Work

5 files changed, 411 insertions, 0 deletions

diff --git a/terraform/README.md b/terraform/README.md
new file mode 100644
index 0000000..11c1762
--- /dev/null
+++ b/terraform/README.md
@@ -0,0 +1,42 @@
+This part of the repo is responsible for creating 
+our home-lab infrastructure using Terraform.
+
+# First time
+```
+terraform init
+cp con.env.example con.env
+```
+Modify  `con.env` with your Proxmox access creds.
+
+> Due to [this](https://github.com/bpg/terraform-provider-proxmox/issues/344) issue, 
+we cannot use the recommended approach dedicated TF user's API access.
+
+# Usual flow
+```
+source con.env
+
+terraform plan -out=tfplan
+#terraform plan -target="proxmox_lxc.testvm" -out=tfplan
+
+terraform apply "tfplan"
+```
+
+# Teardown
+```
+terraform destroy
+terraform destroy -target="proxmox_lxc.testvm"
+```
+
+# A note about GPU pass-through
+At the moment, this provider does not support passing through the Host's GPU or iGPU 
+to the guest VM/LXC. So, if you have Guests that require this, you need to do it manually
+by adding the following config on Proxmox `/etc/pve/lxc/<id of your container>.conf`:
+```
+lxc.cgroup2.devices.allow: c 226:0 rwm
+lxc.cgroup2.devices.allow: c 226:128 rwm
+lxc.cgroup2.devices.allow: c 29:0 rwm
+lxc.mount.entry: /dev/dri dev/dri none bind,optional,create=dir
+lxc.mount.entry: /dev/dri/renderD128 dev/renderD128 none bind,optional,create=file
+```
+
+> I do this for my Nextcloud, and Plex containers.
diff --git a/terraform/con.env.example b/terraform/con.env.example
new file mode 100644
index 0000000..a1ddc29
--- /dev/null
+++ b/terraform/con.env.example
@@ -0,0 +1,3 @@
+export PM_API_URL="https://<ip of your proxmox host>:8006/api2/json"
+export PM_USER="root@pam"
+export PM_PASS="aabbccdd123"
diff --git a/terraform/main.tf b/terraform/main.tf
new file mode 100644
index 0000000..f286985
--- /dev/null
+++ b/terraform/main.tf
@@ -0,0 +1,309 @@
+resource "proxmox_lxc" "minio" {
+  target_node  = "pve"
+  hostname     = "minio"
+  ostemplate   = "local:vztmpl/debian-12-standard_12.0-1_amd64.tar.zst"
+  password     = "${var.minio_password}"
+  unprivileged = false
+  cores        = 1
+  cpulimit     = 2
+  memory       = 2048
+  start        = true
+  onboot       = true
+
+  ssh_public_keys = <<-EOT
+    ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIM9ONfhaHpY0bSk3o81H/eEp+UxQ9RCszJ7p3f+rvcpH kdam0@art-sr
+  EOT
+
+  rootfs {
+    storage = "local-lvm"
+    size    = "3G"
+  }
+
+  features {
+    mount   = "nfs;"
+  }
+
+  network {
+    name   = "eth0"
+    bridge = "vmbr1"
+    tag    = 30
+    ip     = "dhcp"
+    mtu    = "1420"
+  }
+}
+
+resource "proxmox_lxc" "sites" {
+  target_node  = "pve"
+  hostname     = "sites"
+  ostemplate   = "local:vztmpl/debian-12-standard_12.0-1_amd64.tar.zst"
+  password     = "${var.sites_password}"
+  unprivileged = true
+  cores        = 1
+  cpulimit     = 1
+  memory       = 1024
+  start        = true
+  onboot       = true
+
+  ssh_public_keys = <<-EOT
+    ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIM9ONfhaHpY0bSk3o81H/eEp+UxQ9RCszJ7p3f+rvcpH kdam0@art-sr
+  EOT
+
+  rootfs {
+    storage = "local-lvm"
+    size    = "3G"
+  }
+
+  features {
+    fuse    = true
+  }
+
+  network {
+    name   = "eth0"
+    bridge = "vmbr1"
+    tag    = 30
+    ip     = "dhcp"
+    mtu    = "1420"
+  }
+}
+
+resource "proxmox_lxc" "rproxy" {
