terraform oldmac
This commit is contained in:
Dmitry Sergeev
@@ -0,0 +1,25 @@
|
||||
# Terraform files
|
||||
.terraform/
|
||||
*.tfstate
|
||||
*.tfstate.backup
|
||||
*.tfstate.*.backup
|
||||
*.tfvars
|
||||
*.tfvars.json
|
||||
.terraform.lock.hcl
|
||||
|
||||
# Sensitive files
|
||||
secrets/
|
||||
*.pem
|
||||
*.key
|
||||
*.cert
|
||||
|
||||
# Local files
|
||||
.terraform.tfstate.lock.info
|
||||
terraform.plan
|
||||
plan.out
|
||||
|
||||
# IDE files
|
||||
.vscode/
|
||||
.idea/
|
||||
*.swp
|
||||
*.swo
|
||||
@@ -0,0 +1,6 @@
|
||||
#cloud-config
|
||||
packages:
|
||||
- qemu-guest-agent
|
||||
|
||||
runcmd:
|
||||
- systemctl enable --now qemu-guest-agent
|
||||
@@ -0,0 +1,101 @@
|
||||
# https://registry.terraform.io/providers/Telmate/proxmox/latest/docs/guides/cloud-init%2520getting%2520started
|
||||
locals {
|
||||
vms = {
|
||||
vm100 = {
|
||||
vmid = 100
|
||||
name = "runner-docker"
|
||||
memory = 1024
|
||||
cores = 1
|
||||
primary_disk_size = "32G"
|
||||
},
|
||||
}
|
||||
}
|
||||
|
||||
provider "proxmox" {
|
||||
pm_api_url = "https://10.5.1.11:8006/api2/json"
|
||||
pm_tls_insecure = true
|
||||
pm_user = "tfuser@pve"
|
||||
pm_api_token_id = "tfuser@pve!tf"
|
||||
pm_api_token_secret = "992b51e6-578d-43ca-bc49-720fd407ef3f"
|
||||
}
|
||||
|
||||
resource "proxmox_vm_qemu" "cloudinit" {
|
||||
for_each = local.vms
|
||||
vmid = each.value.vmid
|
||||
name = each.value.name
|
||||
target_node = "pve-mac"
|
||||
agent = 1
|
||||
full_clone = true
|
||||
|
||||
cpu {
|
||||
cores = each.value.cores
|
||||
}
|
||||
memory = each.value.memory
|
||||
boot = "order=scsi0"
|
||||
clone = "debian13-template"
|
||||
scsihw = "virtio-scsi-single"
|
||||
vm_state = "running"
|
||||
automatic_reboot = true
|
||||
|
||||
cicustom = "vendor=local:snippets/init-agent.yaml"
|
||||
ciupgrade = true
|
||||
skip_ipv6 = true
|
||||
ciuser = "user"
|
||||
cipassword = "user"
|
||||
sshkeys = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKxACXG6mkk+CML+NsTyJyteiyszpM7m1Pmq+AW7cQ19 yaprac terraform"
|
||||
ipconfig0 = "ip=dhcp"
|
||||
|
||||
serial {
|
||||
id = 0
|
||||
}
|
||||
|
||||
disks {
|
||||
scsi {
|
||||
scsi0 {
|
||||
disk {
|
||||
storage = "local-lvm"
|
||||
size = each.value.primary_disk_size
|
||||
discard = false
|
||||
iothread = false
|
||||
}
|
||||
}
|
||||
}
|
||||
ide {
|
||||
ide1 {
|
||||
cloudinit {
|
||||
storage = "local-lvm"
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
network {
|
||||
id = 0
|
||||
bridge = "vmbr0"
|
||||
model = "virtio"
|
||||
}
|
||||
|
||||
startup_shutdown {
|
||||
order = -1
|
||||
startup_delay = -1
|
||||
shutdown_timeout = -1
|
||||
}
|
||||
|
||||
lifecycle {
|
||||
ignore_changes = [
|
||||
vm_state,
|
||||
cipassword,
|
||||
sshkeys,
|
||||
disks,
|
||||
]
|
||||
}
|
||||
}
|
||||
|
||||
terraform {
|
||||
required_providers {
|
||||
proxmox = {
|
||||
source = "Telmate/proxmox"
|
||||
version = "3.0.2-rc07"
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,152 @@
|
||||
# Proxmox Network Recommendations
|
||||
|
||||
## Current Setup
|
||||
|
||||
- Home network: `10.5.1.0/24`
|
||||
- Proxmox host: `10.5.1.10` (static)
|
||||
- Single NIC, `vmbr0` bridged to LAN
|
||||
- VMs on the same `/24` via DHCP
|
||||
|
||||
```
|
||||
Home Router (10.5.1.1)
|
||||
|
|
||||
[LAN: 10.5.1.0/24]
|
||||
|
|
||||
Proxmox (10.5.1.10) — vmbr0 bridged to LAN
|
||||
|
|
||||
VMs (DHCP from home router, flat network)
|
||||
```
|
||||
|
||||
Problem: VMs, Proxmox management UI (port 8006), and all LAN devices share the same flat network — no isolation.
|
||||
|
||||
---
|
||||
|
||||
## Best Practice Tiers
|
||||
|
||||
### Tier 1 — Minimal (single NIC, no managed switch)
|
||||
|
||||
Add a second internal bridge for isolated VMs. Keep `vmbr0` for LAN-facing VMs.
