From 9eca9b49e052ef20495d6bf9338e73d6aaf290a7 Mon Sep 17 00:00:00 2001 From: swaphb Date: Sun, 16 Aug 2026 14:34:05 -0400 Subject: [PATCH] add Proxmox Terraform infrastructure backlog --- TODO.md | 26 ++++++++++++++++++++++++++ 1 file changed, 26 insertions(+) diff --git a/TODO.md b/TODO.md index 9e78cd9..004938b 100644 --- a/TODO.md +++ b/TODO.md @@ -136,6 +136,32 @@ still needs a clean kube-proxy-free cluster validation. - [ ] Add validation that the cloud host exposes the CPU features required by Falco and modern eBPF. +## Priority 5a: Proxmox Terraform infrastructure path + +- [ ] Add `terraform/proxmox/` using the `bpg/proxmox` provider. + - [ ] Pin a reviewed provider version and document the Proxmox VE version + compatibility assumptions. + - [ ] Use `proxmox_virtual_environment_vm`, not the provider's experimental + `proxmox_vm` resource. + - [ ] Define provider endpoint, API token, TLS behavior, and SSH agent access + through variables or environment variables only. + - [ ] Download or reference the pinned Flatcar Proxmox image with checksum + verification. + - [ ] Upload an Ignition user-data snippet to Proxmox storage with the + `snippets` content type enabled. + - [ ] Provision the Flatcar k3d test host with configurable VM ID, node, + storage, bridge, CPU, memory, and disk size. + - [ ] Set CPU passthrough so Falco and modern eBPF workloads receive the + required instruction set. + - [ ] Keep the Gitea runner VM optional and disabled by default. + - [ ] Keep all runner registration tokens and webhook values outside + Terraform configuration and state. + - [ ] Emit Ansible inventory data or outputs for the created host addresses. + - [ ] Add a documented `terraform apply` followed by the Ansible bootstrap. + - [ ] Add safe destroy, import, and image rotation guidance. + - [ ] Document the required Proxmox storage content types, API permissions, + SSH access, and node prerequisites. + ## Priority 6: Documentation and portfolio evidence - [ ] Update the root README after each automation milestone.