+  target_node  = "pve"
+  hostname     = "rproxy"
+  ostemplate   = "local:vztmpl/alpine-3.18-default_20230607_amd64.tar.xz"
+  password     = "${var.rproxy_password}"
+  unprivileged = true
+  cores        = 1
+  cpulimit     = 1
+  memory       = 1024
+  start        = true
+  onboot       = true
+
+  ssh_public_keys = <<-EOT
+    ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIM9ONfhaHpY0bSk3o81H/eEp+UxQ9RCszJ7p3f+rvcpH kdam0@art-sr
+  EOT
+
+  rootfs {
+    storage = "local-lvm"
+    size    = "2G"
+  }
+
+  network {
+    name   = "eth0"
+    bridge = "vmbr1"
+    tag    = 30
+    ip     = "dhcp"
+    mtu    = "1420"
+  }
+}
+
+resource "proxmox_lxc" "monitoring" {
+  target_node  = "pve"
+  hostname     = "monitoring"
+  ostemplate   = "local:vztmpl/debian-12-standard_12.0-1_amd64.tar.zst"
+  password     = "${var.monitoring_password}"
+  unprivileged = false
+  cores        = 1
+  cpulimit     = 2
+  memory       = 1024
+  start        = true
+  onboot       = true
+
+  ssh_public_keys = <<-EOT
+    ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIM9ONfhaHpY0bSk3o81H/eEp+UxQ9RCszJ7p3f+rvcpH kdam0@art-sr
+  EOT
+
+  rootfs {
+    storage = "local-lvm"
+    size    = "10G"
+  }
+
+  features {
+    nesting = true
+  }
+
+  network {
+    name   = "eth0"
+    bridge = "vmbr1"
+    tag    = 30
+    ip     = "dhcp"
+    mtu    = "1420"
+  }
+}
+
+resource "proxmox_lxc" "nc_kumar" {
+  target_node  = "pve"
+  hostname     = "nc-kumar"
+  ostemplate   = "local:vztmpl/debian-12-standard_12.0-1_amd64.tar.zst"
+  password     = "${var.nc_kumar_password}"
+  unprivileged = false
+  cores        = 8
+  cpulimit     = 8
+  memory       = 12288
+  start        = true
+  onboot       = true
+
+  ssh_public_keys = <<-EOT
+    ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIM9ONfhaHpY0bSk3o81H/eEp+UxQ9RCszJ7p3f+rvcpH kdam0@art-sr
+  EOT
+
+  rootfs {
+    storage = "local-lvm"
+    size    = "15G"
+  }
+
+  features {
+    nesting = true
+    fuse    = true
+    mount   = "nfs;"
+  }
+
+  network {
+    name   = "eth0"
+    bridge = "vmbr1"
+    tag    = 30
+    ip     = "dhcp"
+    mtu    = "1420"
+  }
+}
+
+resource "proxmox_lxc" "plex" {
+  target_node  = "pve"
+  hostname     = "plex"
+  ostemplate   = "local:vztmpl/debian-12-standard_12.0-1_amd64.tar.zst"
+  password     = "${var.plex_password}"
+  unprivileged = false
+  cores        = 8
+  cpulimit     = 8
+  memory       = 4096
+  start        = true
+  onboot       = true
+
+  ssh_public_keys = <<-EOT
+    ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIM9ONfhaHpY0bSk3o81H/eEp+UxQ9RCszJ7p3f+rvcpH kdam0@art-sr
+  EOT
+
+  rootfs {
+    storage = "local-lvm"
+    size    = "100G"
+  }
+
+  features {
+    nesting = true
+    fuse    = true
+    mount   = "nfs;"
+  }
+
+  network {
+    name   = "eth0"
+    bridge = "vmbr1"
+    tag    = 30
+    ip     = "dhcp"
+    mtu    = "1420"
+  }
+}
+
+resource "proxmox_lxc" "vault" {
+  target_node  = "pve"
+  hostname     = "vault"
+  ostemplate   = "local:vztmpl/debian-12-standard_12.0-1_amd64.tar.zst"
+  password     = "${var.vault_password}"
+  unprivileged = true
+  cores        = 1
+  cpulimit     = 2
+  memory       = 1024
+  start        = true
+  onboot       = true
+
+  ssh_public_keys = <<-EOT
+    ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIM9ONfhaHpY0bSk3o81H/eEp+UxQ9RCszJ7p3f+rvcpH kdam0@art-sr
