#opentofu — Public Fediverse posts
Live and recent posts from across the Fediverse tagged #opentofu, aggregated by home.social.
-
Nova atividade para o CoffeeOps de Agosto no LHC. Dia 15 de às 09:00 horas
Agora vamos falar de Proxmox IaC: Gerenciamento com OpenTofu & Terraform com o Marc Pires.
Uma apresentação mão na massa sobre gerenciamento do Procmox com IaC
Tópicos:
Proxmox API
Preparando o ambiente com Terraform/OpenTofu e SeeWeedFS
Preparando Proxmox
Criando VMS e outros recursos via IaChttps://eventos.lhc.net.br/event/coffeeops-2026-08
#hackerspace #coffeeops #comunidade #proxmox #iac #campinas #cafe #free #opentofu #terraform #devops
-
Nova atividade para o CoffeeOps de Agosto no LHC. Dia 15 de às 09:00 horas
Agora vamos falar de Proxmox IaC: Gerenciamento com OpenTofu & Terraform com o Marc Pires.
Uma apresentação mão na massa sobre gerenciamento do Procmox com IaC
Tópicos:
Proxmox API
Preparando o ambiente com Terraform/OpenTofu e SeeWeedFS
Preparando Proxmox
Criando VMS e outros recursos via IaChttps://eventos.lhc.net.br/event/coffeeops-2026-08
#hackerspace #coffeeops #comunidade #proxmox #iac #campinas #cafe #free #opentofu #terraform #devops
-
Looks like it works! Finally Terraform Provider that works with Zabbix 7.0. I wished for this for more than a year.
-
Looks like it works! Finally Terraform Provider that works with Zabbix 7.0. I wished for this for more than a year.
-
I moved cichyform repository with my custom Terraform modules to @codefloe . Original repository on codeberg has not been deleted but archived so your stacks should be usable without any migrations. But all tags and commits are migrated to CodeFloe, so just simple edit in source="" should be enough to migrate :-)
-
I moved cichyform repository with my custom Terraform modules to @codefloe . Original repository on codeberg has not been deleted but archived so your stacks should be usable without any migrations. But all tags and commits are migrated to CodeFloe, so just simple edit in source="" should be enough to migrate :-)
-
Parce que j'ai envie qu'il tombe de la merde (ras le cul de la chaleur), j'ai déjà publié le replay du live de vendredi soir, où on fait évoluer le module #opentofu pour Hetzner avec #OpenCode / #Qwen 🙂(oui, de l'IAGen locale)
https://www.youtube.com/watch?v=W_6_JVNtWV4 -
Ang. min förra boost: #Stacikit är ett intressant(europeiskt) alternativ till #Azure och #AWS. För två år sen var deras utbud inte stort men nu har det utökats med AI-orkestrering, K8s, CRs, Messaging, mm. Mycket av det ser ut att bygga på Open Source. Det finns även stöd för #Terraform(borde även fungera med #OpenTofu).
-
👋 Je propose une mission DevSecOPS pour construire la plateforme d'hébergement de la DINUM qui accueille les applications de l'État, vous travaillez sur les couches d'accès (Coeur de réseau, Load Balancer, VPN, Pare-Feu, Proxy ainsi que leur durcissement du système). La plateforme est construite sur des offres IaaS Interne à l'État ou des clouds SecNumCloud.
Plus d'infos ici :
https://docs.numerique.gouv.fr/docs/50d6dc53-aa9e-4970-b79a-dbab6843b279/#OpenTofu #Terraform #DevOPS #Indep
Merci pour les repouets !
-
👋 Je propose une mission DevSecOPS pour construire la plateforme d'hébergement de la DINUM qui accueille les applications de l'État, vous travaillez sur les couches d'accès (Coeur de réseau, Load Balancer, VPN, Pare-Feu, Proxy ainsi que leur durcissement du système). La plateforme est construite sur des offres IaaS Interne à l'État ou des clouds SecNumCloud.
