adding initial files

main.tf

@@ -0,0 +1,79 @@
+resource "local_sensitive_file" "ssh_private_key" {
+  filename        = "${path.module}/.ssh_key"
+  content_base64  = data.external.infisical.result["ssh_private_key_b64"]
+  file_permission = "0600"
+}
+
+locals {
+  # Shared inputs passed to every proxmox_node module call.
+  node_common = {
+    search_domain   = var.search_domain
+    dns_nameservers = var.dns_nameservers
+    ssh_key         = data.external.infisical.result["ssh_public_key"]
+    ansible_user    = var.ansible_user
+    lxc_password    = data.external.infisical.result["lxc_password"]
+  }
+}
+
+# Provider aliases must be statically declared, so each hypervisor needs its
+# own module block. To add or remove a hypervisor, add/remove the corresponding
+# provider alias in providers.tf and a module block here. Everything else
+# (node contents, common config) lives in the parent repo's terraform.tfvars.
+
+module "proxmox" {
+  source = "./opentofu/modules/proxmox_node"
+
+  node_name       = var.hypervisors["proxmox"].node_name
+  storage         = var.hypervisors["proxmox"].storage
+  lxc             = try(var.nodes["proxmox"].lxc, {})
+  machines        = try(var.nodes["proxmox"].machines, {})
+  search_domain   = local.node_common.search_domain
+  dns_nameservers = local.node_common.dns_nameservers
+  ssh_key         = local.node_common.ssh_key
+  ansible_user    = local.node_common.ansible_user
+  lxc_password    = local.node_common.lxc_password
+
+  providers = {
+    proxmox = proxmox.proxmox
+  }
+}
+
+locals {
+  hv_hosts = {
+    proxmox = { lxc = module.proxmox.lxc_hosts, vm = module.proxmox.vm_hosts }
+  }
+
+  all_hosts = flatten([
+    for hv_name, hv in local.hv_hosts : [
+      for h in concat(hv.lxc, hv.vm) : [
+        for tag in h.filtered_tags : {
+          tag  = tag
+          name = h.name
+          ip   = h.ip
+          vmid = h.vmid
+        }
+      ]
+    ]
+  ])
+
+  tag_groups = {
+    for tag in distinct([for h in local.all_hosts : h.tag]) :
+    tag => [
+      for h in local.all_hosts : {
+        name = h.name
+        ip   = h.ip
+        vmid = h.vmid
+      } if h.tag == tag
+    ]
+  }
+}
+
+resource "local_file" "ansible_inventory" {
+  filename = "${path.module}/${var.ansible_inventory_path}"
+  content  = templatefile("${path.module}/opentofu/inventory.tpl", {
+    hypervisors                  = local.hv_hosts
+    tag_groups                   = local.tag_groups
+    ansible_user                 = var.ansible_user
+    ansible_ssh_private_key_file = local_sensitive_file.ssh_private_key.filename
+  })
+}