public/automation/iac/old-content

Infrastructure as Code

This repository contains the full Infrastructure-as-Code stack that builds, configures, and manages my homelab environment. It brings together Packer, Terraform, and Ansible into a single, structured workflow that provisions VM templates, deploys infrastructure on Proxmox, and configures each service automatically.

The goal is to maintain everything as code: reproducible, version-controlled, and modular.

---

🧱 Repository Structure

Infrastrucutre-as-Code/
├── Packer
├── Terraform
├── Ansible
├── SSO
└── README.md

---

Packer

Packer ├── rocky10-proxmox-template │ ├── http │ │ └── ks.cfg │ ├── scripts │ │ ├── setup-admin-user.sh │ │ └── setup-ansible-user.sh │ ├── packer.pkr.hcl │ ├── secure-packer-build.sh │ ├── terraform.pkrvar.hcl │ └── variables.pkr.hcl └── README.md

Packer is used to create the base OS templates that all my virtual machines are built from.
This includes:

• Automated OS installation (using a minimal Rocky10 base image)
• Hardening steps during image creation
• Preconfigured admin and automation users and passwordless SSH access for them
• Preparation for provisioning tools such as Ansible

Each Packer build lives in its own directory containing:

• packer.pkr.hcl build files
• Kickstart / cloud-init automation
• Hardening & configuration scripts

These ISO's are uploaded to Proxmox as templates to be used by Terraform and form the baseline for the rest of the IaC pipeline.

---

Terraform

Terraform ├── host_tags.yml.tpl ├── main.tf ├── providers.tf ├── README.md ├── terraform.tfvars └── variables.tf

Terraform handles the infrastructure provisioning layer.
It manages all Proxmox-related resources, including:

• VM creation from Packer templates
• Network, firewall, and storage definitions
• Infrastructure for identity and trust components
• Modular, reusable Terraform modules

Terraform defines what the homelab is.

---

Ansible

Ansible ├── group_vars │ ├── all │ │ └── vault_token.yml │ └── all.yml ├── host_vars │ ├── docker-host │ │ └── host_tags.yml │ └── haproxy-vm │ └── host_tags.yml ├── playbooks │ ├── compliance.yml │ ├── initialization.yml │ └── provisioning.yml ├── roles │ ├── bootstrap_roles │ │ ├── base_users │ │ ├── disk_resize │ │ ├── docker_gitlab_setup │ │ ├── endlessh │ │ ├── firewall_ssh │ │ ├── hostname_network │ │ ├── packages │ │ ├── portainer_agent │ │ ├── root_password │ │ └── zsh_custom │ ├── cis_hardening │ │ ├── banners │ │ ├── defaults │ │ ├── file_permissions │ │ ├── filesystem_hardening │ │ ├── handlers │ │ ├── kernel_hardening │ │ ├── password_policy │ │ ├── service_disable │ │ ├── ssh_hardening │ │ └── tasks │ └── secure_vault │ ├── haproxy │ ├── technitium │ └── vault_agent ├── ansible.cfg ├── inventory_initialization.yml ├── inventory.yml ├── README.md ├── requirements.yml └── roles_metadata.yml

Ansible configures the systems after Terraform brings them online.

Roles and playbooks in this layer include:

• Service installation and configuration
• Certificate lifecycle management using Hashicrp Vault
• mTLS enforcement for internal services
• Service deployment and automation
• Modular, reusable roles

Ansible defines how the homelab behaves.

---

SSO

This directory contains everything related to the Single Sign-On stack.

This includes:

• Identity provider access to all locally routed applications and services behind HAProxy
• Integrations with Vault, HAProxy and mTLS layers for true SSO once mTLS trust is verified

The goal is to centralize and standardize authentication across the environment.

---

🔧 Workflow Overview

The full workflow follows a simple, layered model:

1. Packer → build secure, repeatable VM templates
2. Terraform → instantiate infrastructure from those templates
3. Ansible → configure, secure, and deploy services

Each layer owns a specific responsibility, keeping the stack clean, modular, and easy to reason about.

---

📌 Notes

• Everything here is designed to be reproducible.
• No secrets live in this repository — Vault injects them during provisioning.
• Each component stands alone while participating in the overall pipeline.

---

If you're exploring, a good path is Packer → Terraform → Ansible to see how everything connects.