cluster-knaster/platform/proxmox/tofu/main.tf

# GPU-Mappings, GPU-VMs und Infra-LXC aus sites/<site>/proxmox.yaml.
# Nicht gegen einen echten Cluster getestet – beim gemeinsamen Deployment zuerst `tofu plan`.

resource "proxmox_virtual_environment_hardware_mapping_pci" "gpu" {
  for_each = local.site.pci_mappings
  name     = each.key
  map = [{
    node         = each.value.node
    path         = each.value.path
    id           = each.value.id
    subsystem_id = each.value.subsystem_id
    iommu_group  = each.value.iommu_group
  }]
}

resource "proxmox_virtual_environment_vm" "gpu" {
  for_each  = local.site.vms
  name      = each.key
  node_name = each.value.node
  vm_id     = each.value.vmid
  tags      = ["knaster", each.value.role, each.value.driver_generation]

  machine = "q35"
  bios    = "ovmf"
  on_boot = true

  clone {
    vm_id = local.site.cluster.template_vmid
    full  = true
  }

  cpu {
    cores = each.value.cores
    type  = "host"
  }

  # PCI-Passthrough pinnt den gesamten RAM → kein Ballooning
  memory {
    dedicated = each.value.memory_mb
    floating  = 0
  }

  efi_disk {
    datastore_id = try(each.value.storage, local.site.cluster.storage_default)
    type         = "4m"
  }

  disk {
    datastore_id = try(each.value.storage, local.site.cluster.storage_default)
    interface    = "scsi0"
    size         = each.value.disk_gb
    discard      = "on"
    ssd          = true
  }

  # Modelle: eigenes Disk-Image, nicht repliziert, nicht gesichert (ADR-0002)
  disk {
    datastore_id = try(each.value.storage, local.site.cluster.storage_default)
    interface    = "scsi1"
    size         = each.value.models_disk_gb
    discard      = "on"
    ssd          = true
    backup       = false
    replicate    = false
  }

  # Alle Karten des Knotens in eine VM (D2); Reihenfolge = Index in der VM
  dynamic "hostpci" {
    for_each = each.value.gpus
    content {
      device  = "hostpci${hostpci.key}"
      mapping = proxmox_virtual_environment_hardware_mapping_pci.gpu[hostpci.value].name
      pcie    = true
      rombar  = true
    }
  }

  network_device {
    bridge  = local.site.cluster.bridge
    vlan_id = local.site.cluster.vlan_svc # null = flaches Netz
  }

  initialization {
    datastore_id = try(each.value.storage, local.site.cluster.storage_default)
    ip_config {
      ipv4 {
        address = each.value.ip
        gateway = local.site.cluster.gateway
      }
    }
    dns {
      servers = [local.site.cluster.dns]
    }
    user_account {
      username = "knaster"
      keys     = [local.ssh_key]
    }
  }
}

resource "proxmox_virtual_environment_container" "lxc" {
  for_each     = local.site.containers
  node_name    = each.value.node
  vm_id        = each.value.vmid
  tags         = ["knaster", each.key]
  unprivileged = true
  start_on_boot = true

  features {
    nesting = try(each.value.nesting, true) # Docker im LXC
  }

  cpu {
    cores = each.value.cores
  }

  memory {
    dedicated = each.value.memory_mb
  }

  disk {
    datastore_id = try(each.value.storage, local.site.cluster.storage_default)
    size         = each.value.disk_gb
  }

  operating_system {
    template_file_id = local.site.cluster.lxc_template
    type             = "debian"
  }

  network_interface {
    name    = "eth0"
    bridge  = local.site.cluster.bridge
    vlan_id = local.site.cluster.vlan_svc
  }

  initialization {
    hostname = each.key
    dns {
      servers = [local.site.cluster.dns]
    }
    ip_config {
      ipv4 {
        address = each.value.ip
        gateway = local.site.cluster.gateway
      }
    }
    user_account {
      keys = [local.ssh_key]
    }
  }
}

resource "proxmox_virtual_environment_haresource" "infra" {
  for_each    = { for k, v in local.site.containers : k => v if try(v.ha, false) }
  resource_id = "ct:${each.value.vmid}"
  state       = "started"
  comment     = "knaster ${each.key}"
  depends_on  = [proxmox_virtual_environment_container.lxc]
}