CubelaPetarandClaude Opus 5.5
91ed0b300c
- infra/pve: host facts, IP plan, one-time setup - infra/tofu/student-vms: 3 student VMs via tf-mod-pve v1.0.0 - infra/sandbox: template clones for throwaway test VMs - README/TODO: Windows DC/AD instead of FreeIPA, new network - .gitignore: only ignore secrets.auto.tfvars instead of all tfvars Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
PVE host
- Host:
pve(10.100.200.50), Proxmox VE 9.2, 6 cores, 31 GiB RAM - Storage:
local(dir: ISOs, snippets),local-lvm(VM disks) - Network:
vmbr0on10.100.200.0/24, gateway and current DNS10.100.200.4 - Templates:
903temp-debian-13
IP plan (10.100.200.0/24)
| Address | Use | Size |
|---|---|---|
.4 |
Gateway, current DNS | |
.50 |
PVE host | |
.70 |
DC/AD dc01.lab.softbox.net (planned) |
2 vCPU, 4-8 GB |
.80-.100 |
Student VMs (vm-00, …), VMID 1080-1100, 5-10 planned |
1 vCPU, 1 GB |
.101-.211 |
In use by other devices (probably DHCP) |
One-time setup (as root, done)
# 1. Allow snippets on local storage
pvesm set local --content iso,vztmpl,backup,import,snippets
# 2. API user and token for OpenTofu; put the printed value into
# infra/tofu/<role>/secrets.auto.tfvars as pve_api_token = "tofu@pve!tofu=<value>"
pveum user add tofu@pve --comment "OpenTofu"
pveum aclmod / -user tofu@pve -role PVEAdmin
pveum user token add tofu@pve tofu --privsep 0
# 3. sudo for sbxadmin; passwordless rules for the snippet upload of the bpg/proxmox provider
usermod -aG sudo sbxadmin
cat > /etc/sudoers.d/sbxadmin-tofu <<'EOF'
sbxadmin ALL=(root) NOPASSWD: /usr/sbin/pvesm apiinfo
sbxadmin ALL=(root) NOPASSWD: /usr/bin/tee ^/var/lib/vz/snippets/[a-zA-Z0-9_][a-zA-Z0-9_.-]*$
EOF
chmod 440 /etc/sudoers.d/sbxadmin-tofu && visudo -c
# 4. Templates: tf-mod-pve/scripts/create_template.sh, copied to /root/templates/ with
# storage=local-lvm, ssh_keyfile=/root/.ssh/authorized_keys, only temp-debian-13 enabled
cd /root/templates && bash create_template.sh