Damien/iac-homelab
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

docs: update proxmox role privs and default vm user

Browse Source 
This commit updates the documentation and Terraform variables to reflect recent changes in the Proxmox environment setup.

- `docs/proxmox-setup.md`: Added `VM.GuestAgent.Audit` and `VM.GuestAgent.FileRead` to the required privileges list and the CLI command example. This ensures Terraform can properly interact with the QEMU Guest Agent.
- `terraform/prod/variables.tf`: Set a default value ("damien") for the `username` variable in the `virtual_machines` object to simplify configuration for the primary user.
This commit is contained in:
darnodo
2025-12-07 14:04:55 +01:00
parent 4623674632
commit 51bcd79e05
2 changed files with 10 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files

18
docs/proxmox-setup.md
View File

@@ -10,13 +10,13 @@ Instead of using the `Administrator` role, we create a dedicated `TerraformRole`
## Required Privileges (Proxmox 9.1) ## Required Privileges (Proxmox 9.1)
| Category | Privileges | | Category | Privileges |
| --------- | ------------------------------------------------------------------------------------------------------------ | | --------- | ------------------------------------------------------------------------------------------------------------------------------------------------------ |
| Datastore | `Allocate`, `AllocateSpace`, `AllocateTemplate`, `Audit` | | Datastore | `Allocate`, `AllocateSpace`, `AllocateTemplate`, `Audit` |
| System | `Audit`, `Console`, `Modify` | | System | `Audit`, `Console`, `Modify` |
| VM | `Allocate`, `Audit`, `Clone`, `Config.*`, `Console`, `Migrate`, `PowerMgmt`, `Snapshot`, `Snapshot.Rollback` | | VM | `Allocate`, `Audit`, `Clone`, `Config.*`, `Console`, `Migrate`, `PowerMgmt`, `Snapshot`, `Snapshot.Rollback`,`GuestAgent.Audit`, `GuestAgent.FileRead` |
| Pool | `Allocate`, `Audit` | | Pool | `Allocate`, `Audit` |
| SDN | `Use` | | SDN | `Use` |
> ⚠️ `VM.Monitor` was deprecated in Proxmox 9 — do not include it. > ⚠️ `VM.Monitor` was deprecated in Proxmox 9 — do not include it.
@@ -40,7 +40,7 @@ Instead of using the `Administrator` role, we create a dedicated `TerraformRole`
| User name | `terraform` | | User name | `terraform` |
| Realm | `Proxmox VE authentication server` | | Realm | `Proxmox VE authentication server` |
| Password | *(set a strong password)* | | Password | *(set a strong password)* |
| Enabled | ☑️ | | Enabled | ☑️ |
| Expire | `never` | | Expire | `never` |
### 3. Create API Token ### 3. Create API Token
@@ -73,7 +73,7 @@ Instead of using the `Administrator` role, we create a dedicated `TerraformRole`
```bash ```bash
# 1. Create role # 1. Create role
pveum role add TerraformRole -privs "Datastore.Allocate,Datastore.AllocateSpace,Datastore.AllocateTemplate,Datastore.Audit,Pool.Allocate,Pool.Audit,SDN.Use,Sys.Audit,Sys.Console,Sys.Modify,VM.Allocate,VM.Audit,VM.Clone,VM.Config.CDROM,VM.Config.Cloudinit,VM.Config.CPU,VM.Config.Disk,VM.Config.HWType,VM.Config.Memory,VM.Config.Network,VM.Config.Options,VM.Console,VM.Migrate,VM.PowerMgmt,VM.Snapshot,VM.Snapshot.Rollback" pveum role add TerraformRole -privs "Datastore.Allocate,Datastore.AllocateSpace,Datastore.AllocateTemplate,Datastore.Audit,Pool.Allocate,Pool.Audit,SDN.Use,Sys.Audit,Sys.Console,Sys.Modify,VM.Allocate,VM.Audit,VM.Clone,VM.Config.CDROM,VM.Config.Cloudinit,VM.Config.CPU,VM.Config.Disk,VM.Config.HWType,VM.Config.Memory,VM.Config.Network,VM.Config.Options,VM.Console,VM.Migrate,VM.PowerMgmt,VM.Snapshot,VM.Snapshot.Rollback,VM.GuestAgent.Audit,VM.GuestAgent.FileRead "
# 2. Create user # 2. Create user
pveum user add terraform@pve --comment "Terraform automation" pveum user add terraform@pve --comment "Terraform automation"

2
terraform/prod/variables.tf
View File

@@ -59,7 +59,7 @@ variable "virtual_machines" {
disk_format = optional(string, "raw") disk_format = optional(string, "raw")
network_bridge = optional(string, "vmbr0") network_bridge = optional(string, "vmbr0")
network_model = optional(string, "virtio") network_model = optional(string, "virtio")
username = optional(string) username = optional(string, "damien")
on_boot = optional(bool, true) on_boot = optional(bool, true)
tags = optional(list(string), []) tags = optional(list(string), [])