Archlinux up

proxmox/archlinux/files/ladmin@archlinux.pub

@@ -0,0 +1 @@
+ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGH9QqREEaJkDbOGOdKMBiKn9Kq/tgiz6XL9WXZWI/R+ ladmin@archlinux

proxmox/archlinux/locals.tf

@@ -1,3 +1,4 @@
 locals {
   arch_qcow_hash = split(" ", data.http.arch_qcow_hash.response_body)[0]
+  arch_public_key = file("${path.root}/files/ladmin@archlinux.pub")
 }

proxmox/archlinux/providers.tf

@@ -26,3 +26,10 @@ provider "proxmox" {
 provider "dns" {}
 
 provider "http" {}
+
+provider "random" {}
+
+provider "pass" {
+  refresh_store = false
+  store_dir = pathexpand("~/.config/pass")
+}

proxmox/archlinux/resources_pass.tf

@@ -0,0 +1,5 @@
+resource "pass_password" "arch_password" {
+  for_each = toset([for key,value in var.vm_guests: key])
+  password = random_password.this[each.value].result
+  path = "ansible/become-passwords/${each.value}"
+}

proxmox/archlinux/resources_proxmox.tf

@@ -13,13 +13,13 @@ resource "proxmox_download_file" "arch_qcow" {
   verify = true
 }
 
-resource "proxmox_virtual_environment_pool" "archlinux" {
+resource "proxmox_virtual_environment_pool" "this" {
   comment = "Container hosts and download client"
   pool_id = "archlinux"
 }
 
-resource "proxmox_virtual_environment_vm" "container_hosts" {
-  for_each = { for key, value in var.vm_guests: key => value if value.role == "container_host" }
+resource "proxmox_virtual_environment_vm" "this" {
+  for_each = var.vm_guests
   acpi = false
   agent {
     enabled = true
@@ -53,7 +53,6 @@ resource "proxmox_virtual_environment_vm" "container_hosts" {
     backup = true
     cache = "none"
     datastore_id = "local-lvm"
-    # path_in_datastore = "${each.key}_root.qcow2"
     discard = "ignore"
     file_format = "raw"
     file_id = proxmox_download_file.arch_qcow[each.value.host].id
@@ -62,18 +61,20 @@ resource "proxmox_virtual_environment_vm" "container_hosts" {
     replicate = true
     size = 64
   }
-  disk {
-    aio = "io_uring"
-    backup = true
-    cache = "none"
-    datastore_id = "local-lvm"
-    # path_in_datastore = "${each.key}_root.qcow2"
-    discard = "ignore"
-    file_format = "raw"
-    interface = "virtio1"
-    iothread = false
-    replicate = true
-    size = 128
+  dynamic "disk" {
+    for_each = each.value.role == "container_host" ? [1] : []
+    content {
+      aio = "io_uring"
+      backup = true
+      cache = "none"
+      datastore_id = "local-lvm"
+      discard = "ignore"
+      file_format = "raw"
+      interface = "virtio1"
+      iothread = false
+      replicate = true
+      size = 128
+    }
   }
   efi_disk {
     datastore_id = "local-lvm"
@@ -105,9 +106,11 @@ resource "proxmox_virtual_environment_vm" "container_hosts" {
       }
     }
     user_account {
-      keys = []
-      password = "" # FIX
-      username = "" # FIX
+      keys = [
+        local.arch_public_key
+      ]
+      password = random_password.this[each.key].result
+      username = var.arch_username
     }
   }
   keyboard_layout = "en-us"
@@ -133,7 +136,7 @@ resource "proxmox_virtual_environment_vm" "container_hosts" {
   operating_system {
     type = "l26"
   }
-  pool_id = proxmox_virtual_environment_pool.archlinux.pool_id
+  pool_id = proxmox_virtual_environment_pool.this.pool_id
   protection = false
   reboot = false
   reboot_after_update = true
@@ -155,15 +158,3 @@ resource "proxmox_virtual_environment_vm" "container_hosts" {
     model = "i6300esb"
   }
 }
-
-# resource "proxmox_virtual_environment_vm" "download_clients" {
-#   for_each = { for key, value in var.vm_guests: key => value if value.role == "download_client" }
-#   acpi = false
-#   agent {
-#     enabled = true
-#     timeout = "10m"
-#     trim = false
-#     type = "virtio"
-#   }
-#   node_name = each.value.host
-# }

proxmox/archlinux/resources_random.tf

@@ -0,0 +1,13 @@
+resource "random_password" "this" {
+  for_each = toset([for key,value in var.vm_guests: key])
+  length = 16
+  lower = true
+  min_lower = 1
+  min_numeric = 1
+  min_special = 1
+  min_upper = 1
+  numeric = true
+  override_special = "!@#%&?-_+"
+  special = true
+  upper = true
+}

proxmox/archlinux/terraform.tf

@@ -14,6 +14,14 @@ terraform {
       source = "registry.terraform.io/hashicorp/http"
       version = ">= 3.6.1"
     }
+    random = {
+      source = "registry.terraform.io/hashicorp/random"
+      version = ">= 3.9.0"
+    }
+    pass = {
+      source = "registry.terraform.io/digipost/pass"
+      version = ">= 2.1.1"
+    }
   }
 
   backend "local" {

proxmox/archlinux/variables.tf

@@ -45,3 +45,7 @@ variable "local_domain" {
 variable "arch_mirror" {
   type = string
 }
+
+variable "arch_username" {
+  type = string
+}

proxmox/archlinux/vars_archlinux.auto.tfvars

@@ -1 +1,2 @@
 arch_mirror = "mirrors.kernel.org/archlinux"
+arch_username = "ladmin"