From 3bb9c97d6927bd20f2118dee18318151d080c682 Mon Sep 17 00:00:00 2001 From: Damien Arnodo Date: Sun, 3 May 2026 17:02:31 +0000 Subject: [PATCH 1/5] feat: add SSH key variables for CI support Add proxmox_ssh_private_key for provider SSH in CI pipelines. Add admin_ssh_public_key as content-based alternative to file path. Both default to empty string for backward compatibility with local usage. --- terraform/prod/variables.tf | 13 +++++++++++++ 1 file changed, 13 insertions(+) diff --git a/terraform/prod/variables.tf b/terraform/prod/variables.tf index 4efe593..15a2649 100644 --- a/terraform/prod/variables.tf +++ b/terraform/prod/variables.tf @@ -17,12 +17,25 @@ variable "proxmox_api_token" { sensitive = true } +variable "proxmox_ssh_private_key" { + description = "Clé SSH privée pour la connexion Proxmox (utilisée en CI). Si vide, l'agent SSH local est utilisé." + type = string + sensitive = true + default = "" +} + variable "tailscale_auth_key" { description = "Clé d'authentification Tailscale pour enregistrer les noeuds." type = string sensitive = true } +variable "admin_ssh_public_key" { + description = "Contenu de la clé SSH publique à autoriser (utilisé en CI). Prioritaire sur admin_ssh_public_key_path." + type = string + default = "" +} + variable "admin_ssh_public_key_path" { description = "Chemin vers le fichier de la clé SSH publique à autoriser." type = string -- 2.54.0 From c495b40defdc68b3913454274d578d4df22d3670 Mon Sep 17 00:00:00 2001 From: Damien Arnodo Date: Sun, 3 May 2026 17:02:47 +0000 Subject: [PATCH 2/5] feat: support SSH private key injection for CI Use proxmox_ssh_private_key variable when available, otherwise fall back to SSH agent for local development. --- terraform/prod/providers.tf | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/terraform/prod/providers.tf b/terraform/prod/providers.tf index 14ee0a8..f90c5ec 100644 --- a/terraform/prod/providers.tf +++ b/terraform/prod/providers.tf @@ -1,10 +1,10 @@ -# ===================================================================== +# ========================================================================== # Déclaration des Providers Terraform # # Ce fichier indique à Terraform quels "plugins" il doit # télécharger pour interagir avec les API externes (Proxmox, etc.) # et comment les configurer. -# ===================================================================== +# ========================================================================== terraform { required_version = ">= 1.5.0" @@ -43,7 +43,8 @@ provider "proxmox" { api_token = var.proxmox_api_token insecure = true ssh { - agent = true - username = "root" + agent = var.proxmox_ssh_private_key == "" ? true : false + username = "root" + private_key = var.proxmox_ssh_private_key != "" ? var.proxmox_ssh_private_key : null } } -- 2.54.0 From 8fcf0331451e80e6507254c5cdddc7f3b3f108ee Mon Sep 17 00:00:00 2001 From: Damien Arnodo Date: Sun, 3 May 2026 17:03:00 +0000 Subject: [PATCH 3/5] feat: support SSH public key content for CI Use admin_ssh_public_key content when provided, otherwise fall back to reading from admin_ssh_public_key_path file. --- terraform/prod/02-cloud-init.tf | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/terraform/prod/02-cloud-init.tf b/terraform/prod/02-cloud-init.tf index 90996c3..525c98a 100644 --- a/terraform/prod/02-cloud-init.tf +++ b/terraform/prod/02-cloud-init.tf @@ -1,5 +1,10 @@ # Fichier: terraform/prod/02-cloud-init.tf +locals { + # Utilise le contenu direct si fourni (CI), sinon lit depuis le fichier (local) + ssh_public_key = var.admin_ssh_public_key != "" ? var.admin_ssh_public_key : file(var.admin_ssh_public_key_path) +} + resource "proxmox_virtual_environment_file" "cloud_config" { for_each = var.virtual_machines @@ -11,7 +16,7 @@ resource "proxmox_virtual_environment_file" "cloud_config" { data = templatefile("${path.module}/../../cloud-init/user-data.yml.tftpl", { # Variables pour définir les informations de l'utilisateur username = lookup(each.value, "username", var.default_vm_user) - ssh_key = file(var.admin_ssh_public_key_path) + ssh_key = local.ssh_public_key # Variables pour définir les informations de la VM hostname = "${each.key}.${var.domain_suffix}" -- 2.54.0 From b4fa69f00adbb7b0226077768ea41fdcc912bc79 Mon Sep 17 00:00:00 2001 From: Damien Arnodo Date: Sun, 3 May 2026 17:03:33 +0000 Subject: [PATCH 4/5] feat: add SSH key env vars to deploy workflow Inject PROXMOX_SSH_PRIVATE_KEY and ADMIN_SSH_PUBLIC_KEY secrets as TF_VAR_ environment variables for CI. --- .gitea/workflows/terraform-deploy.yml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/.gitea/workflows/terraform-deploy.yml b/.gitea/workflows/terraform-deploy.yml index 96eb06f..d40a000 100644 --- a/.gitea/workflows/terraform-deploy.yml +++ b/.gitea/workflows/terraform-deploy.yml @@ -14,6 +14,8 @@ env: AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }} TF_VAR_proxmox_url: ${{ secrets.PROXMOX_URL }} TF_VAR_proxmox_api_token: ${{ secrets.PROXMOX_API_TOKEN }} + TF_VAR_proxmox_ssh_private_key: ${{ secrets.PROXMOX_SSH_PRIVATE_KEY }} + TF_VAR_admin_ssh_public_key: ${{ secrets.ADMIN_SSH_PUBLIC_KEY }} TF_VAR_tailscale_auth_key: ${{ secrets.TAILSCALE_AUTH_KEY }} GIT_TOKEN: ${{ secrets.GIT_TOKEN }} -- 2.54.0 From f57f68b6f349a6134654408f08ddd97c02898c7a Mon Sep 17 00:00:00 2001 From: Damien Arnodo Date: Sun, 3 May 2026 17:04:10 +0000 Subject: [PATCH 5/5] feat: add SSH key env vars to PR workflow Inject PROXMOX_SSH_PRIVATE_KEY and ADMIN_SSH_PUBLIC_KEY secrets as TF_VAR_ environment variables for CI. --- .gitea/workflows/terraform-pr.yml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/.gitea/workflows/terraform-pr.yml b/.gitea/workflows/terraform-pr.yml index 4de7c9c..2d889cf 100644 --- a/.gitea/workflows/terraform-pr.yml +++ b/.gitea/workflows/terraform-pr.yml @@ -14,6 +14,8 @@ env: AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }} TF_VAR_proxmox_url: ${{ secrets.PROXMOX_URL }} TF_VAR_proxmox_api_token: ${{ secrets.PROXMOX_API_TOKEN }} + TF_VAR_proxmox_ssh_private_key: ${{ secrets.PROXMOX_SSH_PRIVATE_KEY }} + TF_VAR_admin_ssh_public_key: ${{ secrets.ADMIN_SSH_PUBLIC_KEY }} TF_VAR_tailscale_auth_key: ${{ secrets.TAILSCALE_AUTH_KEY }} GIT_TOKEN: ${{ secrets.GIT_TOKEN }} -- 2.54.0