# Infrastructure as Code This repository contains the full Infrastructure-as-Code stack that builds, configures, and manages my homelab environment. It brings together **Packer**, **Terraform**, and **Ansible** into a single, structured workflow that provisions VM templates, deploys infrastructure on Proxmox, and configures each service automatically. [![GitLab repo](https://img.shields.io/badge/GitLab-Public-blue)](https://gitlab.com/) [![Terraform](https://img.shields.io/badge/Terraform-Blue?logo=terraform&logoColor=white)](https://www.terraform.io/) [![Packer](https://img.shields.io/badge/Packer-6C9BFF?logo=hashicorp&logoColor=white)](https://www.packer.io/) [![Ansible](https://img.shields.io/badge/Ansible-Red?logo=ansible&logoColor=white)](https://www.ansible.com/) The goal is to maintain everything as code: reproducible, version-controlled, and modular. --- ## 🧱 Repository Structure ``` Infrastrucutre-as-Code/ ├── Packer ├── Terraform ├── Ansible ├── SSO └── README.md ``` --- ## ![Packer badge](https://img.shields.io/badge/Packer-6C9BFF?logo=hashicorp&logoColor=white) **Packer** Packer ├── rocky10-proxmox-template │ ├── http │ │ └── ks.cfg │ ├── scripts │ │ ├── setup-admin-user.sh │ │ └── setup-ansible-user.sh │ ├── packer.pkr.hcl │ ├── secure-packer-build.sh │ ├── terraform.pkrvar.hcl │ └── variables.pkr.hcl └── README.md Packer is used to create the base OS templates that all my virtual machines are built from. This includes: - Automated OS installation (using a minimal Rocky10 base image) - Hardening steps during image creation - Preconfigured admin and automation users and passwordless SSH access for them - Preparation for provisioning tools such as Ansible Each Packer build lives in its own directory containing: - `packer.pkr.hcl` build files - Kickstart / cloud-init automation - Hardening & configuration scripts These ISO's are uploaded to Proxmox as templates to be used by Terraform and form the baseline for the rest of the IaC pipeline. --- ## ![Terraform badge](https://img.shields.io/badge/Terraform-4C9BFF?logo=terraform&logoColor=white) **Terraform** Terraform ├── host_tags.yml.tpl ├── main.tf ├── providers.tf ├── README.md ├── terraform.tfvars └── variables.tf Terraform handles the infrastructure provisioning layer. It manages all Proxmox-related resources, including: - VM creation from Packer templates - Network, firewall, and storage definitions - Infrastructure for identity and trust components - Modular, reusable Terraform modules Terraform defines **what the homelab *is***. --- ## ![Ansible badge](https://img.shields.io/badge/Ansible-FF5A5A?logo=ansible&logoColor=white) **Ansible** Ansible ├── group_vars │ ├── all │ │ └── vault_token.yml │ └── all.yml ├── host_vars │ ├── docker-host │ │ └── host_tags.yml │ └── haproxy-vm │ └── host_tags.yml ├── playbooks │ ├── compliance.yml │ ├── initialization.yml │ └── provisioning.yml ├── roles │ ├── bootstrap_roles │ │ ├── base_users │ │ ├── disk_resize │ │ ├── docker_gitlab_setup │ │ ├── endlessh │ │ ├── firewall_ssh │ │ ├── hostname_network │ │ ├── packages │ │ ├── portainer_agent │ │ ├── root_password │ │ └── zsh_custom │ ├── cis_hardening │ │ ├── banners │ │ ├── defaults │ │ ├── file_permissions │ │ ├── filesystem_hardening │ │ ├── handlers │ │ ├── kernel_hardening │ │ ├── password_policy │ │ ├── service_disable │ │ ├── ssh_hardening │ │ └── tasks │ └── secure_vault │ ├── haproxy │ ├── technitium │ └── vault_agent ├── ansible.cfg ├── inventory_initialization.yml ├── inventory.yml ├── README.md ├── requirements.yml └── roles_metadata.yml Ansible configures the systems after Terraform brings them online. Roles and playbooks in this layer include: - Service installation and configuration - Certificate lifecycle management using Hashicrp Vault - mTLS enforcement for internal services - Service deployment and automation - Modular, reusable roles Ansible defines **how the homelab *behaves***. --- ## ![SSO badge](https://img.shields.io/badge/SSO-00C2A2?logo=keycloak&logoColor=white) **SSO** This directory contains everything related to the Single Sign-On stack. This includes: - Identity provider access to all locally routed applications and services behind HAProxy - Integrations with Vault, HAProxy and mTLS layers for true SSO once mTLS trust is verified The goal is to centralize and standardize authentication across the environment. --- ## 🔧 Workflow Overview The full workflow follows a simple, layered model: 1. **Packer** → build secure, repeatable VM templates 2. **Terraform** → instantiate infrastructure from those templates 3. **Ansible** → configure, secure, and deploy services Each layer owns a specific responsibility, keeping the stack clean, modular, and easy to reason about. --- ## 📌 Notes - Everything here is designed to be reproducible. - No secrets live in this repository — Vault injects them during provisioning. - Each component stands alone while participating in the overall pipeline. --- If you're exploring, a good path is **Packer → Terraform → Ansible** to see how everything connects.