terraform oldmac
This commit is contained in:
Dmitry Sergeev
@@ -1 +1,10 @@
|
|||||||
# Home infra repo
|
# Home infra repo
|
||||||
|
## Hosts:
|
||||||
|
- t5 10.5.1.10
|
||||||
|
- oldmac 10.5.1.11
|
||||||
|
## Tokens for oldmac
|
||||||
|
| key | value |
|
||||||
|
| :----: | :---: |
|
||||||
|
| full-tokenid | tfuser@pve!tf |
|
||||||
|
| info | {"privsep":"0"} |
|
||||||
|
| value | 992b51e6-578d-43ca-bc49-720fd407ef3f |
|
||||||
|
|||||||
@@ -0,0 +1,25 @@
|
|||||||
|
# Terraform files
|
||||||
|
.terraform/
|
||||||
|
*.tfstate
|
||||||
|
*.tfstate.backup
|
||||||
|
*.tfstate.*.backup
|
||||||
|
*.tfvars
|
||||||
|
*.tfvars.json
|
||||||
|
.terraform.lock.hcl
|
||||||
|
|
||||||
|
# Sensitive files
|
||||||
|
secrets/
|
||||||
|
*.pem
|
||||||
|
*.key
|
||||||
|
*.cert
|
||||||
|
|
||||||
|
# Local files
|
||||||
|
.terraform.tfstate.lock.info
|
||||||
|
terraform.plan
|
||||||
|
plan.out
|
||||||
|
|
||||||
|
# IDE files
|
||||||
|
.vscode/
|
||||||
|
.idea/
|
||||||
|
*.swp
|
||||||
|
*.swo
|
||||||
@@ -0,0 +1,6 @@
|
|||||||
|
#cloud-config
|
||||||
|
packages:
|
||||||
|
- qemu-guest-agent
|
||||||
|
|
||||||
|
runcmd:
|
||||||
|
- systemctl enable --now qemu-guest-agent
|
||||||
@@ -0,0 +1,101 @@
|
|||||||
|
# https://registry.terraform.io/providers/Telmate/proxmox/latest/docs/guides/cloud-init%2520getting%2520started
|
||||||
|
locals {
|
||||||
|
vms = {
|
||||||
|
vm100 = {
|
||||||
|
vmid = 100
|
||||||
|
name = "runner-docker"
|
||||||
|
memory = 1024
|
||||||
|
cores = 1
|
||||||
|
primary_disk_size = "32G"
|
||||||
|
},
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
provider "proxmox" {
|
||||||
|
pm_api_url = "https://10.5.1.11:8006/api2/json"
|
||||||
|
pm_tls_insecure = true
|
||||||
|
pm_user = "tfuser@pve"
|
||||||
|
pm_api_token_id = "tfuser@pve!tf"
|
||||||
|
pm_api_token_secret = "992b51e6-578d-43ca-bc49-720fd407ef3f"
|
||||||
|
}
|
||||||
|
|
||||||
|
resource "proxmox_vm_qemu" "cloudinit" {
|
||||||
|
for_each = local.vms
|
||||||
|
vmid = each.value.vmid
|
||||||
|
name = each.value.name
|
||||||
|
target_node = "pve-mac"
|
||||||
|
agent = 1
|
||||||
|
full_clone = true
|
||||||
|
|
||||||
|
cpu {
|
||||||
|
cores = each.value.cores
|
||||||
|
}
|
||||||
|
memory = each.value.memory
|
||||||
|
boot = "order=scsi0"
|
||||||
|
clone = "debian13-template"
|
||||||
|
scsihw = "virtio-scsi-single"
|
||||||
|
vm_state = "running"
|
||||||
|
automatic_reboot = true
|
||||||
|
|
||||||
|
cicustom = "vendor=local:snippets/init-agent.yaml"
|
||||||
|
ciupgrade = true
|
||||||
|
skip_ipv6 = true
|
||||||
|
ciuser = "user"
|
||||||
|
cipassword = "user"
|
||||||
|
sshkeys = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKxACXG6mkk+CML+NsTyJyteiyszpM7m1Pmq+AW7cQ19 yaprac terraform"
|
||||||
|
ipconfig0 = "ip=dhcp"
|
||||||
|
|
||||||
|
serial {
|
||||||
|
id = 0
|
||||||
|
}
|
||||||
|
|
||||||
|
disks {
|
||||||
|
scsi {
|
||||||
|
scsi0 {
|
||||||
|
disk {
|
||||||
|
storage = "local-lvm"
|
||||||
|
size = each.value.primary_disk_size
|
||||||
|
discard = false
|
||||||
|
iothread = false
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
