Compare commits
2 Commits
ab3427fd82
...
master
Author | SHA1 | Date | |
---|---|---|---|
81698be718 | |||
31a11ac255 |
70
.github/workflows/infra-build.yml
vendored
70
.github/workflows/infra-build.yml
vendored
@@ -1,70 +0,0 @@
|
|||||||
name: Build Infra (Opentofu)
|
|
||||||
|
|
||||||
on:
|
|
||||||
push:
|
|
||||||
branches:
|
|
||||||
- master
|
|
||||||
paths:
|
|
||||||
- '**.tf'
|
|
||||||
|
|
||||||
jobs:
|
|
||||||
opentofu:
|
|
||||||
if: github.repository == 'comprofix/opentofu-homelab'
|
|
||||||
name: Opentofu Build
|
|
||||||
runs-on: self-hosted
|
|
||||||
container:
|
|
||||||
image: node:20-bullseye
|
|
||||||
|
|
||||||
env:
|
|
||||||
PG_CONN_STR: ${{ secrets.PG_CONN_STR }} # PostgreSQL backend connection string
|
|
||||||
|
|
||||||
steps:
|
|
||||||
# 1. Checkout code
|
|
||||||
- name: Checkout code
|
|
||||||
uses: actions/checkout@v5
|
|
||||||
with:
|
|
||||||
fetch-depth: 0
|
|
||||||
|
|
||||||
# 2. Generate dynamic Terraform/Opentofu vars from secrets
|
|
||||||
- name: Generate Dynamic Vars (Secrets)
|
|
||||||
run: |
|
|
||||||
cat <<EOF > terraform.auto.tfvars
|
|
||||||
ci_user = "${{ secrets.CI_USER }}"
|
|
||||||
ci_password = "${{ secrets.CI_PASSWORD }}"
|
|
||||||
proxmox_api_url = "${{ secrets.PVE_API_URL }}"
|
|
||||||
proxmox_api_token_id = "${{ secrets.PVE_API_TOKEN_ID }}"
|
|
||||||
proxmox_api_token_secret = "${{ secrets.PVE_API_TOKEN_SECRET }}"
|
|
||||||
ssh_key = "${{ secrets.SSH_PRIVATE_KEY }}"
|
|
||||||
passphrase = "${{ secrets.SSH_PASSPHRASE }}"
|
|
||||||
EOF
|
|
||||||
|
|
||||||
# 3. Setup Opentofu CLI
|
|
||||||
- name: Setup Opentofu
|
|
||||||
uses: opentofu/setup-opentofu@v1
|
|
||||||
|
|
||||||
# 4. Format the secrets/vars file (required by tofu fmt)
|
|
||||||
- name: Format vars file
|
|
||||||
run: tofu fmt terraform.auto.tfvars
|
|
||||||
|
|
||||||
# 5. Initialize Opentofu backend and providers
|
|
||||||
- name: Opentofu Init
|
|
||||||
run: tofu init
|
|
||||||
|
|
||||||
# 6. Full formatting/lint check for all files
|
|
||||||
- name: Opentofu Format Check
|
|
||||||
run: tofu fmt -check -recursive
|
|
||||||
|
|
||||||
# 7. Validate configuration
|
|
||||||
- name: Opentofu Validate
|
|
||||||
run: tofu validate
|
|
||||||
|
|
||||||
# 8. Plan changes
|
|
||||||
- name: Opentofu Plan
|
|
||||||
id: plan
|
|
||||||
run: |
|
|
||||||
tofu plan -out=tfplan -detailed-exitcode
|
|
||||||
|
|
||||||
# 9. Apply changes only if previous steps succeed
|
|
||||||
- name: Opentofu Apply
|
|
||||||
if: success()
|
|
||||||
run: tofu apply -auto-approve tfplan
|
|
32
README.md
32
README.md
@@ -14,49 +14,19 @@ This repository provisions and manages resources such as the Proxmox VMs and LXC
|
|||||||
|
|
||||||
- Declarative infrastructure management with OpenTofu
|
- Declarative infrastructure management with OpenTofu
|
||||||
- Remote state stored in PostgreSQL backend
|
- Remote state stored in PostgreSQL backend
|
||||||
- Automated formatting, validation, and applies via GitHub Actions
|
|
||||||
- Secure injection of secrets into `terraform.auto.tfvars`
|
- Secure injection of secrets into `terraform.auto.tfvars`
|
||||||
- Supports Proxmox VM provisioning and Omada configuration
|
- Supports Proxmox VM provisioning and Omada configuration
|
||||||
|
|
||||||
---
|
---
|
||||||
|
|
||||||
## 📂 Repository Layout
|
|
||||||
|
|
||||||
```
|
|
||||||
├── dev-docker.tf # Docker VM definitions
|
|
||||||
├── github.tf # GitHub repo/org configuration
|
|
||||||
├── omada.tf # Omada network definitions
|
|
||||||
├── provider.tf # Provider setup and backend configuration
|
|
||||||
```
|
|
||||||
|
|
||||||
---
|
|
||||||
|
|
||||||
## ⚙️ Requirements
|
|
||||||
|
|
||||||
- **OpenTofu** (installed automatically in GitHub Actions via [`opentofu/setup-opentofu`](https://github.com/opentofu/setup-opentofu))
|
|
||||||
- **PostgreSQL** database for remote state
|
|
||||||
Connection string provided via secret: `PG_CONN_STR`
|
|
||||||
- **GitHub Actions self-hosted runner** with access to Proxmox and Omada APIs
|
|
||||||
- Configured repository secrets:
|
|
||||||
- `PG_CONN_STR`
|
|
||||||
- `CI_USER`, `CI_PASSWORD`
|
|
||||||
- `PVE_API_URL`, `PVE_API_TOKEN_ID`, `PVE_API_TOKEN_SECRET`
|
|
||||||
- `SSH_PRIVATE_KEY`, `SSH_PASSPHRASE`
|
|
||||||
|
|
||||||
---
|
|
||||||
|
|
||||||
## 🔄 Workflow
|
## 🔄 Workflow
|
||||||
|
|
||||||
Infrastructure is applied automatically on pushes to the `main` branch.
|
|
||||||
|
|
||||||
1. Checkout repo
|
1. Checkout repo
|
||||||
2. Generate `terraform.auto.tfvars` from GitHub secrets
|
2. Generate `terraform.auto.tfvars`
|
||||||
3. Run `tofu init`, `tofu fmt`, `tofu validate`
|
3. Run `tofu init`, `tofu fmt`, `tofu validate`
|
||||||
4. Execute `tofu plan`
|
4. Execute `tofu plan`
|
||||||
5. If successful, run `tofu apply`
|
5. If successful, run `tofu apply`
|
||||||
|
|
||||||
> 🔒 PRs and forks do not run workflows. Only code merged into `main` will trigger an apply.
|
|
||||||
|
|
||||||
---
|
---
|
||||||
|
|
||||||
## 📖 Usage
|
## 📖 Usage
|
||||||
|
Reference in New Issue
Block a user