Update prod VM disk size to 80GB

Reviewed-on: #19

.gitea/workflows/terraform-deploy.yml

@@ -87,8 +87,8 @@ jobs:
 
       - name: Terraform Plan
         id: plan
+        shell: sh {0}
         run: |
-          set +e
           terraform plan -input=false -no-color -detailed-exitcode -out=tfplan > plan_output.txt 2>&1
           EXITCODE=$?
           cat plan_output.txt

.gitea/workflows/terraform-pr.yml

@@ -85,8 +85,8 @@ jobs:
 
       - name: Terraform Plan
         id: plan
+        shell: sh {0}
         run: |
-          set +e
           terraform plan -input=false -no-color -detailed-exitcode -out=tfplan > plan_output.txt 2>&1
           EXITCODE=$?
           cat plan_output.txt

cloud-init/user-data-alpine.yml.tftpl

@@ -8,17 +8,30 @@ preserve_hostname: false
 # 2. User creation
 # On Alpine, the privilege escalation group is "wheel" (not "sudo").
 # Keep the default shell (ash/busybox) to stay lightweight.
+#
+# IMPORTANT: lock_passwd MUST be false on Alpine.
+# cloud-init's default (lock_passwd: true) sets shadow to "!", which Alpine's
+# OpenSSH (compiled without PAM) interprets as "account locked" and refuses
+# pubkey auth with "User ... not allowed because account is locked".
+# Setting lock_passwd: false lets cloud-init use "*" instead: no password
+# login possible, but pubkey works.
 users:
   - name: ${username}
     sudo: ALL=(ALL) NOPASSWD:ALL
     groups: wheel
+    shell: /bin/ash
+    lock_passwd: false
     ssh_authorized_keys:
       - ${ssh_key}
 
-# 3. apk repositories configuration
-# Pin the two repositories used on this homelab: edge/main + edge/community.
-# Written BEFORE package_update/package_upgrade so apk uses this config immediately.
+# 3. Base system files (DNS + apk repos, written before package_update)
+# Alpine has no netplan/systemd-resolved, so we write resolv.conf ourselves.
 write_files:
+  - path: /etc/resolv.conf
+    owner: root:root
+    permissions: '0644'
+    content: |
+      nameserver ${dns_server}
   - path: /etc/apk/repositories
     owner: root:root
     permissions: '0644'
@@ -45,6 +58,11 @@ runcmd:
   # Enable and start qemu-guest-agent via OpenRC
   - [ rc-update, add, qemu-guest-agent, default ]
   - [ rc-service, qemu-guest-agent, start ]
+  # Unlock the user account: cloud-init's lock_passwd: false is unreliable on
+  # Alpine (passwd -u refuses on passwordless accounts), so we force the shadow
+  # entry to "*" ourselves. "*" means: no password login possible, but pubkey
+  # auth works (unlike "!" which sshd treats as locked).
+  - [ sh, -c, "sed -i 's/^${username}:!:/${username}:*:/' /etc/shadow" ]
   # Enable and start Tailscale via OpenRC
   - [ rc-update, add, tailscale, default ]
   - [ rc-service, tailscale, start ]

cloud-init/user-data-systemd.yml.tftpl

@@ -6,11 +6,24 @@ fqdn: ${hostname}
 preserve_hostname: false
 
 # 2. User creation
+#
+# Unlike Alpine, sshd on Debian/Ubuntu/Rocky is built with PAM, which accepts
+# pubkey auth even when the shadow entry is locked ("!"). So the Alpine
+# /etc/shadow workaround is NOT needed here.
+#
+# Groups:
+# - Debian/Ubuntu: sudo group grants admin rights
+# - Rocky/RHEL:    wheel group grants admin rights
+# We include both so the same template works for all supported distros; cloud-
+# init silently skips groups that don't exist on the target system.
+# (The "admin" group is intentionally NOT included: it was deprecated on
+# Ubuntu 12.04 and absent on RHEL-family distros.)
 users:
   - name: ${username}
     sudo: ALL=(ALL) NOPASSWD:ALL
-    groups: sudo, admin
+    groups: [sudo, wheel]
     shell: /bin/bash
+    lock_passwd: true
     ssh_authorized_keys:
       - ${ssh_key}
 
@@ -23,10 +36,15 @@ packages:
   - qemu-guest-agent
   - curl
 
-# 5. Tailscale installation and configuration
+# 5. Services and Tailscale
+# Order matters: qemu-guest-agent FIRST so Terraform can read the VM IP
+# without waiting for the (potentially slow) Tailscale install.
 runcmd:
   # Enable and start qemu-guest-agent (systemd)
   - [ systemctl, enable, qemu-guest-agent, --now ]
-  # Install and configure Tailscale
+  # Install Tailscale (official installer detects the distro)
   - [ sh, -c, "curl -fsSL https://tailscale.com/install.sh | sh" ]
-  - [ tailscale, up, --authkey=${tailscale_auth_key}, --hostname=${vm_name} ]
+  # Bring the node up on the tailnet. Retry a few times to absorb the small
+  # delay between `systemctl start tailscaled` and the daemon's socket being
+  # ready to accept commands.
+  - [ sh, -c, "for i in 1 2 3 4 5; do tailscale up --authkey=${tailscale_auth_key} --hostname=${vm_name} && break; sleep 2; done" ]

terraform/prod/02-cloud-init.tf

@@ -33,6 +33,9 @@ resource "proxmox_virtual_environment_file" "cloud_config" {
         # VM information
         hostname = "${each.key}.${var.domain_suffix}"
 
+        # Network (used by templates that need to write /etc/resolv.conf themselves, e.g. Alpine)
+        dns_server = var.dns_servers[0]
+
         # Tailscale variables
         vm_name            = each.key
         tailscale_auth_key = var.tailscale_auth_key

terraform/prod/terraform.tfvars

@@ -34,23 +34,23 @@ admin_ssh_public_key_path = "~/.ssh/keys/id_rsa.pub"
 default_vm_user = "damien"
 
 virtual_machines = {
-  "ipfabric" = {
-    os      = "ipfabric"
-    cores   = 4
-    memory  = 16384
-    disk_gb = 128
-    ip      = "192.168.1.161"
-    gateway = "192.168.1.254"
-    tags    = ["ipfabric"]
-  },
   "komodo" = {
     os      = "alpine"
     cores   = 16
     memory  = 32768
     disk_gb = 32
-    ip      = "192.168.1.162"
+    ip      = "192.168.1.161"
     gateway = "192.168.1.254"
     tags    = ["docker"]
+  },
+  "ipfabric" = {
+    os      = "ipfabric"
+    cores   = 16
+    memory  = 32768
+    disk_gb = 80
+    ip      = "192.168.1.162"
+    gateway = "192.168.1.254"
+    tags    = ["ipfabric"]
   }
 }