+  EOT
+
+  rootfs {
+    storage = "local-lvm"
+    size    = "10G"
+  }
+
+  features {
+    nesting = true
+  }
+
+  network {
+    name   = "eth0"
+    bridge = "vmbr1"
+    tag    = 30
+    ip     = "dhcp"
+    mtu    = "1420"
+  }
+}
+
+resource "proxmox_lxc" "torrents" {
+  target_node  = "pve"
+  hostname     = "torrents"
+  ostemplate   = "local:vztmpl/debian-12-standard_12.0-1_amd64.tar.zst"
+  password     = "${var.torrents_password}"
+  unprivileged = false
+  cores        = 2
+  cpulimit     = 2
+  memory       = 2048
+  start        = true
+  onboot       = true
+
+  ssh_public_keys = <<-EOT
+    ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIM9ONfhaHpY0bSk3o81H/eEp+UxQ9RCszJ7p3f+rvcpH kdam0@art-sr
+  EOT
+
+  rootfs {
+    storage = "local-lvm"
+    size    = "100G"
+  }
+
+  features {
+    nesting = true
+    fuse    = true
+    mount   = "nfs;"
+  }
+
+  network {
+    name   = "eth0"
+    bridge = "vmbr1"
+    tag    = 30
+    ip     = "dhcp"
+    mtu    = "1420"
+  }
+}
+
+resource "proxmox_lxc" "med_dl" {
+  target_node  = "pve"
+  hostname     = "med-dl"
+  ostemplate   = "local:vztmpl/debian-12-standard_12.0-1_amd64.tar.zst"
+  password     = "${var.med_dl_password}"
+  unprivileged = false
+  cores        = 4
+  cpulimit     = 4
+  memory       = 2048
+  start        = true
+  onboot       = true
+
+  ssh_public_keys = <<-EOT
+    ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIM9ONfhaHpY0bSk3o81H/eEp+UxQ9RCszJ7p3f+rvcpH kdam0@art-sr
+  EOT
+
+  rootfs {
+    storage = "local-lvm"
+    size    = "10G"
+  }
+
+  features {
+    nesting = true
+    fuse    = true
+    mount   = "nfs;"
+  }
+
+  network {
+    name   = "eth0"
+    bridge = "vmbr1"
+    tag    = 30
+    ip     = "dhcp"
+    mtu    = "1420"
+  }
+}
diff --git a/terraform/terraform.tf b/terraform/terraform.tf
new file mode 100644
index 0000000..64842b0
--- /dev/null
+++ b/terraform/terraform.tf
@@ -0,0 +1,12 @@
+terraform {
+  required_providers {
+    proxmox = {
+      source  = "telmate/proxmox"
+      version = ">=1.0.0"
+    }
+  }
+}
+
+provider "proxmox" {
+  # Configuration options
+}
diff --git a/terraform/variables.tf b/terraform/variables.tf
new file mode 100644
index 0000000..00b96c8
--- /dev/null
+++ b/terraform/variables.tf
@@ -0,0 +1,45 @@
+variable "minio_password" {
+  type        = string
+  sensitive   = true
+  description = "Secret key for minio"
+}
+variable "sites_password" {
+  type        = string
+  sensitive   = true
+  description = "Secret key for sites"
+}
+variable "rproxy_password" {
+  type        = string
+  sensitive   = true
+  description = "Secret key for rproxy"
+}
+variable "monitoring_password" {
+  type        = string
+  sensitive   = true
+  description = "Secret key for monitoring"
+}
+variable "nc_kumar_password" {
+  type        = string
+  sensitive   = true
+  description = "Secret key for nc_kumar"
+}
+variable "plex_password" {
+  type        = string
+  sensitive   = true
+  description = "Secret key for plex"
+}
+variable "vault_password" {
+  type        = string
+  sensitive   = true
+  description = "Secret key for vault"
+}
+variable "torrents_password" {
+  type        = string
+  sensitive   = true
+  description = "Secret key for torrents"
+}
+variable "med_dl_password" {
+  type        = string
+  sensitive   = true
+  description = "Secret key for med_dl"
+}