Plus d'infos ici :
https://docs.numerique.gouv.fr/docs/50d6dc53-aa9e-4970-b79a-dbab6843b279/#OpenTofu #Terraform #DevOPS #Indep
Merci pour les repouets !
-
I wiped my homelab and got it up and running again in 5 minutes. I used what I like to call the BAT stack which is Bootc, Ansible, and Terraform. Bootc for image based os builds, Ansible for configuration, and Terraform for VM provisioning on Proxmox. All being versioned controlled.
Check out more on my blog
https://keijilohier.com/blogs/recreating-my-homelab-with-infrastructure-as-code/
#homelab #bootc #ansible #terraform #proxmox #git
#iac #opentofu -
I wiped my homelab and got it up and running again in 5 minutes. I used what I like to call the BAT stack which is Bootc, Ansible, and Terraform. Bootc for image based os builds, Ansible for configuration, and Terraform for VM provisioning on Proxmox. All being versioned controlled.
Check out more on my blog
https://keijilohier.com/blogs/recreating-my-homelab-with-infrastructure-as-code/
#homelab #bootc #ansible #terraform #proxmox #git
#iac #opentofu -
Ok, one more but it goes with 2. : DO NOT configure your providers in the #terraform / #opentofu code. You're shooting yourself in the foot here, let #terragrunt handle this dynamically.
-
Ok, one more but it goes with 2. : DO NOT configure your providers in the #terraform / #opentofu code. You're shooting yourself in the foot here, let #terragrunt handle this dynamically.
-
The more I work as a Dev Ops / Platform Eng, the more I fight a single anti-pattern.
For your future self :
1. Use #terragrunt and not only #terraform / #opentofu ,
2. Centralize you #tf code in different modules in a single repository and have #tg use them ,
3. That one goes without saying but here it is : DRY your code using locals !I'm tired of removing hundred lines of #IaC code just for the sake of maintainability.
-
The more I work as a Dev Ops / Platform Eng, the more I fight a single anti-pattern.
For your future self :
1. Use #terragrunt and not only #terraform / #opentofu ,
2. Centralize you #tf code in different modules in a single repository and have #tg use them ,
3. That one goes without saying but here it is : DRY your code using locals !I'm tired of removing hundred lines of #IaC code just for the sake of maintainability.
-
Two Flatcar VMs Fought Over An iSCSI LUN Because I Screwed Up
https://rant.mvh.dev/two-flatcar-vms-fought-over-an-iscsi-lun-because-i-screwed-up/
#selfhosted #selfhosting #pangolin #terraform #opentofu #truenas #flatcar #iscsi
-
@sharlatan you're evaluating Mitchell instead of whether a approach similar to vouch would be useful for guix.
fwiw - I made a minor contribution to terraform pre the BSL change..not happy about the license change, but atleast we have #opentofu
I don't think that Mitchel had decision making authority in the terraform BSL change (not in a leadership position when the decision was made afaik). I also am not familiar the his exit from hashicorp; perhaps you're a little hard on him here? 🤷♂️
-
@sharlatan you're evaluating Mitchell instead of whether a approach similar to vouch would be useful for guix.
fwiw - I made a minor contribution to terraform pre the BSL change..not happy about the license change, but atleast we have #opentofu
I don't think that Mitchel had decision making authority in the terraform BSL change (not in a leadership position when the decision was made afaik). I also am not familiar the his exit from hashicorp; perhaps you're a little hard on him here? 🤷♂️
-
Tak to wygląda w module w templatce #butane oraz wywoałeni w stacku środowiska w #terraform / #opentofu
-
Tak to wygląda w module w templatce #butane oraz wywoałeni w stacku środowiska w #terraform / #opentofu
-
Just discovered that #Terraform supports #Proxmox... might be a nice lil weekend project - importing my Proxmox config into Terraform lol. I feel like that makes more sense than smtg like #Ansible right?
---
edit: as per someone's rec, #OpenTofu may be a like-for-like better choice instead of Terraform -
Just discovered that #Terraform supports #Proxmox... might be a nice lil weekend project - importing my Proxmox config into Terraform lol. I feel like that makes more sense than smtg like #Ansible right?
