56 lines
2.5 KiB
YAML
56 lines
2.5 KiB
YAML
---
|
|
# Dynamic inventory: asks the Proxmox API which guests exist rather than
|
|
# listing them by hand, so LXCs created by `terraform apply` show up without
|
|
# a second edit here.
|
|
#
|
|
# VERIFY BEFORE FIRST USE — two things this config asserts that depend on
|
|
# your Proxmox and collection versions:
|
|
#
|
|
# 1. Collection name. Proxmox content was split out of `community.general`
|
|
# into its own `community.proxmox` collection. If your installed
|
|
# Ansible predates that split, this is `community.general.proxmox`
|
|
# instead — here, in requirements.yml, and in ansible.cfg's
|
|
# `enable_plugins`. Check with:
|
|
# ansible-doc -t inventory community.proxmox.proxmox
|
|
# 2. Auto-generated group names. The plugin builds groups from guest type
|
|
# and state; `proxmox_all_lxc` is the conventional one but confirm
|
|
# against your own output before relying on it:
|
|
# ansible-inventory -i inventory/proxmox.yml --graph
|
|
#
|
|
plugin: community.proxmox.proxmox
|
|
|
|
url: "{{ lookup('env', 'PROXMOX_URL') }}"
|
|
user: "{{ lookup('env', 'PROXMOX_USER') }}"
|
|
|
|
# API token, not a password — same reasoning as the Unraid SSH key: a
|
|
# password would mean an interactive prompt (impossible from CI) or a
|
|
# plaintext secret on disk. Store these in Vault under `homelab/ci/proxmox`
|
|
# and export them before running; see docs/vault-secrets.md.
|
|
token_id: "{{ lookup('env', 'PROXMOX_TOKEN_ID') }}"
|
|
token_secret: "{{ lookup('env', 'PROXMOX_TOKEN_SECRET') }}"
|
|
|
|
# Homelab Proxmox typically has a self-signed cert. Flip to true once you
|
|
# put a real one on it.
|
|
validate_certs: false
|
|
|
|
want_facts: true
|
|
|
|
# Manually-created guests are not this repo's to touch. Both Terraform
|
|
# modules tag the LXCs they create with `terraform` (see
|
|
# src/*/terraform/variables.tf), so that tag is the line between "managed
|
|
# here" and "made by hand on the node". Filtering rather than narrowing
|
|
# the group below keeps hand-made guests out of the inventory entirely,
|
|
# so no future play can target them by accident either.
|
|
#
|
|
# `filters` needs a reasonably recent plugin version. If yours rejects the
|
|
# option, delete this block and put the same condition on the group:
|
|
# proxmox_guests: >-
|
|
# proxmox_vmtype == 'lxc'
|
|
# and 'terraform' in (proxmox_tags_parsed | default([]))
|
|
filters:
|
|
- "'terraform' in (proxmox_tags_parsed | default([]))"
|
|
|
|
groups:
|
|
# The group playbooks/proxmox.yml targets. Containers only — VMs, if you
|
|
# ever add any, are not what `lxc_app` knows how to install into.
|
|
proxmox_guests: "proxmox_vmtype == 'lxc'"
|