|
||||
|
||||
```
|
||||
vmbr0 → bridged to NIC → 10.5.1.0/24 (LAN, trusted VMs)
|
||||
vmbr1 → internal only → 10.5.2.0/24 (isolated VMs + NAT)
|
||||
```
|
||||
|
||||
Add to `/etc/network/interfaces`:
|
||||
|
||||
```
|
||||
auto vmbr1
|
||||
iface vmbr1 inet static
|
||||
address 10.5.2.1/24
|
||||
bridge-ports none
|
||||
bridge-stp off
|
||||
post-up echo 1 > /proc/sys/net/ipv4/ip_forward
|
||||
post-up iptables -t nat -A POSTROUTING -s 10.5.2.0/24 -o vmbr0 -j MASQUERADE
|
||||
post-down iptables -t nat -D POSTROUTING -s 10.5.2.0/24 -o vmbr0 -j MASQUERADE
|
||||
```
|
||||
|
||||
**Tradeoff:** No special hardware needed. Proxmox web UI still reachable from entire LAN.
|
||||
|
||||
---
|
||||
|
||||
### Tier 2 — VLAN Segmentation (single NIC + managed switch)
|
||||
|
||||
Make `vmbr0` VLAN-aware. All VLANs over one physical NIC, router handles inter-VLAN routing.
|
||||
|
||||
| VLAN | Purpose | Subnet |
|
||||
|------|---------------------|-----------------|
|
||||
| 10 | Proxmox management | 10.5.10.0/24 |
|
||||
| 20 | Trusted VMs / LAN | 10.5.20.0/24 |
|
||||
| 30 | IoT / untrusted | 10.5.30.0/24 |
|
||||
| 40 | DMZ (internet-facing) | 10.5.40.0/24 |
|
||||
|
||||
In Proxmox UI: set `vmbr0` → **VLAN aware**, assign VLAN tag per VM.
|
||||
|
||||
**Requires:** managed switch + VLAN-capable router (OPNsense, pfSense, Unifi, TP-Link Omada, etc.).
|
||||
|
||||
---
|
||||
|
||||
### Tier 3 — Firewall VM inside Proxmox
|
||||
|
||||
Run OPNsense or pfSense as a VM. Proxmox management gets its own isolated VLAN unreachable by guest VMs.
|
||||
|
||||
```
|
||||
WAN → pfSense VM → routes between all VLANs → VMs
|
||||
→ Proxmox management VLAN (isolated)
|
||||
```
|
||||
|
||||
**Tradeoff:** Most flexible, most complex. Worth it for internet-exposed services.
|
||||
|
||||
---
|
||||
|
||||
## Recommended Setup: Two NICs (Physical Separation)
|
||||
|
||||
Physical separation is simpler and more secure than VLAN trunking at home lab scale.
|
||||
|
||||
```
|
||||
NIC1 (enp1s0) → vmbr0 → Proxmox management only
|
||||
host IP: 10.5.1.10
|
||||
web UI + SSH — no VMs attached
|
||||
|
||||
NIC2 (enp2s0) → vmbr1 → VM traffic bridge
|
||||
VMs get DHCP from home router
|
||||
no host IP on this bridge
|
||||
```
|
||||
|
||||
**Security benefit:** even if a VM is compromised, it has no path to the Proxmox management interface.
|
||||
|
||||
### `/etc/network/interfaces`
|
||||
|
||||
```
|
||||
auto lo
|
||||
iface lo inet loopback
|
||||
|
||||
# Management — Proxmox host only
|
||||
auto enp1s0
|
||||
iface enp1s0 inet manual
|
||||
|
||||
auto vmbr0
|
||||
iface vmbr0 inet static
|
||||
address 10.5.1.10/24
|
||||
gateway 10.5.1.1
|
||||
bridge-ports enp1s0
|
||||
bridge-stp off
|
||||
bridge-fd 0
|
||||
|
||||
# VM traffic — no IP on the bridge itself
|
||||
auto enp2s0
|
||||
iface enp2s0 inet manual
|
||||
|
||||
auto vmbr1
|
||||
iface vmbr1 inet manual
|
||||
bridge-ports enp2s0
|
||||
bridge-stp off
|
||||
bridge-fd 0
|
||||
```
|
||||
|
||||
NIC2 must connect to a regular untagged LAN port on your switch/router so VMs continue to receive DHCP from the home router on `10.5.1.0/24`.
|
||||
|
||||
### Terraform — update the network bridge
|
||||
|
||||
In `main.tf`, change `bridge` from `vmbr0` to `vmbr1` for both resource blocks:
|
||||
|
||||
```hcl
|
||||
network {
|
||||
id = 0
|
||||
bridge = "vmbr1"
|
||||
model = "virtio"
|
||||
}
|
||||
```
|
||||
|
||||
No router changes needed — VMs still get `10.5.1.x` addresses via DHCP as before.
|
||||
|
||||
---
|
||||
|
||||
## Summary
|
||||
|
||||
| Option | Hardware needed | Isolation | Complexity |
|
||||
|--------|----------------|-----------|------------|
|
||||
| Tier 1 (NAT bridge) | None | Partial | Low |
|
||||
| Tier 2 (VLANs) | Managed switch | Good | Medium |
|
||||
| Tier 3 (Firewall VM) | None extra | Excellent | High |
|
||||
| **Two NICs** (chosen) | Second NIC | **Good, simple** | **Low** |
|
||||
Reference in New Issue
Block a user