Archived

This repository has been archived on 2026-07-30. You can view files and clone it. You cannot open issues or pull requests or push a commit.

Files

T

beatzaplentyandClaude Sonnet 4.6 f85c65870f Initial infrastructure mono-repo scaffold

Consolidates nixos, docker, raspi, and debian-configuration into a single
infrastructure-as-code repo. Includes:

- ansible/: full inventory + proxmox-hardening, freeipa, and raspberrypi
  roles (converted from debian-configuration bash scripts)
- terraform/: Proxmox VMs, Dynu DNS, Pi-hole (decommissioned stub),
  Docker container catalog — migrated from docker/infrastructure/terraform/
- stacks/docker/, stacks/raspi/, nixos/: placeholder READMEs pending
  git subtree population (see implementation plan)
- docs/: internal MkDocs site with architecture, network topology, runbooks,
  and drift-detection guide; external sanitized site
- scripts/: drift-detect.sh, docs-build.sh, install-hooks.sh, check-secrets.sh
- CI: secret-scan (push/PR), drift-detect (daily), docs-build (on change)
- Pi-hole removed throughout — DNS is FreeIPA, DHCP is router

See docs/internal/implementation-plan.md for the phased rollout after
pushing to Gitea.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01UvNjoxTWEDkhXsd1Dq2ETP

2026-07-30 07:07:47 +10:00

1.5 KiB

Raw Blame History

terraform/

Infrastructure state management. Each subdirectory is an independent Terraform workspace with its own state backend.

Workspaces

Directory	What it manages	State backend
`proxmox/`	Proxmox VMs and LXCs on pve1	Remote (configure in bootstrap/)
`dns/`	Dynu dynamic DNS records	Remote
`docker/`	Docker container catalog (documentation-only, read-only)	Local
`bootstrap/`	Remote state backend resources	Local (chicken-and-egg)

Usage

# Dry-run: show what would change
cd terraform/proxmox
terraform init
terraform plan

# Detect drift only (exit 2 = drift, exit 0 = in sync)
terraform plan -detailed-exitcode

# Apply (confirm first — always review the plan)
terraform apply

Credentials

Never commit credentials. Use terraform.tfvars (git-ignored) or environment variables:

# Proxmox
export TF_VAR_proxmox_endpoint="https://pve1.sweet.home:8006/"
export TF_VAR_proxmox_api_token_id="terraform@pve!tf"
export TF_VAR_proxmox_api_token_secret="<token>"

# Dynu DNS
export TF_VAR_dynu_api_key="<api_key>"

Importing existing resources

See docs/internal/implementation-plan.md Phase 2 for the terraform import commands to bring existing Proxmox resources under state management.

Drift detection

The drift-detect CI workflow runs terraform plan -detailed-exitcode daily on all workspaces and sends a Gotify notification if any drift is detected.

1.5 KiB Raw Blame History