added technitium config

main.tf

@@ -1,17 +1,30 @@
 resource "local_sensitive_file" "ssh_private_key" {
-  filename        = "${path.module}/.ssh_key"
+  filename        = pathexpand("~/.ssh/infra_ansible_key")
   content_base64  = data.external.infisical.result["ssh_private_key_b64"]
   file_permission = "0600"
 }
 
 locals {
+  # Flatten all declared hosts from tfvars. Derived from var.nodes (not module
+  # outputs) so the values are known at plan time and for_each can use them
+  # before any VMs are created.
+  all_declared_hosts = flatten([
+    for hv_name, hv in var.nodes : concat(
+      [for name, lxc in try(hv.lxc, {}) : { name = name, ip = split("/", lxc.ip)[0] }],
+      [for name, vm in try(hv.machines, {}) : { name = name, ip = split("/", vm.ip)[0] }]
+    )
+  ])
+
+  technitium_enabled = try(data.external.infisical.result["technitium_api_token"], "") != ""
+
   # Shared inputs passed to every proxmox_node module call.
   node_common = {
-    search_domain   = var.search_domain
-    dns_nameservers = var.dns_nameservers
-    ssh_key         = data.external.infisical.result["ssh_public_key"]
-    ansible_user    = var.ansible_user
-    lxc_password    = data.external.infisical.result["lxc_password"]
+    search_domain        = var.search_domain
+    dns_nameservers      = var.dns_nameservers
+    ssh_key              = data.external.infisical.result["ssh_public_key"]
+    ansible_user         = var.ansible_user
+    lxc_password         = data.external.infisical.result["lxc_password"]
+    ssh_private_key_path = local_sensitive_file.ssh_private_key.filename
   }
 }
 
@@ -30,8 +43,9 @@ module "proxmox" {
   search_domain   = local.node_common.search_domain
   dns_nameservers = local.node_common.dns_nameservers
   ssh_key         = local.node_common.ssh_key
-  ansible_user    = local.node_common.ansible_user
-  lxc_password    = local.node_common.lxc_password
+  ansible_user         = local.node_common.ansible_user
+  lxc_password         = local.node_common.lxc_password
+  ssh_private_key_path = local.node_common.ssh_private_key_path
 
   providers = {
     proxmox = proxmox.proxmox
@@ -68,6 +82,16 @@ locals {
   }
 }
 
+module "technitium" {
+  source = "./opentofu/modules/technitium"
+
+  enabled = local.technitium_enabled
+  zone    = var.search_domain
+  hosts   = local.all_declared_hosts
+  zones   = var.dns_zones
+  records = var.dns_records
+}
+
 resource "local_file" "ansible_inventory" {
   filename = "${path.module}/${var.ansible_inventory_path}"
   content  = templatefile("${path.module}/opentofu/inventory.tpl", {