db68067925
Phase 5 — CI pipelines: - default.yml: add SOPS decrypt in prepare step, change git add . to specific paths (stacks/ state/ .woodpecker/), cleanup on success+failure - renew-tls.yml: change git add . to git add secrets/ state/ Phase 6 — sensitive=true: - Add sensitive = true to 256 variable declarations across 149 stack files - Prevents secret values from appearing in terraform plan output - Does NOT modify shared modules (ingress_factory, nfs_volume) to avoid breaking module interface contracts Note: CI pipeline SOPS decryption requires sops_age_key Woodpecker secret to be created before the pipeline will work with SOPS. Until then, the old terraform.tfvars path continues to function.
32 lines
684 B
HCL
32 lines
684 B
HCL
# Generated by Terragrunt. Sig: nIlQXj57tbuaRZEa
|
|
terraform {
|
|
required_providers {
|
|
proxmox = {
|
|
source = "telmate/proxmox"
|
|
version = "3.0.2-rc07"
|
|
}
|
|
}
|
|
}
|
|
|
|
variable "kube_config_path" {
|
|
type = string
|
|
default = "~/.kube/config"
|
|
sensitive = true
|
|
}
|
|
|
|
variable "proxmox_pm_api_url" { type = string }
|
|
variable "proxmox_pm_api_token_id" {
|
|
type = string
|
|
sensitive = true
|
|
}
|
|
variable "proxmox_pm_api_token_secret" {
|
|
type = string
|
|
sensitive = true
|
|
}
|
|
|
|
provider "proxmox" {
|
|
pm_api_url = var.proxmox_pm_api_url
|
|
pm_api_token_id = var.proxmox_pm_api_token_id
|
|
pm_api_token_secret = var.proxmox_pm_api_token_secret
|
|
pm_tls_insecure = true
|
|
}
|