ci(actions): plan on PR / apply on merge — Forgejo Actions + static .101 S3 remote state #1

Open

cescm wants to merge 6 commits from ci-first-plan into main

pull from: ci-first-plan

merge into: cescm:main

cescm:main

Conversation 0 Commits 6 Files changed 8 +451 -56

cescm commented 2026-09-18 15:39:31 +02:00

Owner

Copy link

Brings the homelab workflow in from the README runbook:

• .forgejo/workflows/tofu.yml — on PR: tofu plan -no-color (read-only, shows drift)
• on merge to main: tofu apply -auto-approve (S3 remote state @ SeaweedFS static 192.168.8.101:9000)
• creds come only from repo secrets (AWS_* + PM_API_TOKEN_*), never from git

First Forgejo Actions run for the environment; validates provider + static-IP backend end-to-end.

Brings the homelab workflow in from the README runbook: - `.forgejo/workflows/tofu.yml` — on PR: `tofu plan -no-color` (read-only, shows drift) - on merge to main: `tofu apply -auto-approve` (S3 remote state @ SeaweedFS static `192.168.8.101:9000`) - creds come only from repo secrets (`AWS_*` + `PM_API_TOKEN_*`), never from git First Forgejo Actions run for the environment; validates provider + static-IP backend end-to-end.

cescm added 1 commit 2026-09-18 15:39:31 +02:00

docs: add CI runbook (Forgejo Actions first-run steps + secrets list) 737d555a88

cescm added 1 commit 2026-11-08 23:37:31 +01:00

feat(proxmox-vm): add Windows 11 guest support (VM 102) ... ac12aeb9b0

Module (modules/proxmox-vm):
- os_type input (default "l26"; "win11" for Windows guests)
- tpm_state block (TPM 2.0) behind tpm_enabled/tpm_version
- memory ballooning via memory_min (maps to memory.floating)
- optional secondary CD-ROM (iso_secondary on ide0) for virtio-win drivers
- vga_type and boot_order inputs; Windows Setup needs std VGA and
  installer-first boot

Environment (environments/homelab):
- add windows11 map entry (VM 102): q35/OVMF, TPM 2.0, host CPU, 4 vCPU,
  4096 MiB with a 2048 MiB balloon floor, 40 GB virtio-scsi-single with
  discard+iothread, virtio NIC, installer HDD01:iso/Win11-Pro-Lite.iso
- pass new inputs through try() so Linux entries keep module defaults

Docs:
- README section 17: full Windows 11 spec, virtio-win requirement,
  post-install steps and Ansible scope
- homelab README: VM table row and driver-ISO note
- also lands the pending SeaweedFS backend/credentials/CI-runbook docs

cescm added 1 commit 2026-11-08 23:41:36 +01:00

fix(proxmox-vm): drop second cdrom; attach virtio-win out-of-band ... 691d8e00e7

The legacy proxmox_virtual_environment_vm resource allows only one cdrom
block (MaxItems=1), and q35 exposes only ide0/ide2, so the virtio-win
driver ISO cannot be declared as a second CD-ROM in OpenTofu.

- remove iso_secondary input and the second dynamic cdrom block
- keep the Windows installer ISO as the single declarative cdrom
- document attaching virtio-win with:
    qm set 102 -ide0 HDD01:iso/virtio-win.iso,media=cdrom
  before first boot, and detaching it after install
- note that the ISO is already on the host at
  /mnt/storage/isos/template/iso/virtio-win.iso (HDD01:iso/virtio-win.iso)

cescm added 1 commit 2026-11-08 23:46:11 +01:00

fix(homelab): create Windows VM stopped and pin virtio-win ISO name ... 6a3162bcf4

- add per-VM started passthrough; windows11 starts as false so the
  virtio-win driver ISO can be attached before the first boot
- reference the versioned driver ISO HDD01:iso/virtio-win-0.1.302.iso
- document that the out-of-band ide0 CD-ROM does not cause plan drift
  (the provider skips cdrom devices during read-back)

cescm added 1 commit 2026-11-09 00:07:56 +01:00

chore(homelab): drop Windows install media after install ... 4314511af6

Windows 11 Pro and the virtio-win drivers are installed on VM 102, so the
installer CD is no longer needed.

- remove iso from the windows11 map entry and boot from scsi0 only
- set started = true now that the disk is bootable
- record the installed state in sections 7 and 17
- document the leftover empty ide3 cdrom that blocks VM start after the
  installer ISO is removed, and the one-off fix:
    qm set 102 -delete ide3

cescm added 1 commit 2026-11-09 00:29:22 +01:00

docs(windows11): record the guest's fixed LAN address ... 0502d862f3

The VM now answers on 192.168.8.150. Its MAC is pinned by the module, so the
address survives a rebuild.

- note that Windows Firewall drops ICMP (no ping reply) while RDP 3389 is open
- explain why the address cannot be declared in OpenTofu: cloud-init does not
  apply to Windows guests

Some checks failed

Hide all checks

tofu / tofu (pull_request) Has been cancelled

Details

This pull request can be merged automatically.

You are not authorized to merge this pull request.

View command line instructions

Checkout

From your project repository, check out a new branch and test the changes.

git fetch -u origin ci-first-plan:ci-first-plan

git switch ci-first-plan

Merge

Merge the changes and update on Forgejo.

Warning: The "Autodetect manual merge" setting is not enabled for this repository, you will have to mark this pull request as manually merged afterwards.

git switch main

git merge --no-ff ci-first-plan

git switch ci-first-plan

git rebase main

git switch main

git merge --ff-only ci-first-plan

git switch ci-first-plan

git rebase main

git switch main

git merge --no-ff ci-first-plan

git switch main

git merge --squash ci-first-plan

git switch main

git merge --ff-only ci-first-plan

git switch main

git merge ci-first-plan

git push origin main

Sign in to join this conversation.

Reviewers

No reviewers

Labels

Clear labels

No items

No labels

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

1 participant

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

cescm/iac!1

No description provided.