78 lines
2.9 KiB
HCL
78 lines
2.9 KiB
HCL
variable "proxmox_endpoint" {
|
|
description = "Proxmox VE API endpoint, e.g. https://turtle-proxmox-01.home.turtlesystems.co.uk:8006/"
|
|
type = string
|
|
}
|
|
|
|
variable "proxmox_api_token" {
|
|
description = <<-EOT
|
|
Proxmox API token in `USER@REALM!TOKENID=SECRET` form. Sourced from Vault
|
|
(homelab/ci/proxmox), never committed — pass via the TF_VAR_proxmox_api_token
|
|
environment variable.
|
|
EOT
|
|
type = string
|
|
sensitive = true
|
|
}
|
|
|
|
variable "proxmox_insecure" {
|
|
description = "Skip TLS verification — true while Proxmox has a self-signed cert."
|
|
type = bool
|
|
default = true
|
|
}
|
|
|
|
variable "proxmox_node" {
|
|
description = <<-EOT
|
|
Proxmox node guests are created on. Must be the node's **short** name as
|
|
the cluster knows it (`pvecm nodes`), never an FQDN, even though the API
|
|
endpoint is one.
|
|
|
|
pveproxy compares this against its own short hostname to decide whether a
|
|
request is local. An FQDN never matches, so it proxies the request onward
|
|
— to itself — over a connection it verifies against the cluster CA, which
|
|
a self-signed cert fails. The result is an HTTP 596 carrying an OpenSSL
|
|
`certificate verify failed`, which reads like a TLS misconfiguration on
|
|
this side and is not: `proxmox_insecure` governs the provider's own
|
|
connection and has no bearing on Proxmox's internal one.
|
|
EOT
|
|
type = string
|
|
default = "turtle-proxmox-02"
|
|
}
|
|
|
|
variable "proxmox_replication_node" {
|
|
description = <<-EOT
|
|
The other node in the cluster, which guests on a ZFS pool replicate to.
|
|
Only the shared Postgres module uses this today; it lives here rather than
|
|
in that module's own defaults because it names a node of this cluster, the
|
|
same as `proxmox_node` does.
|
|
|
|
Null disables replication. Set it explicitly even on a single-node
|
|
cluster — a null default is indistinguishable from an oversight, and the
|
|
failure mode is a database with no second copy that looks entirely
|
|
healthy.
|
|
EOT
|
|
type = string
|
|
default = "turtle-proxmox-01"
|
|
}
|
|
|
|
variable "lxc_template_file_id" {
|
|
description = <<-EOT
|
|
Container template every LXC module is built from, e.g.
|
|
`local:vztmpl/debian-12-standard_12.7-1_amd64.tar.zst`. Must already be
|
|
downloaded on the node — `pveam list local` shows what is there, `pveam
|
|
available`/`pveam download local <name>` fetches one. Not defaulted: the
|
|
exact filename moves with each point release, so a stale default would fail
|
|
at apply time rather than here.
|
|
EOT
|
|
type = string
|
|
}
|
|
|
|
variable "ssh_public_keys" {
|
|
description = <<-EOT
|
|
Public keys installed for root in every container, so Ansible can reach
|
|
them. The matching private key is in Vault at `homelab/ci/ssh` — see "SSH
|
|
access" in the top-level README.md. Public keys aren't secret, but they are
|
|
site-specific, so pass rather than commit:
|
|
|
|
export TF_VAR_ssh_public_keys='["'"$(cat ~/.ssh/unraid_ansible.pub)"'"]'
|
|
EOT
|
|
type = list(string)
|
|
}
|