|
ide {
|
||||||
|
ide1 {
|
||||||
|
cloudinit {
|
||||||
|
storage = "local-lvm"
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
network {
|
||||||
|
id = 0
|
||||||
|
bridge = "vmbr0"
|
||||||
|
model = "virtio"
|
||||||
|
}
|
||||||
|
|
||||||
|
startup_shutdown {
|
||||||
|
order = -1
|
||||||
|
startup_delay = -1
|
||||||
|
shutdown_timeout = -1
|
||||||
|
}
|
||||||
|
|
||||||
|
lifecycle {
|
||||||
|
ignore_changes = [
|
||||||
|
vm_state,
|
||||||
|
cipassword,
|
||||||
|
sshkeys,
|
||||||
|
disks,
|
||||||
|
]
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
terraform {
|
||||||
|
required_providers {
|
||||||
|
proxmox = {
|
||||||
|
source = "Telmate/proxmox"
|
||||||
|
version = "3.0.2-rc07"
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
@@ -0,0 +1,152 @@
|
|||||||
|
# Proxmox Network Recommendations
|
||||||
|
|
||||||
|
## Current Setup
|
||||||
|
|
||||||
|
- Home network: `10.5.1.0/24`
|
||||||
|
- Proxmox host: `10.5.1.10` (static)
|
||||||
|
- Single NIC, `vmbr0` bridged to LAN
|
||||||
|
- VMs on the same `/24` via DHCP
|
||||||
|
|
||||||
|
```
|
||||||
|
Home Router (10.5.1.1)
|
||||||
|
|
|
||||||
|
[LAN: 10.5.1.0/24]
|
||||||
|
|
|
||||||
|
Proxmox (10.5.1.10) — vmbr0 bridged to LAN
|
||||||
|
|
|
||||||
|
VMs (DHCP from home router, flat network)
|
||||||
|
```
|
||||||
|
|
||||||
|
Problem: VMs, Proxmox management UI (port 8006), and all LAN devices share the same flat network — no isolation.
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
## Best Practice Tiers
|
||||||
|
|
||||||
|
### Tier 1 — Minimal (single NIC, no managed switch)
|
||||||
|
|
||||||
|
Add a second internal bridge for isolated VMs. Keep `vmbr0` for LAN-facing VMs.
|
||||||
|
|
||||||
|
```
|
||||||
|
vmbr0 → bridged to NIC → 10.5.1.0/24 (LAN, trusted VMs)
|
||||||
|
vmbr1 → internal only → 10.5.2.0/24 (isolated VMs + NAT)
|
||||||
|
```
|
||||||
|
|
||||||
|
Add to `/etc/network/interfaces`:
|
||||||
|
|
||||||
|
```
|
||||||
|
auto vmbr1
|
||||||
|
iface vmbr1 inet static
|
||||||
|
address 10.5.2.1/24
|
||||||
|
bridge-ports none
|
||||||
|
bridge-stp off
|
||||||
|
post-up echo 1 > /proc/sys/net/ipv4/ip_forward
|
||||||
|
post-up iptables -t nat -A POSTROUTING -s 10.5.2.0/24 -o vmbr0 -j MASQUERADE
|
||||||
|
post-down iptables -t nat -D POSTROUTING -s 10.5.2.0/24 -o vmbr0 -j MASQUERADE
|
||||||
|
```
|
||||||
|
|
||||||
|
**Tradeoff:** No special hardware needed. Proxmox web UI still reachable from entire LAN.
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
### Tier 2 — VLAN Segmentation (single NIC + managed switch)
|
||||||
|
|
||||||
|
Make `vmbr0` VLAN-aware. All VLANs over one physical NIC, router handles inter-VLAN routing.
|
||||||
|
|
||||||
|
| VLAN | Purpose | Subnet |
|
||||||
|
|------|---------------------|-----------------|
|
||||||
|
| 10 | Proxmox management | 10.5.10.0/24 |
|
||||||
|
| 20 | Trusted VMs / LAN | 10.5.20.0/24 |
|
||||||
|
| 30 | IoT / untrusted | 10.5.30.0/24 |
|
||||||
|
| 40 | DMZ (internet-facing) | 10.5.40.0/24 |
|
||||||
|
|
||||||
|
In Proxmox UI: set `vmbr0` → **VLAN aware**, assign VLAN tag per VM.
