Restructure into one folder per private repo/host, not a flat Docker/ dump
rocky-docker-lxc/, caddy-vm/, monitoring-vm/ (was missing entirely -
Grafana+Loki+Prometheus stack, refreshed and CA mount stripped same as
everything else), and automation/{ansible,automation-vm,iac}/ for the
three repos that live on the automation VM. Hawser is genuinely
deployed on all three of caddy-vm/monitoring-vm/automation-vm so it's
duplicated in each rather than picking one canonical home.
Old Ansible/ and "Infrastrucutre as Code/" content moved under
automation/ansible/old-playbooks and automation/iac/old-content as-is
for now - contents still need refreshing against the current repos and
a per-folder README, that's the next pass.
This commit is contained in:
146 files changed
+101
-84
No files matched your search
@@ -0,0 +1,176 @@
|
||||
# <span style="color:#4DA3FF;">Infrastructure as Code</span>
|
||||
|
||||
This repository contains the full Infrastructure-as-Code stack that builds, configures, and manages my homelab environment. It brings together **Packer**, **Terraform**, and **Ansible** into a single, structured workflow that provisions VM templates, deploys infrastructure on Proxmox, and configures each service automatically.
|
||||
|
||||
[](https://gitlab.com/)
|
||||
[](https://www.terraform.io/)
|
||||
[](https://www.packer.io/)
|
||||
[](https://www.ansible.com/)
|
||||
|
||||
The goal is to maintain everything as code: reproducible, version-controlled, and modular.
|
||||
|
||||
---
|
||||
|
||||
## <span style="color:#E0A800;">🧱 Repository Structure</span>
|
||||
|
||||
```
|
||||
Infrastrucutre-as-Code/
|
||||
├── Packer
|
||||
├── Terraform
|
||||
├── Ansible
|
||||
├── SSO
|
||||
└── README.md
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
##  **Packer**
|
||||
Packer
|
||||
├── rocky10-proxmox-template
|
||||
│ ├── http
|
||||
│ │ └── ks.cfg
|
||||
│ ├── scripts
|
||||
│ │ ├── setup-admin-user.sh
|
||||
│ │ └── setup-ansible-user.sh
|
||||
│ ├── packer.pkr.hcl
|
||||
│ ├── secure-packer-build.sh
|
||||
│ ├── terraform.pkrvar.hcl
|
||||
│ └── variables.pkr.hcl
|
||||
└── README.md
|
||||
|
||||
Packer is used to create the base OS templates that all my virtual machines are built from.
|
||||
This includes:
|
||||
|
||||
- Automated OS installation (using a minimal Rocky10 base image)
|
||||
- Hardening steps during image creation
|
||||
- Preconfigured admin and automation users and passwordless SSH access for them
|
||||
- Preparation for provisioning tools such as Ansible
|
||||
|
||||
Each Packer build lives in its own directory containing:
|
||||
|
||||
- `packer.pkr.hcl` build files
|
||||
- Kickstart / cloud-init automation
|
||||
- Hardening & configuration scripts
|
||||
|
||||
These ISO's are uploaded to Proxmox as templates to be used by Terraform and form the baseline for the rest of the IaC pipeline.
|
||||
|
||||
---
|
||||
|
||||
##  **Terraform**
|
||||
Terraform
|
||||
├── host_tags.yml.tpl
|
||||
├── main.tf
|
||||
├── providers.tf
|
||||
├── README.md
|
||||
├── terraform.tfvars
|
||||
└── variables.tf
|
||||
|
||||
Terraform handles the infrastructure provisioning layer.
|
||||
It manages all Proxmox-related resources, including:
|
||||
|
||||
- VM creation from Packer templates
|
||||
- Network, firewall, and storage definitions
|
||||
- Infrastructure for identity and trust components
|
||||
- Modular, reusable Terraform modules
|
||||
|
||||
Terraform defines **what the homelab *is***.
