Add Cloud-Init automation with Tailscale

The commit rephrases the README to focus on Cloud-Init setup and removes
unused Ansible code, making Tailscale configuration automatic.

Subject line: Replace Ansible with automated Cloud-Init configuration

Body: Refactors infrastructure bootstrapping to leverage Cloud-Init
instead of Ansible for initial VM setup, particularly with respect to
Tailscale installation and authentication.

This simplifies the architecture by: - Removing manual post-provisioning
Ansible steps - Automating Tailscale setup via Cloud-Init - Updating
documentation to reflect new workflow
This commit is contained in:
darnodo
2025-07-03 09:28:09 +02:00
parent 26d97cbcfb
commit 7cd93ba978
23 changed files with 119 additions and 797 deletions

View File

@@ -2,49 +2,70 @@
## Description
This repository contains Infrastructure as Code (IaC) configurations for a home lab environment. It includes Terraform scripts for provisioning infrastructure resources and Ansible playbooks for configuring those resources.
This repository contains Infrastructure as Code (IaC) configurations for a home lab environment. It uses Terraform to provision virtual machines on Proxmox VE. The initial configuration of the VMs, including the installation and activation of Tailscale, is handled automatically by Cloud-Init.
## Usage
### Prerequisites
- Terraform installed on your machine
- Ansible installed on your machine
- Proxmox VE installed on homelab
- Terraform installed on your local machine.
- A Proxmox VE instance up and running.
- A Tailscale account and an authentication key.
#### Proxmox Role and User
### Proxmox Setup
The Proxmox role is responsible for configuring Proxmox VE on the homelab. It includes tasks for setting up the Proxmox VE cluster, creating virtual machines, and configuring storage.
For Terraform to interact with your Proxmox environment, you must create a dedicated user with specific, limited permissions.
Following the least privilege principle, the role creates a dedicated user account with limited permissions for managing the Proxmox VE cluster.
1. **Create a role (`TerraformProv`) with the necessary privileges:**
```bash
pveum role add TerraformProv -privs "Datastore.Allocate Datastore.AllocateSpace Datastore.Audit Pool.Allocate Sys.Audit Sys.Console Sys.Modify VM.Allocate VM.Audit VM.Clone VM.Config.CDROM VM.Config.Cloudinit VM.Config.CPU VM.Config.Disk VM.Config.HWType VM.Config.Memory VM.Config.Network VM.Config.Options VM.Console VM.Migrate VM.Monitor VM.PowerMgmt SDN.Use"
```
```bash
pveum role add TerraformProv -privs "Datastore.Allocate Datastore.AllocateSpace Datastore.Audit Pool.Allocate Sys.Audit Sys.Console Sys.Modify VM.Allocate VM.Audit VM.Clone VM.Config.CDROM VM.Config.Cloudinit VM.Config.CPU VM.Config.Disk VM.Config.HWType VM.Config.Memory VM.Config.Network VM.Config.Options VM.Console VM.Migrate VM.Monitor VM.PowerMgmt SDN.Use"
```
2. **Create a dedicated user (`terraform@pve`):**
```bash
pveum user add terraform@pve --password <your_secure_password>
pveum acl modify / -user terraform@pve -role TerraformProv
```
Create a dedicated user account with limited permissions for managing the Proxmox VE cluster.
```bash
pveum user add terraform@pve --password <password>
pveum acl modify / -user terraform@pve -role TerraformProv
```
Generate API keys for the Proxmox VE cluster.
```bash
pveum user token add terraform@pve terraform -expire 0 -privsep 0 -comment "Terraform token"
```
3. **Generate an API token for the user:**
```bash
pveum user token add terraform@pve terraform -expire 0 -privsep 0
```
Securely store the generated token ID and secret, as you will need them to authenticate Terraform.
### Provisioning Infrastructure
1. Clone this repository to your local machine.
2. Navigate to the `terraform/prod` directory.
3. Run `terraform init` to initialize the Terraform environment.
4. Run `terraform plan` to preview the infrastructure changes.
5. Run `terraform apply` to apply the infrastructure changes.
1. **Clone this repository** to your local machine.
### Configuring Infrastructure
2. **Navigate to the production environment directory:**
```bash
cd iac-homelab/terraform/prod
```
1. Navigate to the `ansible` directory.
2. Run `ansible-playbook playbooks/setup_dns_server.yml` to set up the DNS server.
(Or `ansible-playbook playbooks/update_dns_records.yml` to update DNS records).
3. **Create a `terraform.tfvars` file.** You can copy the example file to get started:
```bash
cp terraform.tfvars.example terraform.tfvars
```
Edit this file to include your Proxmox API credentials and your Tailscale authentication key.
4. **Initialize Terraform:**
```bash
terraform init
```
5. **Plan and apply the changes:**
```bash
terraform plan
terraform apply
```
Terraform will show you a plan of the resources to be created. If you agree, confirm the apply.
### Configuration via Cloud-Init
The configuration of virtual machines is handled automatically on the first boot by Cloud-Init. The Terraform configuration injects a script that performs the following actions:
- Updates and upgrades all system packages.
- Installs the Tailscale agent.
- Connects the new machine to your Tailscale network using the `tailscale_auth_key` you provided.
Once `terraform apply` is complete, your new virtual machines will automatically appear in your Tailscale admin console shortly after they boot up.