cluster-knaster/platform/proxmox/tofu/main.tf

# GPU-Mappings, GPU-VMs und Infra-LXC aus sites/<site>/proxmox.yaml.
# Gäste per DHCP (D5 zurückgestellt): Die Adresse meldet der qemu-guest-agent (siehe outputs.tf).

resource "proxmox_hardware_mapping_pci" "gpu" {
  for_each = local.site.pci_mappings
  name     = each.key
  map = [{
    node         = each.value.node
    path         = each.value.path
    id           = each.value.id
    subsystem_id = each.value.subsystem_id
    iommu_group  = each.value.iommu_group
  }]
}

resource "proxmox_virtual_environment_vm" "gpu" {
  for_each  = local.site.vms
  name      = each.key
  node_name = each.value.node
  vm_id     = each.value.vmid
  tags      = ["knaster", "gpu", each.value.driver_generation]

  machine       = "q35"
  bios          = "ovmf"
  on_boot       = true
  scsi_hardware = "virtio-scsi-single"

  # Template je Knoten: VMIDs sind clusterweit eindeutig, lokaler Speicher ist nicht geteilt
  clone {
    vm_id        = local.site.cluster.templates[each.value.node]
    node_name    = each.value.node
    datastore_id = each.value.storage
    full         = true
  }

  agent {
    enabled = true
  }

  cpu {
    cores = each.value.cores
    type  = "host"
  }

  # PCI-Passthrough pinnt den gesamten RAM → kein Ballooning
  memory {
    dedicated = each.value.memory_mb
    floating  = 0
  }

  # Ohne vorinstallierte Schlüssel kein Secure Boot: die NVIDIA-DKMS-Module sind nicht signiert
  efi_disk {
    datastore_id      = each.value.storage
    type              = "4m"
    pre_enrolled_keys = false
  }

  disk {
    datastore_id = each.value.storage
    interface    = "scsi0"
    size         = each.value.disk_gb
    discard      = "on"
    ssd          = true
    iothread     = true
  }

  # Modelle: eigenes Disk-Image, nicht repliziert, nicht gesichert (ADR-0002)
  disk {
    datastore_id = each.value.storage
    interface    = "scsi1"
    file_format  = "raw"
    size         = each.value.models_disk_gb
    discard      = "on"
    ssd          = true
    iothread     = true
    backup       = false
    replicate    = false
  }

  # Alle Karten des Knotens (D2), jeweils mit allen Funktionen (Grafik + Audio)
  dynamic "hostpci" {
    for_each = each.value.gpus
    content {
      device  = "hostpci${hostpci.key}"
      mapping = proxmox_hardware_mapping_pci.gpu[hostpci.value].name
      pcie    = true
      rombar  = true
    }
  }

  network_device {
    bridge = local.site.cluster.bridge
  }

  initialization {
    datastore_id        = each.value.storage
    vendor_data_file_id = "local:snippets/knaster-vendor.yaml"
    ip_config {
      ipv4 {
        address = each.value.ip
        gateway = each.value.ip == "dhcp" ? null : local.site.cluster.gateway
      }
    }
    user_account {
      username = "knaster"
      keys     = [local.ssh_key]
    }
  }
}

resource "proxmox_virtual_environment_container" "infra" {
  for_each      = local.site.containers
  node_name     = each.value.node
  vm_id         = each.value.vmid
  tags          = ["knaster", "infra"]
  unprivileged  = true
  start_on_boot = true

  features {
    nesting = true # Docker im LXC
  }

  cpu {
    cores = each.value.cores
  }

  memory {
    dedicated = each.value.memory_mb
  }

  disk {
    datastore_id = each.value.storage
    size         = each.value.disk_gb
  }

  operating_system {
    template_file_id = "${local.site.cluster.storage_iso}:vztmpl/${local.site.cluster.lxc_template}"
    type             = "debian"
  }

  network_interface {
    name   = "eth0"
    bridge = local.site.cluster.bridge
  }

  initialization {
    hostname = each.key
    ip_config {
      ipv4 {
        address = each.value.ip
        gateway = each.value.ip == "dhcp" ? null : local.site.cluster.gateway
      }
    }
    user_account {
      keys = [local.ssh_key]
    }
  }
}

# HA (Ressource + Node-Affinity-Regel) und Replikation setzt die Ansible-Rolle pve-host per root-SSH.
# So braucht der tofu-Token kein Sys.Console auf /.