|
||||
|
||||
---
|
||||
|
||||
##  **Ansible**
|
||||
Ansible
|
||||
├── group_vars
|
||||
│ ├── all
|
||||
│ │ └── vault_token.yml
|
||||
│ └── all.yml
|
||||
├── host_vars
|
||||
│ ├── docker-host
|
||||
│ │ └── host_tags.yml
|
||||
│ └── haproxy-vm
|
||||
│ └── host_tags.yml
|
||||
├── playbooks
|
||||
│ ├── compliance.yml
|
||||
│ ├── initialization.yml
|
||||
│ └── provisioning.yml
|
||||
├── roles
|
||||
│ ├── bootstrap_roles
|
||||
│ │ ├── base_users
|
||||
│ │ ├── disk_resize
|
||||
│ │ ├── docker_gitlab_setup
|
||||
│ │ ├── endlessh
|
||||
│ │ ├── firewall_ssh
|
||||
│ │ ├── hostname_network
|
||||
│ │ ├── packages
|
||||
│ │ ├── portainer_agent
|
||||
│ │ ├── root_password
|
||||
│ │ └── zsh_custom
|
||||
│ ├── cis_hardening
|
||||
│ │ ├── banners
|
||||
│ │ ├── defaults
|
||||
│ │ ├── file_permissions
|
||||
│ │ ├── filesystem_hardening
|
||||
│ │ ├── handlers
|
||||
│ │ ├── kernel_hardening
|
||||
│ │ ├── password_policy
|
||||
│ │ ├── service_disable
|
||||
│ │ ├── ssh_hardening
|
||||
│ │ └── tasks
|
||||
│ └── secure_vault
|
||||
│ ├── haproxy
|
||||
│ ├── technitium
|
||||
│ └── vault_agent
|
||||
├── ansible.cfg
|
||||
├── inventory_initialization.yml
|
||||
├── inventory.yml
|
||||
├── README.md
|
||||
├── requirements.yml
|
||||
└── roles_metadata.yml
|
||||
|
||||
Ansible configures the systems after Terraform brings them online.
|
||||
|
||||
Roles and playbooks in this layer include:
|
||||
|
||||
- Service installation and configuration
|
||||
- Certificate lifecycle management using Hashicrp Vault
|
||||
- mTLS enforcement for internal services
|
||||
- Service deployment and automation
|
||||
- Modular, reusable roles
|
||||
|
||||
Ansible defines **how the homelab *behaves***.
|
||||
|
||||
---
|
||||
|
||||
##  **SSO**
|
||||
|
||||
This directory contains everything related to the Single Sign-On stack.
|
||||
|
||||
This includes:
|
||||
|
||||
- Identity provider access to all locally routed applications and services behind HAProxy
|
||||
- Integrations with Vault, HAProxy and mTLS layers for true SSO once mTLS trust is verified
|
||||
|
||||
The goal is to centralize and standardize authentication across the environment.
|
||||
|
||||
---
|
||||
|
||||
## <span style="color:#F2921D;">🔧 Workflow Overview</span>
|
||||
|
||||
The full workflow follows a simple, layered model:
|
||||
|
||||
1. **Packer** → build secure, repeatable VM templates
|
||||
2. **Terraform** → instantiate infrastructure from those templates
|
||||
3. **Ansible** → configure, secure, and deploy services
|
||||
|
||||
Each layer owns a specific responsibility, keeping the stack clean, modular, and easy to reason about.
|
||||
|
||||
---
|
||||
|
||||
## <span style="color:#17A2B8;">📌 Notes</span>
|
||||
|
||||
- Everything here is designed to be reproducible.
|
||||
- No secrets live in this repository — Vault injects them during provisioning.
|
||||
- Each component stands alone while participating in the overall pipeline.
|
||||
|
||||
---
|
||||
|
||||
If you're exploring, a good path is **Packer → Terraform → Ansible** to see how everything connects.
|
||||
Reference in new issue
Block a user