From cc77e7464b17f0a624b16f5549993b8553b1ac5f Mon Sep 17 00:00:00 2001 From: Dmitry Sergeev Date: Thu, 23 Jul 2026 21:53:15 +0300 Subject: [PATCH] terraform oldmac --- README.md | 9 ++ terraform/oldmac/.gitignore | 25 ++++ terraform/oldmac/init-agent.yaml | 6 + terraform/oldmac/main.tf | 101 +++++++++++++ terraform/oldmac/network-recommendations.md | 152 ++++++++++++++++++++ 5 files changed, 293 insertions(+) create mode 100644 terraform/oldmac/.gitignore create mode 100644 terraform/oldmac/init-agent.yaml create mode 100644 terraform/oldmac/main.tf create mode 100644 terraform/oldmac/network-recommendations.md diff --git a/README.md b/README.md index f6741a0..390639a 100644 --- a/README.md +++ b/README.md @@ -1 +1,10 @@ # Home infra repo +## Hosts: +- t5 10.5.1.10 +- oldmac 10.5.1.11 +## Tokens for oldmac +| key | value | +| :----: | :---: | +| full-tokenid | tfuser@pve!tf | +| info | {"privsep":"0"} | +| value | 992b51e6-578d-43ca-bc49-720fd407ef3f | diff --git a/terraform/oldmac/.gitignore b/terraform/oldmac/.gitignore new file mode 100644 index 0000000..80a71c8 --- /dev/null +++ b/terraform/oldmac/.gitignore @@ -0,0 +1,25 @@ +# Terraform files +.terraform/ +*.tfstate +*.tfstate.backup +*.tfstate.*.backup +*.tfvars +*.tfvars.json +.terraform.lock.hcl + +# Sensitive files +secrets/ +*.pem +*.key +*.cert + +# Local files +.terraform.tfstate.lock.info +terraform.plan +plan.out + +# IDE files +.vscode/ +.idea/ +*.swp +*.swo \ No newline at end of file diff --git a/terraform/oldmac/init-agent.yaml b/terraform/oldmac/init-agent.yaml new file mode 100644 index 0000000..0f8d95e --- /dev/null +++ b/terraform/oldmac/init-agent.yaml @@ -0,0 +1,6 @@ +#cloud-config +packages: + - qemu-guest-agent + +runcmd: + - systemctl enable --now qemu-guest-agent diff --git a/terraform/oldmac/main.tf b/terraform/oldmac/main.tf new file mode 100644 index 0000000..0f8d252 --- /dev/null +++ b/terraform/oldmac/main.tf @@ -0,0 +1,101 @@ +# https://registry.terraform.io/providers/Telmate/proxmox/latest/docs/guides/cloud-init%2520getting%2520started +locals { + vms = { + vm100 = { + vmid = 100 + name = "runner-docker" + memory = 1024 + cores = 1 + primary_disk_size = "32G" + }, + } +} + +provider "proxmox" { + pm_api_url = "https://10.5.1.11:8006/api2/json" + pm_tls_insecure = true + pm_user = "tfuser@pve" + pm_api_token_id = "tfuser@pve!tf" + pm_api_token_secret = "992b51e6-578d-43ca-bc49-720fd407ef3f" +} + +resource "proxmox_vm_qemu" "cloudinit" { + for_each = local.vms + vmid = each.value.vmid + name = each.value.name + target_node = "pve-mac" + agent = 1 + full_clone = true + + cpu { + cores = each.value.cores + } + memory = each.value.memory + boot = "order=scsi0" + clone = "debian13-template" + scsihw = "virtio-scsi-single" + vm_state = "running" + automatic_reboot = true + + cicustom = "vendor=local:snippets/init-agent.yaml" + ciupgrade = true + skip_ipv6 = true + ciuser = "user" + cipassword = "user" + sshkeys = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKxACXG6mkk+CML+NsTyJyteiyszpM7m1Pmq+AW7cQ19 yaprac terraform" + ipconfig0 = "ip=dhcp" + + serial { + id = 0 + } + + disks { + scsi { + scsi0 { + disk { + storage = "local-lvm" + size = each.value.primary_disk_size + discard = false + iothread = false + } + } + } + ide { + ide1 { + cloudinit { + storage = "local-lvm" + } + } + } + } + + network { + id = 0 + bridge = "vmbr0" + model = "virtio" + } + + startup_shutdown { + order = -1 + startup_delay = -1 + shutdown_timeout = -1 + } + + lifecycle { + ignore_changes = [ + vm_state, + cipassword, + sshkeys, + disks, + ] + } +} + +terraform { + required_providers { + proxmox = { + source = "Telmate/proxmox" + version = "3.0.2-rc07" + } + } +} diff --git a/terraform/oldmac/network-recommendations.md b/terraform/oldmac/network-recommendations.md new file mode 100644 index 0000000..3d84d24 --- /dev/null +++ b/terraform/oldmac/network-recommendations.md @@ -0,0 +1,152 @@ +# Proxmox Network Recommendations + +## Current Setup + +- Home network: `10.5.1.0/24` +- Proxmox host: `10.5.1.10` (static) +- Single NIC, `vmbr0` bridged to LAN +- VMs on the same `/24` via DHCP + +``` +Home Router (10.5.1.1) + | + [LAN: 10.5.1.0/24] + | + Proxmox (10.5.1.10) — vmbr0 bridged to LAN + | + VMs (DHCP from home router, flat network) +``` + +Problem: VMs, Proxmox management UI (port 8006), and all LAN devices share the same flat network — no isolation. + +--- + +## Best Practice Tiers + +### Tier 1 — Minimal (single NIC, no managed switch) + +Add a second internal bridge for isolated VMs. Keep `vmbr0` for LAN-facing VMs. + +``` +vmbr0 → bridged to NIC → 10.5.1.0/24 (LAN, trusted VMs) +vmbr1 → internal only → 10.5.2.0/24 (isolated VMs + NAT) +``` + +Add to `/etc/network/interfaces`: + +``` +auto vmbr1 +iface vmbr1 inet static + address 10.5.2.1/24 + bridge-ports none + bridge-stp off + post-up echo 1 > /proc/sys/net/ipv4/ip_forward + post-up iptables -t nat -A POSTROUTING -s 10.5.2.0/24 -o vmbr0 -j MASQUERADE + post-down iptables -t nat -D POSTROUTING -s 10.5.2.0/24 -o vmbr0 -j MASQUERADE +``` + +**Tradeoff:** No special hardware needed. Proxmox web UI still reachable from entire LAN. + +--- + +### Tier 2 — VLAN Segmentation (single NIC + managed switch) + +Make `vmbr0` VLAN-aware. All VLANs over one physical NIC, router handles inter-VLAN routing. + +| VLAN | Purpose | Subnet | +|------|---------------------|-----------------| +| 10 | Proxmox management | 10.5.10.0/24 | +| 20 | Trusted VMs / LAN | 10.5.20.0/24 | +| 30 | IoT / untrusted | 10.5.30.0/24 | +| 40 | DMZ (internet-facing) | 10.5.40.0/24 | + +In Proxmox UI: set `vmbr0` → **VLAN aware**, assign VLAN tag per VM. + +**Requires:** managed switch + VLAN-capable router (OPNsense, pfSense, Unifi, TP-Link Omada, etc.). + +--- + +### Tier 3 — Firewall VM inside Proxmox + +Run OPNsense or pfSense as a VM. Proxmox management gets its own isolated VLAN unreachable by guest VMs. + +``` +WAN → pfSense VM → routes between all VLANs → VMs + → Proxmox management VLAN (isolated) +``` + +**Tradeoff:** Most flexible, most complex. Worth it for internet-exposed services. + +--- + +## Recommended Setup: Two NICs (Physical Separation) + +Physical separation is simpler and more secure than VLAN trunking at home lab scale. + +``` +NIC1 (enp1s0) → vmbr0 → Proxmox management only + host IP: 10.5.1.10 + web UI + SSH — no VMs attached + +NIC2 (enp2s0) → vmbr1 → VM traffic bridge + VMs get DHCP from home router + no host IP on this bridge +``` + +**Security benefit:** even if a VM is compromised, it has no path to the Proxmox management interface. + +### `/etc/network/interfaces` + +``` +auto lo +iface lo inet loopback + +# Management — Proxmox host only +auto enp1s0 +iface enp1s0 inet manual + +auto vmbr0 +iface vmbr0 inet static + address 10.5.1.10/24 + gateway 10.5.1.1 + bridge-ports enp1s0 + bridge-stp off + bridge-fd 0 + +# VM traffic — no IP on the bridge itself +auto enp2s0 +iface enp2s0 inet manual + +auto vmbr1 +iface vmbr1 inet manual + bridge-ports enp2s0 + bridge-stp off + bridge-fd 0 +``` + +NIC2 must connect to a regular untagged LAN port on your switch/router so VMs continue to receive DHCP from the home router on `10.5.1.0/24`. + +### Terraform — update the network bridge + +In `main.tf`, change `bridge` from `vmbr0` to `vmbr1` for both resource blocks: + +```hcl +network { + id = 0 + bridge = "vmbr1" + model = "virtio" +} +``` + +No router changes needed — VMs still get `10.5.1.x` addresses via DHCP as before. + +--- + +## Summary + +| Option | Hardware needed | Isolation | Complexity | +|--------|----------------|-----------|------------| +| Tier 1 (NAT bridge) | None | Partial | Low | +| Tier 2 (VLANs) | Managed switch | Good | Medium | +| Tier 3 (Firewall VM) | None extra | Excellent | High | +| **Two NICs** (chosen) | Second NIC | **Good, simple** | **Low** |