From dc4ade7ed1cd27476253d485014c1521c54dbb75 Mon Sep 17 00:00:00 2001
From: bob <robby.wilcox@gmail.com>
Date: Fri, 10 Apr 2026 21:31:58 -0500
Subject: [PATCH] refactor(provider): switch auth from password to API token
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Prefer API token over username/password — scoped to least-privilege
TerraformRole, reduces blast radius if credentials leak.
---
 .terraform.lock.hcl      | 24 ++++++++++++++++++++++++
 CLAUDE.md                | 35 +++++++++++++++++++++++++++++++++++
 main.tf                  |  3 +--
 terraform.tfvars.example |  5 ++---
 variables.tf             |  9 ++-------
 5 files changed, 64 insertions(+), 12 deletions(-)
 create mode 100644 .terraform.lock.hcl
 create mode 100644 CLAUDE.md

diff --git a/.terraform.lock.hcl b/.terraform.lock.hcl
new file mode 100644
index 0000000..d584d45
--- /dev/null
+++ b/.terraform.lock.hcl
@@ -0,0 +1,24 @@
+# This file is maintained automatically by "terraform init".
+# Manual edits may be lost in future updates.
+
+provider "registry.terraform.io/bpg/proxmox" {
+  version     = "0.101.1"
+  constraints = "~> 0.73"
+  hashes = [
+    "h1:2MjGiI3uWXkZXOvoLNYq3Mji/cnJCugdzcZAdmYZ4JI=",
+    "zh:0b2f899c59727b9d5ebc6324944653172e7d4f27fae2670dc10fb717f0dc085a",
+    "zh:0dfb5f212aef8d5b9372ba89fe08c2404311dc7842d216585f55cae4634e1aa6",
+    "zh:430c1096c801f615932d8e5ceba5cf1c46fb19c602733b12537292f0379d9875",
+    "zh:6b2de9a0cfe3939372bb1c4115be81a8f470b2f1f27ff4a47e92bbc1cd16308e",
+    "zh:6e32494c0e46754946e481473189bd14e9982fb4ab25938d9d8b7125f85ed09b",
+    "zh:98f847d3b67e551443cb81f96e59cb320f3a5c4bf45ac4a7194eb395f950774d",
+    "zh:a55dc4a1cdee600a867205cae89c57b36184f63d1fdf16945854ed2a5098012f",
+    "zh:a80b4777d9cb3c2fd545ecaa0d0f8315363b1a50801638c2866701c50b097710",
+    "zh:b0512be4d006abcbf91f2a8784ebc11055d3890bc119cf221373b6e820bc9cbb",
+    "zh:c0207c88fa879aac82a624b10099bfd31b7760ece82fa60fe943e65cc1e7add7",
+    "zh:c6e722112a1cee87ee621e7dec1cb9a8d2a64ba71d7ae021e1e9456dfb6584d8",
+    "zh:e0bbca20173fe9051f53b7c211cc5f52552a3c8fe766aca34b7b1880d57a5ec7",
+    "zh:f26e0763dbe6a6b2195c94b44696f2110f7f55433dc142839be16b9697fa5597",
+    "zh:f5d7b772797b17fd61d199136e98281b5ca2472732cd97703a28b288cd6eefa4",
+  ]
+}
diff --git a/CLAUDE.md b/CLAUDE.md
new file mode 100644
index 0000000..f6f485d
--- /dev/null
+++ b/CLAUDE.md
@@ -0,0 +1,35 @@
+# Project: ProxmoxInfra
+
+Terraform infrastructure-as-code for a homelab Proxmox environment.
+
+## Context
+
+This repo was started *after* the Proxmox server was already set up manually.
+Existing infrastructure was provisioned by hand and must not be touched by
+Terraform. Only new resources going forward are managed here.
+
+## Key rules for this project
+
+- **Never import or manage existing Proxmox resources** unless the junior
+  explicitly decides to and understands the risk of state drift.
+- **Credentials never go in version control.** `.tfvars` files are gitignored.
+  Always use `terraform.tfvars.example` as the template pattern.
+- **No resources in root module.** As the repo grows, push toward a
+  `environments/` layout with reusable modules under `modules/`.
+- **State is not yet remote.** When a backend is introduced, make it a
+  deliberate decision with a knowledge transfer on why remote state matters
+  (locking, team access, DR).
+
+## Stack
+
+- Provider: `bpg/proxmox` (not the deprecated Telmate provider)
+- Terraform >= 1.0
+- Target: single-node Proxmox VE homelab
+
+## Learning goals for this project
+
+- Understand Terraform's core workflow (init / plan / apply / destroy)
+- Understand provider authentication and least-privilege API tokens
+- Understand state — what it is, why it matters, what happens when it drifts
+- Build intuition for when to use a VM vs an LXC container in Proxmox
+- Learn to structure a Terraform repo that can scale without becoming a mess
diff --git a/main.tf b/main.tf
index f990117..4925ac5 100644
--- a/main.tf
+++ b/main.tf
@@ -11,8 +11,7 @@ terraform {
 
 provider "proxmox" {
   endpoint = var.proxmox_endpoint
-  username = var.proxmox_username
-  password = var.proxmox_password
+  api_token = var.proxmox_api_token
 
   # Set to true if using a self-signed certificate (common on home labs)
   insecure = var.proxmox_insecure
diff --git a/terraform.tfvars.example b/terraform.tfvars.example
index 57efa2c..36a0c94 100644
--- a/terraform.tfvars.example
+++ b/terraform.tfvars.example
@@ -2,6 +2,5 @@
 # terraform.tfvars is gitignored to keep secrets out of version control.
 
 proxmox_endpoint = "https://192.168.1.10:8006/"
-proxmox_username = "terraform@pve"
-proxmox_password = "changeme"
-proxmox_insecure = true
+proxmox_api_token = "terraform@pve!terraform-nonprod=<secret>"
+proxmox_insecure = true
\ No newline at end of file
diff --git a/variables.tf b/variables.tf
index bb857a0..4757e1d 100644
--- a/variables.tf
+++ b/variables.tf
@@ -3,13 +3,8 @@ variable "proxmox_endpoint" {
   type        = string
 }
 
-variable "proxmox_username" {
-  description = "Proxmox user in the form user@realm, e.g. terraform@pve"
-  type        = string
-}
-
-variable "proxmox_password" {
-  description = "Password for the Proxmox user"
+variable "proxmox_api_token" {
+  description = "Proxmox API token in the form user@realm!token-id=secret, e.g. terraform@pve!api-token-name=<SECRET>"
   type        = string
   sensitive   = true
 }