177 lines
5.9 KiB
Markdown
177 lines
5.9 KiB
Markdown
# <span style="color:#4DA3FF;">Infrastructure as Code</span>
|
|
|
|
This repository contains the full Infrastructure-as-Code stack that builds, configures, and manages my homelab environment. It brings together **Packer**, **Terraform**, and **Ansible** into a single, structured workflow that provisions VM templates, deploys infrastructure on Proxmox, and configures each service automatically.
|
|
|
|
[](https://gitlab.com/)
|
|
[](https://www.terraform.io/)
|
|
[](https://www.packer.io/)
|
|
[](https://www.ansible.com/)
|
|
|
|
The goal is to maintain everything as code: reproducible, version-controlled, and modular.
|
|
|
|
---
|
|
|
|
## <span style="color:#E0A800;">🧱 Repository Structure</span>
|
|
|
|
```
|
|
Infrastrucutre-as-Code/
|
|
├── Packer
|
|
├── Terraform
|
|
├── Ansible
|
|
├── SSO
|
|
└── README.md
|
|
```
|
|
|
|
---
|
|
|
|
##  **Packer**
|
|
Packer
|
|
├── rocky10-proxmox-template
|
|
│ ├── http
|
|
│ │ └── ks.cfg
|
|
│ ├── scripts
|
|
│ │ ├── setup-admin-user.sh
|
|
│ │ └── setup-ansible-user.sh
|
|
│ ├── packer.pkr.hcl
|
|
│ ├── secure-packer-build.sh
|
|
│ ├── terraform.pkrvar.hcl
|
|
│ └── variables.pkr.hcl
|
|
└── README.md
|
|
|
|
Packer is used to create the base OS templates that all my virtual machines are built from.
|
|
This includes:
|
|
|
|
- Automated OS installation (using a minimal Rocky10 base image)
|
|
- Hardening steps during image creation
|
|
- Preconfigured admin and automation users and passwordless SSH access for them
|
|
- Preparation for provisioning tools such as Ansible
|
|
|
|
Each Packer build lives in its own directory containing:
|
|
|
|
- `packer.pkr.hcl` build files
|
|
- Kickstart / cloud-init automation
|
|
- Hardening & configuration scripts
|
|
|
|
These ISO's are uploaded to Proxmox as templates to be used by Terraform and form the baseline for the rest of the IaC pipeline.
|
|
|
|
---
|
|
|
|
##  **Terraform**
|
|
Terraform
|
|
├── host_tags.yml.tpl
|
|
├── main.tf
|
|
├── providers.tf
|
|
├── README.md
|
|
├── terraform.tfvars
|
|
└── variables.tf
|
|
|
|
Terraform handles the infrastructure provisioning layer.
|
|
It manages all Proxmox-related resources, including:
|
|
|
|
- VM creation from Packer templates
|
|
- Network, firewall, and storage definitions
|
|
- Infrastructure for identity and trust components
|
|
- Modular, reusable Terraform modules
|
|
|
|
Terraform defines **what the homelab *is***.
|
|
|
|
---
|
|
|
|
##  **Ansible**
|
|
Ansible
|
|
├── group_vars
|
|
│ ├── all
|
|
│ │ └── vault_token.yml
|
|
│ └── all.yml
|
|
├── host_vars
|
|
│ ├── docker-host
|
|
│ │ └── host_tags.yml
|
|
│ └── haproxy-vm
|
|
│ └── host_tags.yml
|
|
├── playbooks
|
|
│ ├── compliance.yml
|
|
│ ├── initialization.yml
|
|
│ └── provisioning.yml
|
|
├── roles
|
|
│ ├── bootstrap_roles
|
|
│ │ ├── base_users
|
|
│ │ ├── disk_resize
|
|
│ │ ├── docker_gitlab_setup
|
|
│ │ ├── endlessh
|
|
│ │ ├── firewall_ssh
|
|
│ │ ├── hostname_network
|
|
│ │ ├── packages
|
|
│ │ ├── portainer_agent
|
|
│ │ ├── root_password
|
|
│ │ └── zsh_custom
|
|
│ ├── cis_hardening
|
|
│ │ ├── banners
|
|
│ │ ├── defaults
|
|
│ │ ├── file_permissions
|
|
│ │ ├── filesystem_hardening
|
|
│ │ ├── handlers
|
|
│ │ ├── kernel_hardening
|
|
│ │ ├── password_policy
|
|
│ │ ├── service_disable
|
|
│ │ ├── ssh_hardening
|
|
│ │ └── tasks
|
|
│ └── secure_vault
|
|
│ ├── haproxy
|
|
│ ├── technitium
|
|
│ └── vault_agent
|
|
├── ansible.cfg
|
|
├── inventory_initialization.yml
|
|
├── inventory.yml
|
|
├── README.md
|
|
├── requirements.yml
|
|
└── roles_metadata.yml
|
|
|
|
Ansible configures the systems after Terraform brings them online.
|
|
|
|
Roles and playbooks in this layer include:
|
|
|
|
- Service installation and configuration
|
|
- Certificate lifecycle management using Hashicrp Vault
|
|
- mTLS enforcement for internal services
|
|
- Service deployment and automation
|
|
- Modular, reusable roles
|
|
|
|
Ansible defines **how the homelab *behaves***.
|
|
|
|
---
|
|
|
|
##  **SSO**
|
|
|
|
This directory contains everything related to the Single Sign-On stack.
|
|
|
|
This includes:
|
|
|
|
- Identity provider access to all locally routed applications and services behind HAProxy
|
|
- Integrations with Vault, HAProxy and mTLS layers for true SSO once mTLS trust is verified
|
|
|
|
The goal is to centralize and standardize authentication across the environment.
|
|
|
|
---
|
|
|
|
## <span style="color:#F2921D;">🔧 Workflow Overview</span>
|
|
|
|
The full workflow follows a simple, layered model:
|
|
|
|
1. **Packer** → build secure, repeatable VM templates
|
|
2. **Terraform** → instantiate infrastructure from those templates
|
|
3. **Ansible** → configure, secure, and deploy services
|
|
|
|
Each layer owns a specific responsibility, keeping the stack clean, modular, and easy to reason about.
|
|
|
|
---
|
|
|
|
## <span style="color:#17A2B8;">📌 Notes</span>
|
|
|
|
- Everything here is designed to be reproducible.
|
|
- No secrets live in this repository — Vault injects them during provisioning.
|
|
- Each component stands alone while participating in the overall pipeline.
|
|
|
|
---
|
|
|
|
If you're exploring, a good path is **Packer → Terraform → Ansible** to see how everything connects.
|