# PVE host

- Host: `pve` (`10.100.200.50`), Proxmox VE 9.2, 6 cores, 31 GiB RAM
- Storage: `local` (dir: ISOs, snippets), `local-lvm` (VM disks)
- Network: `vmbr0` on `10.100.200.0/24`, gateway and current DNS `10.100.200.4`
- Templates: `903` `temp-debian-13`

## IP plan (10.100.200.0/24)

| Address | Use | Size |
|---|---|---|
| `.4` | Gateway, current DNS | |
| `.50` | PVE host | |
| `.70` | DC/AD `dc01.lab.softbox.net` (planned) | 2 vCPU, 4-8 GB |
| `.80-.100` | Student VMs (`vm-00`, …), VMID `1080-1100`, 5-10 planned | 1 vCPU, 1 GB |
| `.101-.211` | In use by other devices (probably DHCP) | |

## One-time setup (as root, done)

```bash
# 1. Allow snippets on local storage
pvesm set local --content iso,vztmpl,backup,import,snippets

# 2. API user and token for OpenTofu; put the printed value into
#    infra/tofu/<role>/secrets.auto.tfvars as pve_api_token = "tofu@pve!tofu=<value>"
pveum user add tofu@pve --comment "OpenTofu"
pveum aclmod / -user tofu@pve -role PVEAdmin
pveum user token add tofu@pve tofu --privsep 0

# 3. sudo for sbxadmin; passwordless rules for the snippet upload of the bpg/proxmox provider
usermod -aG sudo sbxadmin
cat > /etc/sudoers.d/sbxadmin-tofu <<'EOF'
sbxadmin ALL=(root) NOPASSWD: /usr/sbin/pvesm apiinfo
sbxadmin ALL=(root) NOPASSWD: /usr/bin/tee ^/var/lib/vz/snippets/[a-zA-Z0-9_][a-zA-Z0-9_.-]*$
EOF
chmod 440 /etc/sudoers.d/sbxadmin-tofu && visudo -c

# 4. Templates: tf-mod-pve/scripts/create_template.sh, copied to /root/templates/ with
#    storage=local-lvm, ssh_keyfile=/root/.ssh/authorized_keys, only temp-debian-13 enabled
cd /root/templates && bash create_template.sh
```