58 lines
3.3 KiB
Markdown
58 lines
3.3 KiB
Markdown
# mk-labs VM Provisioning Pipeline — Backlog
|
|
|
|
## Pipeline Hardening
|
|
|
|
- [ ] **Error handling on individual pipeline steps** — Each step (Terraform, Proxmox API, NetBox API) should catch failures and set NetBox status to Failed with a descriptive error in provisioning_notes
|
|
- [ ] **Terraform init check** — Verify `terraform init` has been run before `apply`, or add it to the pipeline
|
|
- [ ] **Terraform plan before apply** — Optional dry-run mode for validation without execution
|
|
- [ ] **`-state` flag deprecation** — Migrate from `-state` CLI flag to local backend `path` attribute for per-VM state isolation
|
|
|
|
## Secrets Management
|
|
|
|
- [ ] **HashiCorp Vault (or equivalent)** — Centralized secrets management to replace n8n Global Constants
|
|
- [ ] **Verify n8n Community Edition compatibility** — Confirm whether CE supports external secrets store integrations before planning migration
|
|
|
|
## Sub-workflow Refactoring (DRY)
|
|
|
|
- [ ] **DHCP: Create Reservation** — Extract Unifi DHCP step into standalone sub-workflow (inputs: hostname, mac_address, ip_address). Reusable for LXCs, printers, switches, etc.
|
|
- [ ] **DNS: Delete A Record** — Companion to the existing Create sub-workflow for VM decommissioning
|
|
- [ ] **NetBox: Register MAC Address** — Extract MAC creation + interface assignment into sub-workflow
|
|
|
|
## Ansible Integration
|
|
|
|
- [ ] **Semaphore trigger from n8n** — Call Semaphore API to launch vm-provision playbook after VM boots
|
|
- [ ] **vm-baseline role** — Packages, SSH hardening, user config, any other OS-level setup
|
|
- [ ] **Ansible sets NetBox Active** — Move final status update from n8n to Ansible (confirms OS config succeeded, not just infra provisioning)
|
|
|
|
## Infrastructure Automation
|
|
|
|
- [ ] **city-hall bootstrap playbook** — Ansible playbook to automate Terraform prerequisites: install Terraform, clone repo, `terraform init` on all modules, create `states/` directories
|
|
- [ ] **Proxmox API token management** — Document or automate token rotation
|
|
|
|
## VM Lifecycle
|
|
|
|
- [ ] **VM decommissioning pipeline** — Reverse flow triggered by NetBox status change (e.g., Active → Decommissioning):
|
|
- [ ] Remove VM from HA affinity rule (Proxmox API)
|
|
- [ ] Remove HA resource (Proxmox API)
|
|
- [ ] Stop VM (Proxmox API)
|
|
- [ ] Remove DNS A record (Technitium API — new sub-workflow: DNS: Delete A Record)
|
|
- [ ] Remove DHCP reservation (Terraform destroy on unifi/dhcp state file)
|
|
- [ ] Destroy VM (Terraform destroy on proxmox/vm state file)
|
|
- [ ] Remove MAC address from NetBox
|
|
- [ ] Clear VM resources in NetBox (CPU, memory, disk)
|
|
- [ ] Set NetBox status to Decommissioned (or delete VM record)
|
|
- [ ] Clean up Terraform state files
|
|
- [ ] **VM resize/update pipeline** — Handle CPU/memory changes triggered from NetBox
|
|
- [ ] **VM rebuild pipeline** — Destroy and re-provision a VM in place (same IP, hostname, fresh OS)
|
|
|
|
## NetBox Enhancements
|
|
|
|
- [ ] **Webhook idempotency** — Investigate NetBox event rule conditions to filter at the source instead of in n8n
|
|
- [ ] **Additional custom fields** — As needs arise (e.g., Ansible playbook to run, application role)
|
|
|
|
## n8n Workflow Improvements
|
|
|
|
- [ ] **Notification on failure** — Slack/email alert when pipeline fails
|
|
- [ ] **Execution logging** — Structured logging for pipeline runs
|
|
- [ ] **Parallel execution** — Run independent steps concurrently (e.g., NetBox VM update + DHCP reservation)
|