---
edit: as per someone's rec, #OpenTofu may be a like-for-like better choice instead of Terraform -
Aujourd’hui je parle infra pure.
Je bosse sur OpenStack, je propose des contributions et j’ai besoin d’un environnement de test. Mon petit setup 𝗢𝗽𝗲𝗻𝗧𝗼𝗳𝘂 + 𝗞𝗼𝗹𝗹𝗮-𝗔𝗻𝘀𝗶𝗯𝗹𝗲 histoire d’avoir un lab reproductible en ~10 min me facilite la vie vous pouvez pas imaginer.
Le confort de pouvoir tout rebuild de zéro en une commande. 🐨🦊 -
#OpenTofu 1.12 is out!
This update isn’t a complete rewrite, but it does resolve some issues that infrastructure teams have faced for a while.
Find out more: https://bit.ly/3RY6AdU
-
#OpenTofu 1.12 is out!
This update isn’t a complete rewrite, but it does resolve some issues that infrastructure teams have faced for a while.
Find out more: https://bit.ly/3RY6AdU
-
OpenTofu continua a crescere come piattaforma Infrastructure as Code open source compatibile con Terraform. Nuove funzioni semplificano multi-cloud, sicurezza e gestione dei provider. #OpenTofu #Linux #DevOps #CloudComputing #Terraform #InfrastructureAsCode
-
OpenTofu continua a crescere come piattaforma Infrastructure as Code open source compatibile con Terraform. Nuove funzioni semplificano multi-cloud, sicurezza e gestione dei provider. #OpenTofu #Linux #DevOps #CloudComputing #Terraform #InfrastructureAsCode
-
أعلن OpenTofu عن إطلاق الإصدار 1.12.0، الذي يقدم تحسينات مهمة للمطورين. أصبح بإمكان وسيطة دورة الحياة `prevent_destroy` الآن الإشارة إلى المتغيرات داخل الوحدة نفسها، مما يتيح تكوينات أكثر ديناميكية وتخصيصًا للبيئة. كما تم تبسيط التعامل مع مجاميع التحقق للمزودين، حيث يقوم أمر `tofu init` بإضافة جميع الهاشات الضرورية تلقائيًا. بالإضافة إلى ذلك، تتيح خيار `-json-into` الجديد مخرجات متوازية بصيغتي JSON وواجهة المستخدم، مما يعزز سير عمل التكامل بفعالية.
-
OpenTofu 1.12 IaC tool adds dynamic prevent_destroy support, provider checksum improvements, faster installs, and CLI output updates.
https://linuxiac.com/opentofu-1-12-iac-tool-adds-dynamic-prevent_destroy-support/ -
OpenTofu 1.12 IaC tool adds dynamic prevent_destroy support, provider checksum improvements, faster installs, and CLI output updates.
https://linuxiac.com/opentofu-1-12-iac-tool-adds-dynamic-prevent_destroy-support/ -
Follow-up on #Forgejo vs #Gitea:
I read more about the split, and I'm still not sure.
I understand the governance concerns around Gitea, and Forgejo’s FOSS/community direction is very appealing.
But #Gitea supports #OpenTofu state, which I need, and I don't think "open source + paid hosting/support" is a bad model. Actually, it can be one of the healthier ways to fund development.
Maintainers should be paid. Good open-source tools need time, money, and boring long-term maintenance.
-
Finally moved my private repos to GitLab and migrated Terraform stuff to OpenTofu with GitLab CI/state.
Less tools around, less things to remember. Nice.
