tofu

tofu

The lab's guests, cloned from packer/'s templates through Saruman's API, from phoenix (ADR-0076). How to run it is provision-lab-guests.md. This page is the map.

set -a; . ~/.config/proxmox/phoenix.env; set +a
tofu -chdir=tofu init
tofu -chdir=tofu plan -out=next.tfplan
tofu -chdir=tofu apply next.tfplan && rm tofu/next.tfplan

What is here

• versions.tf pins tofu, bpg/proxmox and random, and sets the local backend at state/lab.tfstate. .terraform.lock.hcl pins the providers' hashes and is committed.
• encryption.tf encrypts state and plans with a passphrase from phoenix.env, and refuses to write either unencrypted. It is self-contained, because CI copies it as it stands to prove it.
• providers.tf reads the endpoint and the token from the environment, so neither is ever written to state.
• guests.tf lists the guests. The pools are derived from them, so a pool lives exactly as long as a guest in it does. It holds ADR-0029's six domain guests (150–155), in the lab-domain pool, #920's on-demand dotfiles VMs (191–198, ADR-0090), in the dotfiles pool, #921's always-on analyst workstation garuda (162, [ADR-0091]), in the analyst pool, and the proof guest, 998, only under -var proof=true.
• modules/guest/ makes one full clone, with the flags the hand-built guests have: q35, OVMF and an EFI disk, a TPM on Windows, and the MAC and SMBIOS UUID each guest is given. It leaves startup alone: setting it takes Sys.Modify on /, so root on Saruman sets it after an apply.

Rules this tree keeps

• State is never plaintext, and never tracked. enforced = true refuses a plaintext write. .gitignore, scripts/check-tracked-artefacts.sh and the tfstate-plaintext rule in .gitleaks.toml each catch a state that got out. scripts/check-tofu-state-encryption.sh --self-test proves every one of those can fail.
• Full clones only, because packer build -force rebuilds a template at the same VMID (ADR-0074).
• The six domain guests keep their MACs and SMBIOS UUIDs. morpheus's reservations are keyed by MAC, and the endpoints' activation by the UUID. A rebuild is build-the-lab-domain.md's, and it destroys with -target=module.guest so the pool's grant survives.
• CI proves that the tree parses and that the encryption holds. phoenix proves that it applies. scripts/lint.sh runs fmt -check and validate, and scripts/self-tests.sh runs the encryption proof. Both use the image stacks/observability/compose.yaml pins. A change here is only finished once the runbook's §4 has passed against a real apply.