Compare commits
2 Commits
ab3427fd82
...
master
Author | SHA1 | Date | |
---|---|---|---|
81698be718 | |||
31a11ac255 |
70
.github/workflows/infra-build.yml
vendored
70
.github/workflows/infra-build.yml
vendored
@@ -1,70 +0,0 @@
|
||||
name: Build Infra (Opentofu)
|
||||
|
||||
on:
|
||||
push:
|
||||
branches:
|
||||
- master
|
||||
paths:
|
||||
- '**.tf'
|
||||
|
||||
jobs:
|
||||
opentofu:
|
||||
if: github.repository == 'comprofix/opentofu-homelab'
|
||||
name: Opentofu Build
|
||||
runs-on: self-hosted
|
||||
container:
|
||||
image: node:20-bullseye
|
||||
|
||||
env:
|
||||
PG_CONN_STR: ${{ secrets.PG_CONN_STR }} # PostgreSQL backend connection string
|
||||
|
||||
steps:
|
||||
# 1. Checkout code
|
||||
- name: Checkout code
|
||||
uses: actions/checkout@v5
|
||||
with:
|
||||
fetch-depth: 0
|
||||
|
||||
# 2. Generate dynamic Terraform/Opentofu vars from secrets
|
||||
- name: Generate Dynamic Vars (Secrets)
|
||||
run: |
|
||||
cat <<EOF > terraform.auto.tfvars
|
||||
ci_user = "${{ secrets.CI_USER }}"
|
||||
ci_password = "${{ secrets.CI_PASSWORD }}"
|
||||
proxmox_api_url = "${{ secrets.PVE_API_URL }}"
|
||||
proxmox_api_token_id = "${{ secrets.PVE_API_TOKEN_ID }}"
|
||||
proxmox_api_token_secret = "${{ secrets.PVE_API_TOKEN_SECRET }}"
|
||||
ssh_key = "${{ secrets.SSH_PRIVATE_KEY }}"
|
||||
passphrase = "${{ secrets.SSH_PASSPHRASE }}"
|
||||
EOF
|
||||
|
||||
# 3. Setup Opentofu CLI
|
||||
- name: Setup Opentofu
|
||||
uses: opentofu/setup-opentofu@v1
|
||||
|
||||
# 4. Format the secrets/vars file (required by tofu fmt)
|
||||
- name: Format vars file
|
||||
run: tofu fmt terraform.auto.tfvars
|
||||
|
||||
# 5. Initialize Opentofu backend and providers
|
||||
- name: Opentofu Init
|
||||
run: tofu init
|
||||
|
||||
# 6. Full formatting/lint check for all files
|
||||
- name: Opentofu Format Check
|
||||
run: tofu fmt -check -recursive
|
||||
|
||||
# 7. Validate configuration
|
||||
- name: Opentofu Validate
|
||||
run: tofu validate
|
||||
|
||||
# 8. Plan changes
|
||||
- name: Opentofu Plan
|
||||
id: plan
|
||||
run: |
|
||||
tofu plan -out=tfplan -detailed-exitcode
|
||||
|
||||
# 9. Apply changes only if previous steps succeed
|
||||
- name: Opentofu Apply
|
||||
if: success()
|
||||
run: tofu apply -auto-approve tfplan
|
32
README.md
32
README.md
@@ -14,49 +14,19 @@ This repository provisions and manages resources such as the Proxmox VMs and LXC
|
||||
|
||||
- Declarative infrastructure management with OpenTofu
|
||||
- Remote state stored in PostgreSQL backend
|
||||
- Automated formatting, validation, and applies via GitHub Actions
|
||||
- Secure injection of secrets into `terraform.auto.tfvars`
|
||||
- Supports Proxmox VM provisioning and Omada configuration
|
||||
|
||||
---
|
||||
|
||||
## 📂 Repository Layout
|
||||
|
||||
```
|
||||
├── dev-docker.tf # Docker VM definitions
|
||||
├── github.tf # GitHub repo/org configuration
|
||||
├── omada.tf # Omada network definitions
|
||||
├── provider.tf # Provider setup and backend configuration
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## ⚙️ Requirements
|
||||
|
||||
- **OpenTofu** (installed automatically in GitHub Actions via [`opentofu/setup-opentofu`](https://github.com/opentofu/setup-opentofu))
|
||||
- **PostgreSQL** database for remote state
|
||||
Connection string provided via secret: `PG_CONN_STR`
|
||||
- **GitHub Actions self-hosted runner** with access to Proxmox and Omada APIs
|
||||
- Configured repository secrets:
|
||||
- `PG_CONN_STR`
|
||||
- `CI_USER`, `CI_PASSWORD`
|
||||
- `PVE_API_URL`, `PVE_API_TOKEN_ID`, `PVE_API_TOKEN_SECRET`
|
||||
- `SSH_PRIVATE_KEY`, `SSH_PASSPHRASE`
|
||||
|
||||
---
|
||||
|
||||
## 🔄 Workflow
|
||||
|
||||
Infrastructure is applied automatically on pushes to the `main` branch.
|
||||
|
||||
1. Checkout repo
|
||||
2. Generate `terraform.auto.tfvars` from GitHub secrets
|
||||
2. Generate `terraform.auto.tfvars`
|
||||
3. Run `tofu init`, `tofu fmt`, `tofu validate`
|
||||
4. Execute `tofu plan`
|
||||
5. If successful, run `tofu apply`
|
||||
|
||||
> 🔒 PRs and forks do not run workflows. Only code merged into `main` will trigger an apply.
|
||||
|
||||
---
|
||||
|
||||
## 📖 Usage
|
||||
|
Reference in New Issue
Block a user