From 51bcd79e057bb048c3bd801827d6c08153ad7854 Mon Sep 17 00:00:00 2001 From: darnodo Date: Sun, 7 Dec 2025 14:04:55 +0100 Subject: [PATCH] docs: update proxmox role privs and default vm user This commit updates the documentation and Terraform variables to reflect recent changes in the Proxmox environment setup. - `docs/proxmox-setup.md`: Added `VM.GuestAgent.Audit` and `VM.GuestAgent.FileRead` to the required privileges list and the CLI command example. This ensures Terraform can properly interact with the QEMU Guest Agent. - `terraform/prod/variables.tf`: Set a default value ("damien") for the `username` variable in the `virtual_machines` object to simplify configuration for the primary user. --- docs/proxmox-setup.md | 18 +++++++++--------- terraform/prod/variables.tf | 2 +- 2 files changed, 10 insertions(+), 10 deletions(-) diff --git a/docs/proxmox-setup.md b/docs/proxmox-setup.md index f403a15..e063db5 100644 --- a/docs/proxmox-setup.md +++ b/docs/proxmox-setup.md @@ -10,13 +10,13 @@ Instead of using the `Administrator` role, we create a dedicated `TerraformRole` ## Required Privileges (Proxmox 9.1) -| Category | Privileges | -| --------- | ------------------------------------------------------------------------------------------------------------ | -| Datastore | `Allocate`, `AllocateSpace`, `AllocateTemplate`, `Audit` | -| System | `Audit`, `Console`, `Modify` | -| VM | `Allocate`, `Audit`, `Clone`, `Config.*`, `Console`, `Migrate`, `PowerMgmt`, `Snapshot`, `Snapshot.Rollback` | -| Pool | `Allocate`, `Audit` | -| SDN | `Use` | +| Category | Privileges | +| --------- | ------------------------------------------------------------------------------------------------------------------------------------------------------ | +| Datastore | `Allocate`, `AllocateSpace`, `AllocateTemplate`, `Audit` | +| System | `Audit`, `Console`, `Modify` | +| VM | `Allocate`, `Audit`, `Clone`, `Config.*`, `Console`, `Migrate`, `PowerMgmt`, `Snapshot`, `Snapshot.Rollback`,`GuestAgent.Audit`, `GuestAgent.FileRead` | +| Pool | `Allocate`, `Audit` | +| SDN | `Use` | > ⚠️ `VM.Monitor` was deprecated in Proxmox 9 — do not include it. @@ -40,7 +40,7 @@ Instead of using the `Administrator` role, we create a dedicated `TerraformRole` | User name | `terraform` | | Realm | `Proxmox VE authentication server` | | Password | *(set a strong password)* | -| Enabled | ☑️ | +| Enabled | ☑️ | | Expire | `never` | ### 3. Create API Token @@ -73,7 +73,7 @@ Instead of using the `Administrator` role, we create a dedicated `TerraformRole` ```bash # 1. Create role -pveum role add TerraformRole -privs "Datastore.Allocate,Datastore.AllocateSpace,Datastore.AllocateTemplate,Datastore.Audit,Pool.Allocate,Pool.Audit,SDN.Use,Sys.Audit,Sys.Console,Sys.Modify,VM.Allocate,VM.Audit,VM.Clone,VM.Config.CDROM,VM.Config.Cloudinit,VM.Config.CPU,VM.Config.Disk,VM.Config.HWType,VM.Config.Memory,VM.Config.Network,VM.Config.Options,VM.Console,VM.Migrate,VM.PowerMgmt,VM.Snapshot,VM.Snapshot.Rollback" +pveum role add TerraformRole -privs "Datastore.Allocate,Datastore.AllocateSpace,Datastore.AllocateTemplate,Datastore.Audit,Pool.Allocate,Pool.Audit,SDN.Use,Sys.Audit,Sys.Console,Sys.Modify,VM.Allocate,VM.Audit,VM.Clone,VM.Config.CDROM,VM.Config.Cloudinit,VM.Config.CPU,VM.Config.Disk,VM.Config.HWType,VM.Config.Memory,VM.Config.Network,VM.Config.Options,VM.Console,VM.Migrate,VM.PowerMgmt,VM.Snapshot,VM.Snapshot.Rollback,VM.GuestAgent.Audit,VM.GuestAgent.FileRead " # 2. Create user pveum user add terraform@pve --comment "Terraform automation" diff --git a/terraform/prod/variables.tf b/terraform/prod/variables.tf index 5fc93d5..4efe593 100644 --- a/terraform/prod/variables.tf +++ b/terraform/prod/variables.tf @@ -59,7 +59,7 @@ variable "virtual_machines" { disk_format = optional(string, "raw") network_bridge = optional(string, "vmbr0") network_model = optional(string, "virtio") - username = optional(string) + username = optional(string, "damien") on_boot = optional(bool, true) tags = optional(list(string), [])