Ryan Blundon
97e9889251
- Terraform: VM provisioning, Unifi DHCP, Technitium DNS - talhelper: cluster config for 6-node Talos cluster - Cilium 1.19.4 CNI with Talos-compatible security context - docs: city-hall setup guide and bootstrap runbook
95 lines
4.4 KiB
HCL
95 lines
4.4 KiB
HCL
# ─── Talos Node Resource ─────────────────────────────────────────────────────
|
|
# Creates a Proxmox VM booting from the Talos ISO.
|
|
# No cloud-init, no template clone — Talos is configured via the Talos API
|
|
# after boot using talhelper-generated machine configs from city-hall.
|
|
#
|
|
# Boot sequence:
|
|
# 1. Terraform creates VM (stopped) + DHCP reservation
|
|
# 2. Unifi assigns reserved IP when VM starts
|
|
# 3. talhelper applies machine config via Talos API (port 50000)
|
|
# 4. Cluster bootstraps; ISO is no longer needed after first boot
|
|
# (Talos installs itself to disk on first config apply)
|
|
|
|
resource "proxmox_virtual_environment_vm" "node" {
|
|
name = var.hostname
|
|
vm_id = var.vm_id
|
|
node_name = var.target_node
|
|
|
|
description = "Talos ${var.node_role} node — fastpass cluster. Managed by mk-labs Terraform."
|
|
tags = ["managed", "talos", "fastpass", var.node_role]
|
|
bios = "ovmf"
|
|
|
|
# ─── EFI Disk ─────────────────────────────────────────────────────────────
|
|
# Required for OVMF/UEFI boot. Stores EFI variables.
|
|
efi_disk {
|
|
datastore_id = var.datastore
|
|
file_format = "raw"
|
|
type = "4m"
|
|
}
|
|
|
|
# ─── Boot: Talos ISO ──────────────────────────────────────────────────────
|
|
# Talos boots from ISO, applies machine config via API, then installs
|
|
# itself to the disk. After first boot the ISO is not needed.
|
|
cdrom {
|
|
file_id = var.iso_file_id
|
|
interface = "ide2"
|
|
}
|
|
|
|
boot_order = ["scsi0", "ide2"]
|
|
|
|
# ─── Disk ─────────────────────────────────────────────────────────────────
|
|
# Single disk — Talos manages its own partition layout.
|
|
# No separate data disk; persistent app storage comes from Pure Storage CSI.
|
|
disk {
|
|
datastore_id = var.datastore
|
|
size = var.disk_size
|
|
interface = "scsi0"
|
|
file_format = "raw"
|
|
ssd = true
|
|
discard = "on"
|
|
}
|
|
|
|
# ─── CPU ──────────────────────────────────────────────────────────────────
|
|
cpu {
|
|
cores = var.cpu_cores
|
|
type = "x86-64-v2-AES"
|
|
}
|
|
|
|
# ─── Memory ───────────────────────────────────────────────────────────────
|
|
memory {
|
|
dedicated = var.memory_mb
|
|
}
|
|
|
|
# ─── Network ──────────────────────────────────────────────────────────────
|
|
# Single NIC on VLAN 71 (Server Trusted).
|
|
# MAC is deterministic via Terraform so Unifi DHCP reservation matches.
|
|
network_device {
|
|
bridge = var.bridge
|
|
model = "virtio"
|
|
}
|
|
|
|
# ─── QEMU Guest Agent ─────────────────────────────────────────────────────
|
|
# Requires the qemu-guest-agent Talos system extension (set in talhelper).
|
|
agent {
|
|
enabled = true
|
|
}
|
|
|
|
# ─── Start Behavior ───────────────────────────────────────────────────────
|
|
# VM starts immediately — Talos needs to boot to accept machine configs.
|
|
# Unifi DHCP reservation is created before this resource so the IP is
|
|
# already reserved when the NIC first broadcasts a DHCP request.
|
|
started = true
|
|
|
|
# ─── Lifecycle ────────────────────────────────────────────────────────────
|
|
lifecycle {
|
|
ignore_changes = [
|
|
description,
|
|
tags,
|
|
# cdrom can be ejected manually after first boot without Terraform drift
|
|
cdrom,
|
|
# node_name changes after HA migrates VMs to their intended hosts
|
|
node_name,
|
|
]
|
|
}
|
|
}
|