CubelaPetarandClaude Opus 5.5
91ed0b300c
- infra/pve: host facts, IP plan, one-time setup - infra/tofu/student-vms: 3 student VMs via tf-mod-pve v1.0.0 - infra/sandbox: template clones for throwaway test VMs - README/TODO: Windows DC/AD instead of FreeIPA, new network - .gitignore: only ignore secrets.auto.tfvars instead of all tfvars Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
42 lines
1.6 KiB
Markdown
42 lines
1.6 KiB
Markdown
# PVE host
|
|
|
|
- Host: `pve` (`10.100.200.50`), Proxmox VE 9.2, 6 cores, 31 GiB RAM
|
|
- Storage: `local` (dir: ISOs, snippets), `local-lvm` (VM disks)
|
|
- Network: `vmbr0` on `10.100.200.0/24`, gateway and current DNS `10.100.200.4`
|
|
- Templates: `903` `temp-debian-13`
|
|
|
|
## IP plan (10.100.200.0/24)
|
|
|
|
| Address | Use | Size |
|
|
|---|---|---|
|
|
| `.4` | Gateway, current DNS | |
|
|
| `.50` | PVE host | |
|
|
| `.70` | DC/AD `dc01.lab.softbox.net` (planned) | 2 vCPU, 4-8 GB |
|
|
| `.80-.100` | Student VMs (`vm-00`, …), VMID `1080-1100`, 5-10 planned | 1 vCPU, 1 GB |
|
|
| `.101-.211` | In use by other devices (probably DHCP) | |
|
|
|
|
## One-time setup (as root, done)
|
|
|
|
```bash
|
|
# 1. Allow snippets on local storage
|
|
pvesm set local --content iso,vztmpl,backup,import,snippets
|
|
|
|
# 2. API user and token for OpenTofu; put the printed value into
|
|
# infra/tofu/<role>/secrets.auto.tfvars as pve_api_token = "tofu@pve!tofu=<value>"
|
|
pveum user add tofu@pve --comment "OpenTofu"
|
|
pveum aclmod / -user tofu@pve -role PVEAdmin
|
|
pveum user token add tofu@pve tofu --privsep 0
|
|
|
|
# 3. sudo for sbxadmin; passwordless rules for the snippet upload of the bpg/proxmox provider
|
|
usermod -aG sudo sbxadmin
|
|
cat > /etc/sudoers.d/sbxadmin-tofu <<'EOF'
|
|
sbxadmin ALL=(root) NOPASSWD: /usr/sbin/pvesm apiinfo
|
|
sbxadmin ALL=(root) NOPASSWD: /usr/bin/tee ^/var/lib/vz/snippets/[a-zA-Z0-9_][a-zA-Z0-9_.-]*$
|
|
EOF
|
|
chmod 440 /etc/sudoers.d/sbxadmin-tofu && visudo -c
|
|
|
|
# 4. Templates: tf-mod-pve/scripts/create_template.sh, copied to /root/templates/ with
|
|
# storage=local-lvm, ssh_keyfile=/root/.ssh/authorized_keys, only temp-debian-13 enabled
|
|
cd /root/templates && bash create_template.sh
|
|
```
|