changed naming and order of folders and files to represent deployment order

01-proxmox-infra/index.ts

@@ -0,0 +1,321 @@
+import * as pulumi from "@pulumi/pulumi";
+import * as proxmox from "@muhlba91/pulumi-proxmoxve";
+import * as tls from "@pulumi/tls";
+import * as pfsense from "@pulumi/pfsense";
+
+const config = new pulumi.Config();
+
+const pve1Endpoint = config.requireSecret("pve1Endpoint");
+const pve1ApiToken = config.requireSecret("pve1ApiToken");
+const pve2Endpoint = config.requireSecret("pve2Endpoint");
+const pve2ApiToken = config.requireSecret("pve2ApiToken");
+
+const pfSenseUrl = config.requireSecret("pfSenseUrl");
+const pfSenseUser = config.requireSecret("pfSenseUser");
+const pfSensePassword = config.requireSecret("pfSensePassword");
+
+const master1Ip = config.requireSecret("master1Ip");
+const master2Ip = config.requireSecret("master2Ip");
+const worker1Ip = config.requireSecret("worker1Ip");
+const master3Ip = config.requireSecret("master3Ip");
+const worker2Ip = config.requireSecret("worker2Ip");
+
+// ---------------------------------------------------------------------------
+// Providers — one per standalone Proxmox machine
+// ---------------------------------------------------------------------------
+
+const pveProvider = new proxmox.Provider("pve", {
+  endpoint: pve1Endpoint,
+  apiToken: pve1ApiToken,
+  insecure: true,
+});
+
+const pveBckpProvider = new proxmox.Provider("pve-bckp", {
+  endpoint: pve2Endpoint,
+  apiToken: pve2ApiToken,
+  insecure: true,
+});
+
+// ---------------------------------------------------------------------------
+// Providers — PfSense
+// ---------------------------------------------------------------------------
+
+const pfSenseProvider = new pfsense.Provider("pfsense", {
+  url: pfSenseUrl,
+  username: pfSenseUser,
+  password: pfSensePassword,
+  tlsSkipVerify: true,
+});
+
+// ---------------------------------------------------------------------------
+// CI runner SSH keypair — generated once, stored in Pulumi state backend.
+// Public key goes into every VM; private key is exported for k8s-bootstrap.
+// ---------------------------------------------------------------------------
+
+const ciRunnerKey = new tls.PrivateKey("ci-runner-key", {
+  algorithm: "ED25519",
+});
+
+// ---------------------------------------------------------------------------
+// Download Ubuntu Noble cloud image to each node's ISO storage
+// ---------------------------------------------------------------------------
+
+const ubuntuNobleUrl =
+  "https://cloud-images.ubuntu.com/noble/current/noble-server-cloudimg-amd64.img";
+
+const ubuntuImagePve = new proxmox.download.File(
+  "ubuntu-noble-pve",
+  {
+    nodeName: "pve",
+    datastoreId: "pve-local-ext1",
+    contentType: "import",
+    fileName: "noble-server-cloudimg-amd64.qcow2",
+    url: ubuntuNobleUrl,
+    overwrite: false,
+    overwriteUnmanaged: true,
+  },
+  { provider: pveProvider },
+);
+
+const ubuntuImagePveBckp = new proxmox.download.File(
+  "ubuntu-noble-pve-bckp",
+  {
+    nodeName: "pve-bckp",
+    datastoreId: "local",
+    contentType: "import",
+    fileName: "noble-server-cloudimg-amd64.qcow2",
+    url: ubuntuNobleUrl,
+    overwrite: false,
+    overwriteUnmanaged: true,
+  },
+  { provider: pveBckpProvider },
+);
+
+// ---------------------------------------------------------------------------
+// VM templates — one per node, cloned from the downloaded cloud image.
+// Templates are not started and have no cloud-init config; that is applied
+// per-clone so each node gets its own hostname (derived from VM name).
