tf-debian-vm/main.tf

terraform {
  required_providers {
    libvirt = {
      source = "dmacvicar/libvirt"
    }
  }
}

locals {
  cloudinit_user_data = templatefile("${path.module}/files/cloud_init.cfg.tftpl", {
    name                  = var.name,
    admin_authorized_keys = var.admin_authorized_keys,
    insecure_password     = var.insecure_password,
    use_host_cert         = var.use_host_cert,
    host_cert             = trimspace(null_resource.cert.triggers["cert"]),
    private_key           = tls_private_key.debian.private_key_openssh,
    data_disk             = var.data_disk != null
    fixed_dns             = var.fixed_dns
    add_data_share        = var.add_data_share
  })
  cloudinit_network_config = templatefile("${path.module}/files/network_config.cfg.tftpl", {
    fixed_address = var.fixed_address
  })
  domain_name = coalesce(var.domain_name, var.name)
}

resource "tls_private_key" "debian" {
  algorithm = "ED25519"
}

data "tls_public_key" "debian" {
  private_key_pem = tls_private_key.debian.private_key_pem
}

data "external" "cert" {
  program = ["bash", "${path.module}/files/get_cert.sh"]

  query = {
    pubkey   = trimspace(data.tls_public_key.debian.public_key_openssh)
    host     = var.name
    cahost   = var.ca_host
    cascript = var.ca_script
    cakey    = var.ca_key
  }
}

resource "null_resource" "cert" {
  triggers = {
    cert = data.external.cert.result["cert"]
  }

  lifecycle {
    ignore_changes = [
      triggers
    ]

    postcondition {
      condition     = data.external.cert.result["cert"] != "" || !var.use_host_cert
      error_message = "Error retrieving host certificate."
    }
  }
}

resource "libvirt_volume" "debian" {
  name             = "${local.domain_name}.iso"
  pool             = var.disk_pool
  size             = var.disk_size
  base_volume_name = var.disk_base
  base_volume_pool = var.disk_base_pool

  lifecycle {
    replace_triggered_by = [
      libvirt_cloudinit_disk.debian.id
    ]
  }
}

resource "libvirt_cloudinit_disk" "debian" {
  name           = "${local.domain_name}.iso"
  pool           = var.cloudinit_pool
  user_data      = local.cloudinit_user_data
  network_config = local.cloudinit_network_config
}

resource "null_resource" "data_share" {
  connection {
    type = "ssh"
    user = "root"
    host = "atlas.hyp"
  }

  provisioner "remote-exec" {
    inline = [
      "${var.add_data_share} && mkdir -p --mode=og=rwx /data/${local.domain_name}"
    ]
  }
}

resource "libvirt_domain" "debian" {
  name      = local.domain_name
  memory    = var.memory
  vcpu      = 4
  autostart = true

  disk {
    volume_id = libvirt_volume.debian.id
  }

  dynamic "disk" {
    for_each = var.data_disk != null ? [1] : []

    content {
      volume_id = var.data_disk
    }
  }

  dynamic "filesystem" {
    for_each = var.add_data_share ? [1] : []

    content {
      source   = "/data/${local.domain_name}"
      target   = "data"
      readonly = false
    }
  }

  network_interface {
    bridge   = var.bridge_name
    hostname = var.name
    mac      = var.mac
  }

  cloudinit = libvirt_cloudinit_disk.debian.id

  provisioner "local-exec" {
    command = var.ansible_command
  }

  lifecycle {
    replace_triggered_by = [
      libvirt_cloudinit_disk.debian.id
    ]
  }

  depends_on = [
    null_resource.data_share
  ]
}