terraform {
  required_version = ">= 1.6"

  required_providers {
    proxmox = {
      source = "bpg/proxmox"
      # Deliberately unpinned until the first real `terraform init` — pin to
      # whatever it resolves, and commit .terraform.lock.hcl (which is not
      # gitignored) so everyone and CI get the same provider.
      # version = "~> 0.0"
    }
  }

  # State in Postgres rather than a local file: CI and your workstation need
  # to see the same state, and a local file makes Terraform workstation-only.
  #
  # Specifically the CloudNativePG cluster on k3s, reached at
  # k3s_postgres_loadbalancer_ip — *not* the shared Postgres this
  # configuration itself provisions on Proxmox. That would be circular:
  # Terraform would need the database to exist in order to create the
  # container the database runs in. Putting state on a cluster this
  # configuration has no hand in building breaks the cycle outright, which is
  # why it is worth the cross-platform dependency the rest of the repo
  # otherwise avoids — `terraform apply` now needs the Pis up.
  #
  # Left empty on purpose — the connection string contains a password, so it
  # is supplied at init time instead of being committed:
  #
  #   terraform init \
  #     -backend-config="conn_str=postgres://terraform:$PG_PASSWORD@192.168.50.81:5432/terraform_state"
  #
  # Bootstrap ordering: the k3s cluster and its CNPG instance must exist (and
  # a `terraform_state` database be created on it) before `terraform init`
  # succeeds. See docs/postgres-proxmox.md.
  backend "pg" {}
}

provider "proxmox" {
  endpoint  = var.proxmox_endpoint
  api_token = var.proxmox_api_token
  insecure  = var.proxmox_insecure
}