-
Yay!! 2k GitHub stars 🎉
Will celebrate with a new release 🤘
#Terraform #OpenTofu #Proxmox #bpg -
Yay!! 2k GitHub stars 🎉
Will celebrate with a new release 🤘
#Terraform #OpenTofu #Proxmox #bpg -
OpenTofu vs Terraform in 2026: the fork finally diverged
https://jorijn.com/en/blog/opentofu-vs-terraform-2026-the-fork-finally-diverged/
-
OpenTofu vs Terraform in 2026: the fork finally diverged
https://jorijn.com/en/blog/opentofu-vs-terraform-2026-the-fork-finally-diverged/
-
Well, that was weird. I was hired to help a client with build an internal #Kubernetes as-a-service solution, but ended up designing and deploying a new #PowerDNS setup for them instead. Client is happy. They managed to hire a full time employee to cover my spot, so it ends up being a short 3 month contract, which is done in one.
Coming out of a very convenient and comfortable series of contracts for a single client, totalling six years, this is very different. This is the first client who's mentioned #AI (and been rather excited about it) so I'm playing catch up and trying to establish my position on that. I'm guessing there will soon be a huge market for sensible adult contractors, ready to clean up after AI #slop spills. Time will tell.
Anyhoo, my network seems to have my back as usual, and I've got some interviews coming up in the following weeks. Trying to focus on gigs using Kubernetes, #Terraform, #OpenTofu and #Go, which means saying "no thanks" a lot. That's new for me.
#work -
Well, that was weird. I was hired to help a client with build an internal #Kubernetes as-a-service solution, but ended up designing and deploying a new #PowerDNS setup for them instead. Client is happy. They managed to hire a full time employee to cover my spot, so it ends up being a short 3 month contract, which is done in one.
Coming out of a very convenient and comfortable series of contracts for a single client, totalling six years, this is very different. This is the first client who's mentioned #AI (and been rather excited about it) so I'm playing catch up and trying to establish my position on that. I'm guessing there will soon be a huge market for sensible adult contractors, ready to clean up after AI #slop spills. Time will tell.
Anyhoo, my network seems to have my back as usual, and I've got some interviews coming up in the following weeks. Trying to focus on gigs using Kubernetes, #Terraform, #OpenTofu and #Go, which means saying "no thanks" a lot. That's new for me.
#work -
Let's continue the Proxmox + Tofu + Talos + Cilium adventure, with two little footnotes. "Devil is in the details!"
First: Talos "inlineManifests" behavior.
When you add some inlineManifests to your Talos MachineConfig and push that MachineConfig, the manifests get applied immediately. Yay!
However, when you update or remove some inlineManifests and push the MachineConfig ... Nothing happens. Talos does a full (potentially destructive!) reconcile only when executing a cluster upgrade. (This is pretty well explained in the Talos docs[1])
This means that our initial installation of CIlium will work immediately, but subsequent configuration changes won't work (the YAML won't be applied) until we run a "talosctl upgrade-k8s". (Pro-tip: make sure to specify "--to" with the current k8s version, otherwise it'll execute a "real" upgrade which implies downloading new images and restarting the whole control plane one component at a time - which takes a while.)
So, are we there yet?
Not quite!
The second issue: each time I'd do a "tofu plan", it would tell me that something had changed. Which is kind of annoying. If you don't change your Tofu configuration, variables, etc, normally, you'd expect "tofu plan" to tell you a reassuring:
No changes. Your infrastructure matches the configuration.
So, what is going on? 🤔
-
Let's continue the Proxmox + Tofu + Talos + Cilium adventure, with two little footnotes. "Devil is in the details!"
First: Talos "inlineManifests" behavior.
When you add some inlineManifests to your Talos MachineConfig and push that MachineConfig, the manifests get applied immediately. Yay!
However, when you update or remove some inlineManifests and push the MachineConfig ... Nothing happens. Talos does a full (potentially destructive!) reconcile only when executing a cluster upgrade. (This is pretty well explained in the Talos docs[1])
This means that our initial installation of CIlium will work immediately, but subsequent configuration changes won't work (the YAML won't be applied) until we run a "talosctl upgrade-k8s". (Pro-tip: make sure to specify "--to" with the current k8s version, otherwise it'll execute a "real" upgrade which implies downloading new images and restarting the whole control plane one component at a time - which takes a while.)
So, are we there yet?
Not quite!
