+    agent       = false
+    # private_key = file("~/.ssh/id_ed25519")
+    username    = var.proxmox_ssh_username
+    password    = var.proxmox_ssh_password
+  }
+}
--- a/terraform/projects/semaphore-vms/variables.tf
+++ b/terraform/projects/semaphore-vms/variables.tf
@@ -0,0 +1,22 @@
+variable "proxmox_endpoint" {
+  description = "Proxmox URL endpoint"
+  type        = string
+}
+
+variable "proxmox_api_token" {
+  description = "Proxmox API token"
+  type        = string
+  sensitive   = true
+}
+
+variable "proxmox_ssh_username" {
+  description = "Proxmox SSH username"
+  type        = string
+  sensitive   = true
+}
+
+variable "proxmox_ssh_password" {
+  description = "Proxmox SSH password"
+  type        = string
+  sensitive   = true
+}
--- a/terraform/projects/simple-vm-with-module/variables.tf
+++ b/terraform/projects/simple-vm-with-module/variables.tf
@@ -7,4 +7,4 @@ variable "proxmox_api_token" {
  description = "Proxmox API token"
  type        = string
  sensitive   = true
-}
+}
--- a/terraform/projects/simple-vm/main.tf
+++ b/terraform/projects/simple-vm/main.tf
@@ -83,8 +83,7 @@ resource "proxmox_virtual_environment_vm" "vm" {
  }

  network_device {
-    bridge  = "vmbr0"               # Use the default bridge
-    vlan_id = var.vm_vlan           # VLAN tagging if used
+    bridge  = "vlan${var.vm_vlan}"  # VNet used with VLAN ID
  }

  operating_system {
Author	SHA1	Message	Date
Vezpi	1bffdef5fe	revert: insecure to false	2025-12-15 19:38:03 +00:00
Vezpi	6a57609f8a	change: set insecure to true	2025-12-13 21:35:26 +00:00
Vezpi	f4d67bee86	add: proxmox project with terraform_user.yml	2025-12-12 20:45:24 +00:00
Vezpi	b028018d7e	change: use username/password instead of ssh key	2025-12-11 19:50:04 +00:00
Vezpi	72bf321145	feat: use multiple ssh key in pve_vm module	2025-12-06 16:52:01 +00:00
Vezpi	87c5a9386d	remove: firewall section	2025-12-05 21:24:21 +00:00
Vezpi	6b1c582ca6	add: install_nginx.yml	2025-12-05 19:50:22 +00:00
Vezpi	908f9748bd	add: semaphore-vms terraform project for semaphore UI	2025-12-05 19:36:03 +00:00
Vezpi	ef0e5bf8f2	change: bridge vmbr0 and vlan tag by vlan66	2025-09-12 06:46:26 +00:00
Vezpi	89be2412ef	feat: variabilize disk size	2025-09-10 08:15:25 +00:00
Vezpi	2f60387d70	change: disk size from 4 to 10	2025-09-04 13:23:46 +00:00
Vezpi	b73837c028	fix: cloud-init config file is now named with the VM hostname	2025-07-16 08:44:43 +00:00
Vezpi	3a991010d5	feat: introduce vm roles	2025-07-07 07:06:01 +00:00
Vezpi	4d92a926be	fix: declare providers at project level	2025-07-04 13:53:51 +00:00
Vezpi	c524868cf5	feat: rework terraform pve_vm module	2025-07-02 07:15:55 +00:00
Vezpi	a78860c3b8	docs: update README	2025-05-28 08:20:16 +00:00
Vezpi	e9f084443d	fix: add lifecycle section for idempotency	2025-05-28 07:45:21 +00:00
Vezpi	e17e6be329	docs: add comments to describe the code	2025-05-28 07:45:11 +00:00
Vezpi	54317c0a1c	restore simple-vm without module	2025-05-28 07:44:57 +00:00