platform: OpenTofu/Ansible für Proxmox, CI, Makefile, Doku-Abgleich

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
2026-10-12 00:54:23 +02:00
parent cb5a413169
commit f22eaa8449
27 changed files with 623 additions and 6 deletions
@@ -0,0 +1,153 @@
+# GPU-Mappings, GPU-VMs und Infra-LXC aus sites/<site>/proxmox.yaml.
+# Nicht gegen einen echten Cluster getestet – beim gemeinsamen Deployment zuerst `tofu plan`.
+
+resource "proxmox_virtual_environment_hardware_mapping_pci" "gpu" {
+  for_each = local.site.pci_mappings
+  name     = each.key
+  map = [{
+    node         = each.value.node
+    path         = each.value.path
+    id           = each.value.id
+    subsystem_id = each.value.subsystem_id
+    iommu_group  = each.value.iommu_group
+  }]
+}
+
+resource "proxmox_virtual_environment_vm" "gpu" {
+  for_each  = local.site.vms
+  name      = each.key
+  node_name = each.value.node
+  vm_id     = each.value.vmid
+  tags      = ["knaster", each.value.role, each.value.driver_generation]
+
+  machine = "q35"
+  bios    = "ovmf"
+  on_boot = true
+
+  clone {
+    vm_id = local.site.cluster.template_vmid
+    full  = true
+  }
+
+  cpu {
+    cores = each.value.cores
+    type  = "host"
+  }
+
+  # PCI-Passthrough pinnt den gesamten RAM → kein Ballooning
+  memory {
+    dedicated = each.value.memory_mb
+    floating  = 0
+  }
+
+  efi_disk {
+    datastore_id = local.site.cluster.storage_vm
+    type         = "4m"
+  }
+
+  disk {
+    datastore_id = local.site.cluster.storage_vm
+    interface    = "scsi0"
+    size         = each.value.disk_gb
+    discard      = "on"
+    ssd          = true
+  }
+
+  # Modelle: eigenes Disk-Image, nicht repliziert, nicht gesichert (ADR-0002)
+  disk {
+    datastore_id = local.site.cluster.storage_vm
+    interface    = "scsi1"
+    size         = each.value.models_disk_gb
+    discard      = "on"
+    ssd          = true
+    backup       = false
+    replicate    = false
+  }
+
+  hostpci {
+    device  = "hostpci0"
+    mapping = proxmox_virtual_environment_hardware_mapping_pci.gpu[each.value.gpu].name
+    pcie    = true
+    rombar  = true
+  }
+
+  network_device {
+    bridge  = local.site.cluster.bridge
+    vlan_id = local.site.cluster.vlan_svc
+  }
+
+  initialization {
+    datastore_id = local.site.cluster.storage_vm
+    ip_config {
+      ipv4 {
+        address = each.value.ip
+        gateway = local.site.cluster.gateway
+      }
+    }
+    dns {
+      servers = [local.site.cluster.dns]
+    }
+    user_account {
+      username = "knaster"
+      keys     = [local.ssh_key]
+    }
+  }
+}
+
+resource "proxmox_virtual_environment_container" "infra" {
+  for_each     = local.site.containers
+  node_name    = each.value.node
+  vm_id        = each.value.vmid
+  tags         = ["knaster", "infra"]
+  unprivileged = true
+  start_on_boot = true
+
+  features {
+    nesting = true # Docker im LXC
+  }
+
+  cpu {
+    cores = each.value.cores
+  }
+
+  memory {
+    dedicated = each.value.memory_mb
+  }
+
+  disk {
+    datastore_id = local.site.cluster.storage_vm
+    size         = each.value.disk_gb
+  }
+
+  operating_system {
+    template_file_id = "${local.site.cluster.storage_iso}:vztmpl/debian-12-standard_12.7-1_amd64.tar.zst"
+    type             = "debian"
+  }
+
+  network_interface {
+    name    = "eth0"
+    bridge  = local.site.cluster.bridge
+    vlan_id = local.site.cluster.vlan_svc
+  }
+
+  initialization {
+    hostname = each.key
+    ip_config {
+      ipv4 {
+        address = each.value.ip
+        gateway = local.site.cluster.gateway
+      }
+    }
+    user_account {
+      keys = [local.ssh_key]
+    }
+  }
+}
+
+resource "proxmox_virtual_environment_haresource" "infra" {
+  for_each    = { for k, v in local.site.containers : k => v if try(v.ha, false) }
+  resource_id = "ct:${each.value.vmid}"
+  state       = "started"
+  comment     = "knaster ${each.key}"
+  depends_on  = [proxmox_virtual_environment_container.infra]
+}