Raw Proxmox Deployment¶

Raw Proxmox support is the lower-level path for operators who do not use Ludus or who want full control over VM templates, networks, and routing.

Intended Shape¶

Proxmox creates the VM topology.
OpenTofu/Terraform-style templates define VM names, CPUs, memory, cloud-init, and networks.
Ansible configures the software stack after VM creation.
AIT still runs through public CLIs and artifacts.

R3 Pack¶

The raw pack lives under lab/range/proxmox/.

lab/range/proxmox/
  README.md
  opentofu/
    main.tf.example
    variables.tf.example
    tofu.tfvars.example
    terraform.tfvars.example
    profiles/
      compact.tfvars.example
      standard.tfvars.example
      full-split.tfvars.example
  scripts/
    render_inventory.py
    tofu_plan.sh
    tofu_apply.sh
    tofu_destroy.sh

Plan-Only Workflow¶

PROFILE=standard lab/range/proxmox/scripts/tofu_plan.sh

The plan script copies the example HCL, selects the requested profile tfvars, runs init, fmt, validate, and plan, then stops before any Proxmox changes are made.

Deployment Workflow¶

Copy a profile into a local tofu.tfvars, add real Proxmox credentials, review the plan, then apply.

cd lab/range/proxmox/opentofu
cp profiles/standard.tfvars.example tofu.tfvars
$EDITOR tofu.tfvars
tofu init
tofu plan -var-file=tofu.tfvars
tofu apply -var-file=tofu.tfvars

Or use the wrapper after editing tofu.tfvars:

lab/range/proxmox/scripts/tofu_apply.sh

Destroy is explicit:

lab/range/proxmox/scripts/tofu_destroy.sh

Inventory¶

Generate an Ansible inventory matching the selected profile:

lab/range/proxmox/scripts/render_inventory.py \
  --profile standard \
  --out lab/range/ansible/inventory.standard.generated.ini

Use that inventory with the shared Ansible roles after VMs are reachable.

Profiles¶

compact: operator VM plus one combined target VM.
standard: operator, support/planner, services, and privileged sink.
full-split: one VM per role plus optional intercept placement.

Ludus remains the recommended professional path. Raw Proxmox is for homelab and custom infrastructure operators who want direct OpenTofu control.