Skip to main content
Provision VMs and LXCs from one reviewed Terrakube workspace apply.
tofu-proxmox defines every VM and LXC in the homelab as OpenTofu resources. Terrakube runs it remotely and OpenBao supplies short-lived provider credentials.

​
What it does

  • Reads its desired-state from the deployment.json contract — one versioned S3 object, fetched fail-loud, single-writer via the state lock
  • Defines compute, network, and storage for every homelab guest
  • Wraps the bpg/proxmox provider
  • Places guests across cluster nodes via a per-resource node_name (defaults to the primary node)
  • Declares per-node ZFS storage (node_storage) that Ansible provisions — OpenTofu references the datastore by id and never creates the pool itself (zpool create is an OS-level operation)
  • Uses typed HCL inputs and locals to share values without generated configuration
  • Outputs a list of provisioned hosts that Ansible inventories consume directly
  • Provisions the object_storage module: RustFS LXC (S3-compatible, active)

​
How it fits

​
Object storage

The homelab uses RustFS for S3-compatible object storage. The object_storage module declares the RustFS LXC, which serves data flows and Splunkbase sync. ansible-proxmox backs up the RustFS data volume via sanoid/syncoid.

​
Getting started

1

Clone and enter the dev shell

git clone https://github.com/dryvist/tofu-proxmox && cd tofu-proxmox && nix develop
2

Authenticate to Terrakube

Run tofu login for the repo’s Terrakube host. The workspace obtains Proxmox credentials from OpenBao.
3

Apply

Run tofu plan, review the remote plan, then tofu apply.
4

Hand off to Ansible

Outputs are written to the file Ansible reads as its inventory. Run ansible-proxmox next.

ansible-proxmox

Configures the host once OpenTofu has provisioned it.

ansible-proxmox-apps

Deploys HAProxy, Cribl Edge, Cribl Stream on top.

tofu-splunk-aws

The AWS-side equivalent for Splunk’s DR footprint.

Source on GitHub

Modules, examples, full README.