tofu: GPU-VMs mit allen Karten des Knotens, DHCP über Gast-Agent, Provider für PVE 9

bpg/proxmox ~> 0.116.0 (nur API). Template je Knoten, Speicher je Gast,
hostpci dynamisch aus vms.*.gpus, kein Secure Boot (DKMS), Vendor-Snippet
für den qemu-guest-agent, Ausgabe ansible_inventory für die DHCP-Adressen.
scripts/make-template.sh legt das Ubuntu-24.04-Template mit Prüfsumme an.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

platform/proxmox/tofu/main.tf

@@ -1,5 +1,5 @@
 # GPU-Mappings, GPU-VMs und Infra-LXC aus sites/<site>/proxmox.yaml.
-# Nicht gegen einen echten Cluster getestet – beim gemeinsamen Deployment zuerst `tofu plan`.
+# Gäste per DHCP (D5 zurückgestellt): Die Adresse meldet der qemu-guest-agent (siehe outputs.tf).
 
 resource "proxmox_virtual_environment_hardware_mapping_pci" "gpu" {
   for_each = local.site.pci_mappings
@@ -18,15 +18,23 @@ resource "proxmox_virtual_environment_vm" "gpu" {
   name      = each.key
   node_name = each.value.node
   vm_id     = each.value.vmid
-  tags      = ["knaster", each.value.role, each.value.driver_generation]
+  tags      = ["knaster", "gpu", each.value.driver_generation]
 
-  machine = "q35"
-  bios    = "ovmf"
-  on_boot = true
+  machine       = "q35"
+  bios          = "ovmf"
+  on_boot       = true
+  scsi_hardware = "virtio-scsi-single"
 
+  # Template je Knoten: VMIDs sind clusterweit eindeutig, lokaler Speicher ist nicht geteilt
   clone {
-    vm_id = local.site.cluster.template_vmid
-    full  = true
+    vm_id        = local.site.cluster.templates[each.value.node]
+    node_name    = each.value.node
+    datastore_id = each.value.storage
+    full         = true
+  }
+
+  agent {
+    enabled = true
   }
 
   cpu {
@@ -40,53 +48,59 @@ resource "proxmox_virtual_environment_vm" "gpu" {
     floating  = 0
   }
 
+  # Ohne vorinstallierte Schlüssel kein Secure Boot: die NVIDIA-DKMS-Module sind nicht signiert
   efi_disk {
-    datastore_id = local.site.cluster.storage_vm
-    type         = "4m"
+    datastore_id      = each.value.storage
+    type              = "4m"
+    pre_enrolled_keys = false
   }
 
   disk {
-    datastore_id = local.site.cluster.storage_vm
+    datastore_id = each.value.storage
     interface    = "scsi0"
     size         = each.value.disk_gb
     discard      = "on"
     ssd          = true
+    iothread     = true
   }
 
   # Modelle: eigenes Disk-Image, nicht repliziert, nicht gesichert (ADR-0002)
   disk {
-    datastore_id = local.site.cluster.storage_vm
+    datastore_id = each.value.storage
     interface    = "scsi1"
+    file_format  = "raw"
     size         = each.value.models_disk_gb
     discard      = "on"
     ssd          = true
+    iothread     = true
     backup       = false
     replicate    = false
   }
 
-  hostpci {
-    device  = "hostpci0"
-    mapping = proxmox_virtual_environment_hardware_mapping_pci.gpu[each.value.gpu].name
-    pcie    = true
-    rombar  = true
+  # Alle Karten des Knotens (D2), jeweils mit allen Funktionen (Grafik + Audio)
+  dynamic "hostpci" {
+    for_each = each.value.gpus
+    content {
+      device  = "hostpci${hostpci.key}"
+      mapping = proxmox_virtual_environment_hardware_mapping_pci.gpu[hostpci.value].name
+      pcie    = true
+      rombar  = true
+    }
   }
 
   network_device {
-    bridge  = local.site.cluster.bridge
-    vlan_id = local.site.cluster.vlan_svc
+    bridge = local.site.cluster.bridge
   }
 
   initialization {
-    datastore_id = local.site.cluster.storage_vm
+    datastore_id        = each.value.storage
+    vendor_data_file_id = "local:snippets/knaster-vendor.yaml"
     ip_config {
       ipv4 {
         address = each.value.ip
-        gateway = local.site.cluster.gateway
+        gateway = each.value.ip == "dhcp" ? null : local.site.cluster.gateway
       }
     }
-    dns {
-      servers = [local.site.cluster.dns]
-    }
     user_account {
       username = "knaster"
       keys     = [local.ssh_key]
@@ -95,11 +109,11 @@ resource "proxmox_virtual_environment_vm" "gpu" {
 }
 
 resource "proxmox_virtual_environment_container" "infra" {
-  for_each     = local.site.containers
-  node_name    = each.value.node
-  vm_id        = each.value.vmid
-  tags         = ["knaster", "infra"]
-  unprivileged = true
+  for_each      = local.site.containers
+  node_name     = each.value.node
+  vm_id         = each.value.vmid
+  tags          = ["knaster", "infra"]
+  unprivileged  = true
   start_on_boot = true
 
   features {
@@ -115,19 +129,18 @@ resource "proxmox_virtual_environment_container" "infra" {
   }
 
   disk {
-    datastore_id = local.site.cluster.storage_vm
+    datastore_id = each.value.storage
     size         = each.value.disk_gb
   }
 
   operating_system {
-    template_file_id = "${local.site.cluster.storage_iso}:vztmpl/debian-12-standard_12.7-1_amd64.tar.zst"
+    template_file_id = "${local.site.cluster.storage_iso}:vztmpl/${local.site.cluster.lxc_template}"
     type             = "debian"
   }
 
   network_interface {
-    name    = "eth0"
-    bridge  = local.site.cluster.bridge
-    vlan_id = local.site.cluster.vlan_svc
+    name   = "eth0"
+    bridge = local.site.cluster.bridge
   }
 
   initialization {
@@ -135,7 +148,7 @@ resource "proxmox_virtual_environment_container" "infra" {
     ip_config {
       ipv4 {
         address = each.value.ip
-        gateway = local.site.cluster.gateway
+        gateway = each.value.ip == "dhcp" ? null : local.site.cluster.gateway
       }
     }
     user_account {