nickandClaude Opus 5
14dd42bb1b
module.technitium was gated only on the API token being present in Infisical, so the single way to stop Terraform reconciling DNS was to pull the token -- which also disables anything else that needs it. This adds an explicit switch that ANDs with the existing token check, so the token can stay put. Set to false for now: DNS is being moved by hand during the domain migration, and an apply in the middle of that would fight it. Co-Authored-By: Claude Opus 5 <[email protected]>
235 lines
7.7 KiB
HCL
235 lines
7.7 KiB
HCL
# ── Site configuration ─────────────────────────────────────────────────────────
|
|
|
|
hypervisors = {
|
|
proxmox = {
|
|
api_url = "https://192.168.7.240:8006/"
|
|
node_name = "pve"
|
|
storage = "local-lvm"
|
|
}
|
|
goose = {
|
|
api_url = "https://192.168.7.241:8006/"
|
|
node_name = "goose"
|
|
storage = "local-lvm"
|
|
}
|
|
}
|
|
|
|
ipam_endpoint = "https://ipam.example.net/api"
|
|
|
|
network_subnets = {
|
|
lan = "192.168.0.0/24"
|
|
atlashorizon = "192.168.7.0/24"
|
|
}
|
|
|
|
ansible_user = "ansible"
|
|
search_domain = "lan.oswaldtheotter.net"
|
|
dns_nameservers = "192.168.7.2"
|
|
technitium_host = "http://192.168.7.2:5380"
|
|
|
|
# ── DNS (Technitium) ────────────────────────────────────────────────────────────
|
|
# Every declared node automatically gets an A record in the search_domain zone
|
|
# (lan.oswaldtheotter.net). Define extra zones and manual records below.
|
|
|
|
# Set to false to stop Terraform from managing Technitium DNS zones/records
|
|
# (the LXC itself is unaffected; only module.technitium is skipped).
|
|
technitium_enabled = false
|
|
|
|
# Additional zones beyond the auto-managed search_domain zone.
|
|
dns_zones = {
|
|
# "internal.oswaldtheotter.net" = { type = "Primary" }
|
|
# "10.168.192.in-addr.arpa" = { type = "Primary" }
|
|
}
|
|
|
|
# Manual records. In the search_domain zone, a record whose name matches an
|
|
# auto-added host replaces that host's record instead of conflicting with it.
|
|
dns_records = [
|
|
# { zone = "lan.oswaldtheotter.net", name = "router", type = "A", value = "192.168.0.1" },
|
|
# { zone = "lan.oswaldtheotter.net", name = "nas", type = "CNAME", value = "dev.lan.oswaldtheotter.net" },
|
|
# { zone = "lan.oswaldtheotter.net", name = "@", type = "MX", value = "mail.lan.oswaldtheotter.net", priority = 10 },
|
|
]
|
|
|
|
|
|
# ── Reverse proxy (Caddy) ───────────────────────────────────────────────────────
|
|
# Managed on the caddy LXC (192.168.0.5). The admin API listens on loopback, so
|
|
# reach it by tunneling SSH to the box as the ansible user. Clear caddy_host to
|
|
# disable Caddy management entirely.
|
|
|
|
caddy_host = "http://localhost:2019"
|
|
caddy_ssh_host = "[email protected]:22"
|
|
# From: ssh-keyscan 192.168.0.5 — must be refreshed if the LXC is rebuilt.
|
|
# Must be the ECDSA key: the provider's (old) Go SSH client prefers
|
|
# ecdsa-sha2-nistp256 during negotiation and pins the exact key it receives.
|
|
caddy_ssh_host_key = "192.168.0.5 ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBLjluBg9JCITeqG4NPad4VNTkAcZDY3y9FU9CP5BAuKIr3TDhTFYzuAdNnROCEhW1ddJI9ZFKI5y/3xqNTmkHbA="