The second issue: each time I'd do a "tofu plan", it would tell me that something had changed. Which is kind of annoying. If you don't change your Tofu configuration, variables, etc, normally, you'd expect "tofu plan" to tell you a reassuring:
No changes. Your infrastructure matches the configuration.
So, what is going on? 🤔
-
Also, I want the K8S cluster to support IPV6, which meant replacing Talos' default CNI (Flannel) with Cilium.
(OK, it might be possible to support IPv6 with Flannel on Talos, but the Talos docs say very little about how to customize Flannel, and I wanted Cilium for other reasons too - e.g. LoadBalancer support with L2 announcements, replacing kube-proxy...)
This means declaring "cni: none" in the Talos machine config, and then either:
1) manually installing Cilium after provisioning the cluster
2) finding a way to automatically install Cilium when the cluster is provisioned.
Of course I went for option 2, right :-)
Which leads us to a rabbit hole of multiple options:
1) wait for the cluster to be up (=K8S API is functional) and then use the Helm provider to create a helm_release resource on the cluster
Problem: there is no easy and clean way to wait for the cluster to be up.
Talos has a talos_cluster_health resource, but this one waits for all nodes to be "Ready", which isn't going to happen since the CNI hasn't been deployed yet. (There is a skip_kubernetes_checks option but it doesn't seem to help.)
Declaring something like a kubernetes_nodes resource in Tofu sort of works, ... until you reprovision the cluster. Then you realize that you can't even do a "tofu plan" because Tofu tries to refresh that resources' status, which requires the cluster to be up. So, this is a non-starter.
2) use Talos "inlineManifests" feature, which instructs talos to apply a bunch of YAML to the cluster when it's provisioned
Problem: this requires Cilium YAML manifests; and the way I install it is typically with the Helm chart.
Solution: use a helm_template data source to do the equivalent of the "helm template" command, and render the Cilium chart into ready-to-apply YAML manifests.
Next problem: the Cilium Helm chart is very sophisticated, and depends on Capabilities.KubeVersion - in other words, when we invoke the helm_template resource, we need to pass it the correct kube_version.
Next solution: that version is available in talos_machine_configuration resources.
And with that (and a good amount of Cilium configuration!) our cluster comes up fully functional!
-
Also, I want the K8S cluster to support IPV6, which meant replacing Talos' default CNI (Flannel) with Cilium.
(OK, it might be possible to support IPv6 with Flannel on Talos, but the Talos docs say very little about how to customize Flannel, and I wanted Cilium for other reasons too - e.g. LoadBalancer support with L2 announcements, replacing kube-proxy...)
This means declaring "cni: none" in the Talos machine config, and then either:
1) manually installing Cilium after provisioning the cluster
2) finding a way to automatically install Cilium when the cluster is provisioned.
Of course I went for option 2, right :-)
Which leads us to a rabbit hole of multiple options:
1) wait for the cluster to be up (=K8S API is functional) and then use the Helm provider to create a helm_release resource on the cluster
Problem: there is no easy and clean way to wait for the cluster to be up.
Talos has a talos_cluster_health resource, but this one waits for all nodes to be "Ready", which isn't going to happen since the CNI hasn't been deployed yet. (There is a skip_kubernetes_checks option but it doesn't seem to help.)
Declaring something like a kubernetes_nodes resource in Tofu sort of works, ... until you reprovision the cluster. Then you realize that you can't even do a "tofu plan" because Tofu tries to refresh that resources' status, which requires the cluster to be up. So, this is a non-starter.
2) use Talos "inlineManifests" feature, which instructs talos to apply a bunch of YAML to the cluster when it's provisioned
Problem: this requires Cilium YAML manifests; and the way I install it is typically with the Helm chart.
Solution: use a helm_template data source to do the equivalent of the "helm template" command, and render the Cilium chart into ready-to-apply YAML manifests.
Next problem: the Cilium Helm chart is very sophisticated, and depends on Capabilities.KubeVersion - in other words, when we invoke the helm_template resource, we need to pass it the correct kube_version.
Next solution: that version is available in talos_machine_configuration resources.
