update path

.gitea/workflows/main.yml

@@ -0,0 +1,50 @@
+name: Terraform CI
+run-name: ${{ gitea.actor }} triggered a Terraform CI
+on: 
+  push:
+  pull_request:
+
+jobs:
+  terraform:
+    runs-on: infra-terraform 
+
+    container:
+      volumes:
+        - /srv/terraform-state/proxmox-prod:/srv/terraform-state/proxmox-prod"
+    defaults:
+      run:
+        working-directory: stacks/prod/proxmox
+
+    env:
+      # TODO: migrate to Openbao
+      PROXMOX_VE_ENDPOINT: ${{ secrets.PROXMOX_VE_ENDPOINT }}
+      PROXMOX_VE_API_TOKEN: ${{ secrets.PROXMOX_VE_API_TOKEN }}
+      PROXMOX_VE_SSH_PRIVATE_KEY: ${{ secrets.PROXMOX_VE_SSH_PRIVATE_KEY }}
+
+    steps:
+        - name: Checkout repository 
+          uses: actions/checkout@v4
+
+        - name: Setup Terraform
+          uses: hashicorp/setup-terraform@v3
+          with:
+            terraform_version: 1.13.3
+
+          # Job will fail if you didn't run `terraform fmt -recursive`
+        - name: Check formatting
+          run: terraform fmt -check -recursive
+
+        - name: Initialize Terraform modules
+          run: terraform init
+
+        - name: Validate Terraform
+          run: terraform validate
+
+        - name: Create Terraform plan
+          run: terraform plan -out=tfplan
+
+          # Job will apply the plan if pushed to main
+        - name: Conditionally apply the Terraform plan
+          if: github.event_name == 'push' && github.ref == 'refs/heads/main'
+          run: terraform apply -auto-approve tfplan
+

stacks/prod/proxmox/providers.tf

@@ -6,7 +6,7 @@ provider "proxmox" {
   endpoint = "https://192.168.30.70:8006"
 
   # API token authentication (through environment variables)
-  api_token = var.proxmox_api_token
+  # api_token = var.proxmox_api_token
 
   # Accept self-signed certificates (TODO: change in the future if necessary)
   insecure = true
@@ -14,9 +14,10 @@ provider "proxmox" {
   # Allow SSH connections for certain operations (like uploading ISO files)
   # https://registry.terraform.io/providers/bpg/proxmox/latest/docs#ssh-connection
   ssh {
-    agent       = false
-    username    = "svc-terraform"
-    private_key = file("/home/svc-terraform/.ssh/id_rsa")
+    agent    = false
+    username = "svc-terraform"
+    # Read directly from PROXMOX_VE_SSH_PRIVATE_KEY env variable (in Gitea CI/CD)
+    # private_key = file("/home/svc-terraform/.ssh/id_rsa")
     # port = 22
     node {
       name    = "parker"

stacks/prod/proxmox/variables.tf

@@ -1,13 +1,16 @@
-variable "proxmox_endpoint" {
-  description = "Proxmox HTTPS API endpoint (including the port 8006)."
-  type        = string
-}
+# Comment out only if you need to pass it in as a variable when running not through CI/CD
+# Should not be the norm!!!!
 
-variable "proxmox_api_token" {
-  description = "The API token for Proxmox authentication in the form user@realm!tokenid=token-value"
-  type        = string
-  sensitive   = true # Don't show in console outputs
-}
+# variable "proxmox_endpoint" {
+#   description = "Proxmox HTTPS API endpoint (including the port 8006)."
+#   type        = string
+# }
+# 
+# variable "proxmox_api_token" {
+#   description = "The API token for Proxmox authentication in the form user@realm!tokenid=token-value"
+#   type        = string
+#   sensitive   = true # Don't show in console outputs
+# }
 
 # variable "username" {
 # 	type			= string