|
|
|
|
# Each proxy serves plain HTTP on :80 by default; set protocol = "https" to
|
|
# serve it on :443 instead. Note: .lan hostnames can't get public certificates,
|
|
# so HTTPS sites use Caddy's internal CA — trust its root cert on your devices
|
|
# to avoid browser warnings.
|
|
caddy_proxies = {
|
|
# dns = {
|
|
# host = "dns.oswaldtheotter.lan"
|
|
# upstreams = ["192.168.0.2:5380"]
|
|
# }
|
|
# secure-example = {
|
|
# host = "secure.oswaldtheotter.lan"
|
|
# upstreams = ["192.168.0.202:80"]
|
|
# protocol = "https"
|
|
# }
|
|
code = {
|
|
host = "code.oswaldtheotter.lan"
|
|
upstreams = ["192.168.0.200:8080"]
|
|
}
|
|
}
|
|
|
|
# ── Node definitions ───────────────────────────────────────────────────────────
|
|
|
|
nodes = {
|
|
proxmox = {
|
|
lxc = {
|
|
"caddy" = {
|
|
hostname = "caddy"
|
|
vmid = 101
|
|
template = "local:vztmpl/debian-13-standard_13.1-2_amd64.tar.zst"
|
|
unprivileged = true
|
|
onboot = true
|
|
tags = ""
|
|
memory = 1024
|
|
swap = 0
|
|
disk_size = "8G"
|
|
nic_name = "eth0"
|
|
bridge = "vmbr0"
|
|
ip = "192.168.0.5/24"
|
|
nameserver = "192.168.0.2"
|
|
gw = "192.168.0.1"
|
|
}
|
|
"audiopen" = {
|
|
hostname = "audiopen"
|
|
vmid = 801
|
|
template = "local:vztmpl/debian-13-standard_13.1-2_amd64.tar.zst"
|
|
unprivileged = true
|
|
onboot = true
|
|
tags = ""
|
|
memory = 512
|
|
swap = 0
|
|
disk_size = "8G"
|
|
nic_name = "eth0"
|
|
bridge = "vmbr0"
|
|
ip = "192.168.0.202/24"
|
|
gw = "192.168.0.1"
|
|
}
|
|
"remoteterm" = {
|
|
hostname = "remoteterm"
|
|
vmid = 117
|
|
template = "local:vztmpl/debian-13-standard_13.1-2_amd64.tar.zst"
|
|
unprivileged = true
|
|
onboot = false
|
|
tags = ""
|
|
memory = 2048
|
|
swap = 0
|
|
disk_size = "16G"
|
|
nic_name = "eth0"
|
|
bridge = "vmbr0"
|
|
ip = "192.168.0.203/24"
|
|
gw = "192.168.0.1"
|
|
}
|
|
"technitium" = {
|
|
hostname = "technitium"
|
|
vmid = 118
|
|
template = "local:vztmpl/debian-13-standard_13.1-2_amd64.tar.zst"
|
|
unprivileged = true
|
|
onboot = true
|
|
tags = ""
|
|
memory = 2048
|
|
swap = 0
|
|
disk_size = "8G"
|
|
nic_name = "eth0"
|
|
bridge = "vmbr0"
|
|
ip = "192.168.0.2/24"
|
|
gw = "192.168.0.1"
|
|
}
|
|
}
|
|
machines = {
|
|
}
|
|
}
|
|
goose = {
|
|
lxc = {
|
|
"dev" = {
|
|
hostname = "dev"
|
|
vmid = 200
|
|
template = "local:vztmpl/debian-13-standard_13.1-2_amd64.tar.zst"
|
|
unprivileged = true
|
|
onboot = true
|
|
tags = ""
|
|
memory = 4096
|
|
swap = 2048
|
|
disk_size = "32G"
|
|
nic_name = "eth0"
|
|
bridge = "vmbr0"
|
|
vlan = 1
|
|
ip = "192.168.0.200/24"
|
|
nameserver = "192.168.0.2"
|
|
gw = "192.168.0.1"
|
|
}
|
|
"donetick" = {
|
|
hostname = "donetick"
|
|
vmid = 201
|
|
template = "local:vztmpl/debian-13-standard_13.1-2_amd64.tar.zst"
|
|
unprivileged = true
|
|
onboot = true
|
|
tags = ""
|
|
memory = 4096
|
|
swap = 2048
|
|
disk_size = "32G"
|
|
nic_name = "eth0"
|
|
bridge = "vmbr0"
|
|
vlan = 1
|
|
ip = "192.168.0.202/24"
|
|
nameserver = "192.168.0.2"
|
|
gw = "192.168.0.1"
|
|
}
|
|
}
|
|
machines = {
|
|
"oswald-runner" = {
|
|
hostname = "oswald-runner"
|
|
vmid = 202
|
|
ip = "192.168.7.50"
|
|
vlan = 7
|
|
template = "Debian13"
|
|
full_clone = true
|
|
onboot = true
|
|
tags = ""
|
|
agent = 1
|
|
memory = 4096
|
|
disk_size = "32"
|
|
balloon = 1
|
|
cpu_type = "kvm64"
|
|
cores = 4
|
|
sockets = 1
|
|
vcpus = 0
|
|
bios = "ovmf"
|
|
machine = "q35"
|
|
bridge = "vmbr0"
|
|
}
|
|
"grist" = {
|
|
hostname = "grist"
|
|
vmid = 204
|
|
ip = "192.168.7.54"
|
|
vlan = 7
|
|
template = "Debian13"
|
|
full_clone = true
|
|
onboot = true
|
|
tags = ""
|
|
agent = 1
|
|
memory = 4096
|
|
disk_size = "32"
|
|
balloon = 1
|
|
cpu_type = "kvm64"
|
|
cores = 4
|
|
sockets = 1
|
|
vcpus = 0
|
|
bios = "ovmf"
|
|
machine = "q35"
|
|
bridge = "vmbr0"
|
|
}
|
|
}
|
|
}
|
|
} |