+// ---------------------------------------------------------------------------
+
+const templateSettings = {
+  template: true,
+  started: false,
+  stopOnDestroy: true,
+  scsiHardware: "virtio-scsi-pci",
+  cpu: {
+    cores: 2,
+    sockets: 1,
+    type: "host",
+    numa: true,
+  },
+  memory: {
+    dedicated: 2048,
+    floating: 0,
+  },
+  networkDevices: [{ bridge: "vmbr0", model: "virtio" }],
+  serialDevices: [{}],
+  vga: { type: "serial0" },
+  agent: { enabled: true },
+};
+
+const pveTemplate = new proxmox.VmLegacy(
+  "k3s-template-pve",
+  {
+    ...templateSettings,
+    nodeName: "pve",
+    name: "k3s-ubuntu-noble-template",
+    disks: [
+      {
+        interface: "scsi0",
+        datastoreId: "local-lvm",
+        importFrom: pulumi.interpolate`${ubuntuImagePve.datastoreId}:import/${ubuntuImagePve.fileName}`,
+        size: 10,
+        ssd: true,
+        discard: "on",
+      },
+    ],
+  },
+  { provider: pveProvider },
+);
+
+const pveBckpTemplate = new proxmox.VmLegacy(
+  "k3s-template-pve-bckp",
+  {
+    ...templateSettings,
+    nodeName: "pve-bckp",
+    name: "k3s-ubuntu-noble-template",
+    disks: [
+      {
+        interface: "scsi0",
+        datastoreId: "local",
+        importFrom: pulumi.interpolate`${ubuntuImagePveBckp.datastoreId}:import/${ubuntuImagePveBckp.fileName}`,
+        size: 10,
+        ssd: true,
+        discard: "on",
+      },
+    ],
+  },
+  { provider: pveBckpProvider },
+);
+
+// ---------------------------------------------------------------------------
+// k3s nodes — full clones of their respective templates
+// ---------------------------------------------------------------------------
+
+const k3sVmPassword = config.requireSecret("k3sVmPassword");
+const sshPvePublicKey = config.requireSecret("sshPvePublicKey");
+
+interface NodeConfig {
+  name: string;
+  role: "master" | "worker";
+  nodeName: string;
+  provider: proxmox.Provider;
+  template: proxmox.VmLegacy;
+  diskDatastore: string;
+  ip: pulumi.Output<string>;
+}
+
+const nodeConfigs: NodeConfig[] = [
+  {
+    name: "k3s-master-1",
+    role: "master",
+    nodeName: "pve",
+    provider: pveProvider,
+    template: pveTemplate,
+    diskDatastore: "local-lvm",
+    ip: master1Ip,
+  },
+  {
+    name: "k3s-master-2",
+    role: "master",
+    nodeName: "pve",
+    provider: pveProvider,
+    template: pveTemplate,
+    diskDatastore: "local-lvm",
+    ip: master2Ip,
+  },
+  {
+    name: "k3s-worker-1",
+    role: "worker",
+    nodeName: "pve",
+    provider: pveProvider,
+    template: pveTemplate,
+    diskDatastore: "local-lvm",
+    ip: worker1Ip,
+  },
+  {
+    name: "k3s-master-3",
+    role: "master",
+    nodeName: "pve-bckp",
+    provider: pveBckpProvider,
+    template: pveBckpTemplate,
+    diskDatastore: "local",
+    ip: master3Ip,
+  },
+  {
+    name: "k3s-worker-2",
+    role: "worker",
+    nodeName: "pve-bckp",
+    provider: pveBckpProvider,
+    template: pveBckpTemplate,
+    diskDatastore: "local",
+    ip: worker2Ip,
+  },
+];
+
+const k3sVms = nodeConfigs.map(
+  (node) =>
+    new proxmox.VmLegacy(
+      node.name,
+      {
+        nodeName: node.nodeName,
+        name: node.name,
+        description: "k3s " + node.role + " node — managed by Pulumi",
+        tags: ["k3s", node.role],
+        clone: {
+          vmId: node.template.vmId,
+          full: true,
+          datastoreId: node.diskDatastore,
+        },
+        cpu: {
+          cores: 2,
+          sockets: 1,
+          type: "host",
+          numa: true,
+        },
+        memory: {
+          dedicated: 2048,
+          floating: 0,
+        },
+        disks: [
+          {
+            interface: "scsi0",
+            datastoreId: node.diskDatastore,
+            size: 10,
+            ssd: true,
+            discard: "on",
+          },
+        ],
+        initialization: {
+          datastoreId: node.diskDatastore,
+          ipConfigs: [{ ipv4: { address: "dhcp" } }],
+          userAccount: {
+            username: "ubuntu",
+            password: k3sVmPassword,
+            keys: [
+              sshPvePublicKey.apply((k) => k.trim()),
+              ciRunnerKey.publicKeyOpenssh.apply((k) => k.trim()),
+            ],
+          },
+        },
+        networkDevices: [{ bridge: "vmbr0", model: "virtio" }],
+        scsiHardware: "virtio-scsi-pci",
+        serialDevices: [{}],
+        vga: { type: "serial0" },
+        agent: { enabled: true },
+        started: false,
+        stopOnDestroy: true,
+      },
+      {
+        provider: node.provider,
+        retainOnDelete: true,
+        ignoreChanges: ["clone", "started"],
+      },
+    ),
+);
+
+k3sVms.forEach((vmResource, i) => {
+  const assignedMac = vmResource.networkDevices.apply(
+    (nic) => nic[0].macAddress,
+  );
+
+  return new pfsense.Dhcpv4Staticmapping(
+    `${nodeConfigs[i].name}-dhcp`,
+    {
+      interface: "lan",
+      macAddress: assignedMac,
+      ipAddress: nodeConfigs[i].ip,
+      hostname: nodeConfigs[i].name,
+    },
+    { dependsOn: vmResource, provider: pfSenseProvider },
+  );
+});
+
+// Individual vmId exports — used by k8s-bootstrap to start VMs.
+// Order matches nodeConfigs: master-1, master-2, worker-1, master-3, worker-2.
+export const vmIds = {
+  master1: k3sVms[0].vmId,
+  master2: k3sVms[1].vmId,
+  worker1: k3sVms[2].vmId,
+  master3: k3sVms[3].vmId,
+  worker2: k3sVms[4].vmId,
+};
+
+// CI runner SSH private key — consumed by k8s-bootstrap via StackReference.
+export const ciRunnerPrivateKey = pulumi.secret(ciRunnerKey.privateKeyOpenssh);
+
+// Proxmox API credentials — consumed by k8s-bootstrap via StackReference.
+export { pve1Endpoint, pve1ApiToken, pve2Endpoint, pve2ApiToken };
+
+//k3s instance ips consumed by k8s-bootstrap.
+export { master1Ip, master2Ip, worker1Ip, master3Ip, worker2Ip };