And with that (and a good amount of Cilium configuration!) our cluster comes up fully functional!
-
The whole thing is provisioned with Tofu; and one of my favorite things to do is to verify that the end-to-end provisioning works fine.
So that means a lot of "tofu destroy" + "tofu apply".
However, the TF configuration includes the Talos disk images used by the cluster, and I didn't want to re-download them every single time.
My first intention was to use "tofu taint" on the virtual machines. But they are declared in a for_each block; and you can't use "tofu taint" or "tofu plan -replace" on a for_each resource (unless you enumerate each resource individually).
However, you can do a targeted destroy:
tofu plan -destroy -target proxmox_virtual_environment_vm.k8s_nodes
And destroy will follow dependencies (if you destroy a resource, the resources that depend on it will automatically be destroyed), so in my case I could also do e.g.:
tofu plan -destroy -target talos_machine_secrets.this
(Because pretty much every Talos-related resource depends on this directly or indirectly).
#terraform #opentofu #talos #kubernetes #homelab #selfhosted
-
The whole thing is provisioned with Tofu; and one of my favorite things to do is to verify that the end-to-end provisioning works fine.
So that means a lot of "tofu destroy" + "tofu apply".
However, the TF configuration includes the Talos disk images used by the cluster, and I didn't want to re-download them every single time.
My first intention was to use "tofu taint" on the virtual machines. But they are declared in a for_each block; and you can't use "tofu taint" or "tofu plan -replace" on a for_each resource (unless you enumerate each resource individually).
However, you can do a targeted destroy:
tofu plan -destroy -target proxmox_virtual_environment_vm.k8s_nodes
And destroy will follow dependencies (if you destroy a resource, the resources that depend on it will automatically be destroyed), so in my case I could also do e.g.:
tofu plan -destroy -target talos_machine_secrets.this
(Because pretty much every Talos-related resource depends on this directly or indirectly).
#terraform #opentofu #talos #kubernetes #homelab #selfhosted
-
👋 Vous parlez OpenTofu en première ou deuxième langue ?
Je propose une mission DevOPS pour construire le Cloud de l'État, vous travaillez sur les couches d'accès (Réseau, Load Balancer, VPN, Pare-Feu, Proxy) à construire sur des offres IaaS.Plus d'infos ici :
https://docs.numerique.gouv.fr/docs/3d622786-6883-4701-9e87-4057be68f775/#OpenTofu #Terraform #DevOPS #Indep #Python
Merci pour les repouets !
-
👋 Vous parlez OpenTofu en première ou deuxième langue ?
Je propose une mission DevOPS pour construire le Cloud de l'État, vous travaillez sur les couches d'accès (Réseau, Load Balancer, VPN, Pare-Feu, Proxy) à construire sur des offres IaaS.Plus d'infos ici :
https://docs.numerique.gouv.fr/docs/3d622786-6883-4701-9e87-4057be68f775/#OpenTofu #Terraform #DevOPS #Indep #Python
Merci pour les repouets !
-
I'm looking at using #netbox as an IPAM for #proxmox and I'm sad to discover that the native integration is completely unfit for purpose. No way to specify VRF. Unable to handle nested prefixes.
Looking at #terraform (well, #opentofu) to do this instead as a proof of concept. And that's before I get to the CAPI part of treating #kubernetes clusters like the resources they should be.
-
I'm looking at using #netbox as an IPAM for #proxmox and I'm sad to discover that the native integration is completely unfit for purpose. No way to specify VRF. Unable to handle nested prefixes.
Looking at #terraform (well, #opentofu) to do this instead as a proof of concept. And that's before I get to the CAPI part of treating #kubernetes clusters like the resources they should be.
-
Next level in my Homelab: A storage cluster with linbit drbd. Should run on the same nodes as proxmox pve. And of course defined in some ansible scripts 🤣
Currently, this is still running on a test cluster that I set up using OpenTofu on top of the current pve cluster.
But there are still some "hickups"#homelab #linbit #drbd #proxmox #pve #ansible #OpenTofu #TerraForm