Damien/iac-homelab
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

docs: update proxmox role privs and default vm user

Browse Source 
This commit updates the documentation and Terraform variables to reflect recent changes in the Proxmox environment setup.

- `docs/proxmox-setup.md`: Added `VM.GuestAgent.Audit` and `VM.GuestAgent.FileRead` to the required privileges list and the CLI command example. This ensures Terraform can properly interact with the QEMU Guest Agent.
- `terraform/prod/variables.tf`: Set a default value ("damien") for the `username` variable in the `virtual_machines` object to simplify configuration for the primary user.
This commit is contained in:
darnodo
2025-12-07 14:04:55 +01:00
parent 4623674632
commit 51bcd79e05
2 changed files with 10 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files

18
docs/proxmox-setup.md
View File

@@ -10,13 +10,13 @@ Instead of using the `Administrator` role, we create a dedicated `TerraformRole`
## Required Privileges (Proxmox 9.1)
| Category | Privileges |
| --------- | ------------------------------------------------------------------------------------------------------------ |
| Datastore | `Allocate`, `AllocateSpace`, `AllocateTemplate`, `Audit` |
| System | `Audit`, `Console`, `Modify` |
| VM | `Allocate`, `Audit`, `Clone`, `Config.*`, `Console`, `Migrate`, `PowerMgmt`, `Snapshot`, `Snapshot.Rollback` |
| Pool | `Allocate`, `Audit` |
| SDN | `Use` |
| Category | Privileges |
| --------- | ------------------------------------------------------------------------------------------------------------------------------------------------------ |
| Datastore | `Allocate`, `AllocateSpace`, `AllocateTemplate`, `Audit` |
| System | `Audit`, `Console`, `Modify` |
| VM | `Allocate`, `Audit`, `Clone`, `Config.*`, `Console`, `Migrate`, `PowerMgmt`, `Snapshot`, `Snapshot.Rollback`,`GuestAgent.Audit`, `GuestAgent.FileRead` |
| Pool | `Allocate`, `Audit` |
| SDN | `Use` |
> ⚠️ `VM.Monitor` was deprecated in Proxmox 9 — do not include it.
@@ -40,7 +40,7 @@ Instead of using the `Administrator` role, we create a dedicated `TerraformRole`
| User name | `terraform` |
| Realm | `Proxmox VE authentication server` |
| Password | *(set a strong password)* |
| Enabled | ☑️ |
| Enabled | ☑️ |
| Expire | `never` |
### 3. Create API Token
@@ -73,7 +73,7 @@ Instead of using the `Administrator` role, we create a dedicated `TerraformRole`
```bash
# 1. Create role
pveum role add TerraformRole -privs "Datastore.Allocate,Datastore.AllocateSpace,Datastore.AllocateTemplate,Datastore.Audit,Pool.Allocate,Pool.Audit,SDN.Use,Sys.Audit,Sys.Console,Sys.Modify,VM.Allocate,VM.Audit,VM.Clone,VM.Config.CDROM,VM.Config.Cloudinit,VM.Config.CPU,VM.Config.Disk,VM.Config.HWType,VM.Config.Memory,VM.Config.Network,VM.Config.Options,VM.Console,VM.Migrate,VM.PowerMgmt,VM.Snapshot,VM.Snapshot.Rollback"
pveum role add TerraformRole -privs "Datastore.Allocate,Datastore.AllocateSpace,Datastore.AllocateTemplate,Datastore.Audit,Pool.Allocate,Pool.Audit,SDN.Use,Sys.Audit,Sys.Console,Sys.Modify,VM.Allocate,VM.Audit,VM.Clone,VM.Config.CDROM,VM.Config.Cloudinit,VM.Config.CPU,VM.Config.Disk,VM.Config.HWType,VM.Config.Memory,VM.Config.Network,VM.Config.Options,VM.Console,VM.Migrate,VM.PowerMgmt,VM.Snapshot,VM.Snapshot.Rollback,VM.GuestAgent.Audit,VM.GuestAgent.FileRead "
# 2. Create user
pveum user add terraform@pve --comment "Terraform automation"

2
terraform/prod/variables.tf
View File

@@ -59,7 +59,7 @@ variable "virtual_machines" {
disk_format = optional(string, "raw")
network_bridge = optional(string, "vmbr0")
network_model = optional(string, "virtio")
username = optional(string)
username = optional(string, "damien")
on_boot = optional(bool, true)
tags = optional(list(string), [])