|
||||||
|
|
||||||
|
**Requires:** managed switch + VLAN-capable router (OPNsense, pfSense, Unifi, TP-Link Omada, etc.).
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
### Tier 3 — Firewall VM inside Proxmox
|
||||||
|
|
||||||
|
Run OPNsense or pfSense as a VM. Proxmox management gets its own isolated VLAN unreachable by guest VMs.
|
||||||
|
|
||||||
|
```
|
||||||
|
WAN → pfSense VM → routes between all VLANs → VMs
|
||||||
|
→ Proxmox management VLAN (isolated)
|
||||||
|
```
|
||||||
|
|
||||||
|
**Tradeoff:** Most flexible, most complex. Worth it for internet-exposed services.
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
## Recommended Setup: Two NICs (Physical Separation)
|
||||||
|
|
||||||
|
Physical separation is simpler and more secure than VLAN trunking at home lab scale.
|
||||||
|
|
||||||
|
```
|
||||||
|
NIC1 (enp1s0) → vmbr0 → Proxmox management only
|
||||||
|
host IP: 10.5.1.10
|
||||||
|
web UI + SSH — no VMs attached
|
||||||
|
|
||||||
|
NIC2 (enp2s0) → vmbr1 → VM traffic bridge
|
||||||
|
VMs get DHCP from home router
|
||||||
|
no host IP on this bridge
|
||||||
|
```
|
||||||
|
|
||||||
|
**Security benefit:** even if a VM is compromised, it has no path to the Proxmox management interface.
|
||||||
|
|
||||||
|
### `/etc/network/interfaces`
|
||||||
|
|
||||||
|
```
|
||||||
|
auto lo
|
||||||
|
iface lo inet loopback
|
||||||
|
|
||||||
|
# Management — Proxmox host only
|
||||||
|
auto enp1s0
|
||||||
|
iface enp1s0 inet manual
|
||||||
|
|
||||||
|
auto vmbr0
|
||||||
|
iface vmbr0 inet static
|
||||||
|
address 10.5.1.10/24
|
||||||
|
gateway 10.5.1.1
|
||||||
|
bridge-ports enp1s0
|
||||||
|
bridge-stp off
|
||||||
|
bridge-fd 0
|
||||||
|
|
||||||
|
# VM traffic — no IP on the bridge itself
|
||||||
|
auto enp2s0
|
||||||
|
iface enp2s0 inet manual
|
||||||
|
|
||||||
|
auto vmbr1
|
||||||
|
iface vmbr1 inet manual
|
||||||
|
bridge-ports enp2s0
|
||||||
|
bridge-stp off
|
||||||
|
bridge-fd 0
|
||||||
|
```
|
||||||
|
|
||||||
|
NIC2 must connect to a regular untagged LAN port on your switch/router so VMs continue to receive DHCP from the home router on `10.5.1.0/24`.
|
||||||
|
|
||||||
|
### Terraform — update the network bridge
|
||||||
|
|
||||||
|
In `main.tf`, change `bridge` from `vmbr0` to `vmbr1` for both resource blocks:
|
||||||
|
|
||||||
|
```hcl
|
||||||
|
network {
|
||||||
|
id = 0
|
||||||
|
bridge = "vmbr1"
|
||||||
|
model = "virtio"
|
||||||
|
}
|
||||||
|
```
|
||||||
|
|
||||||
|
No router changes needed — VMs still get `10.5.1.x` addresses via DHCP as before.
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
## Summary
|
||||||
|
|
||||||
|
| Option | Hardware needed | Isolation | Complexity |
|
||||||
|
|--------|----------------|-----------|------------|
|
||||||
|
| Tier 1 (NAT bridge) | None | Partial | Low |
|
||||||
|
| Tier 2 (VLANs) | Managed switch | Good | Medium |
|
||||||
|
| Tier 3 (Firewall VM) | None extra | Excellent | High |
|
||||||
|
| **Two NICs** (chosen) | Second NIC | **Good, simple** | **Low** |
|
||||||
Reference in New Issue
Block a user