gitea (LXC 114), the woodpecker server (231) and the woodpecker agents
(910/911) were migrated into the cluster (Phase 2: Service flipped
ExternalName -> ClusterIP, now in-cluster StatefulSets/Deployment; see
kubernetes/apps/MIGRATION-gitea-woodpecker.md) and the Proxmox guests
decommissioned -- but their OpenTofu declarations were left behind with
onboot/start = true. An unscoped `tofu apply` (deploy-infrastructure.yml)
would attempt to recreate the retired stack, and backup_jobs.tf still
advertised the dead VMIDs as PBS-protected.
- delete opentofu/woodpecker_agents.tf, lxc_231_woodpecker.tf,
lxc_114_gitea_srv_renner_uno.tf
- drop VMIDs 114/231 and the 910.. agent loop from backup_jobs.tf
- remove the now-orphaned woodpecker_agents local + woodpecker_agent_count
variable (only those files referenced them)
- delete the dead .woodpecker/deploy-woodpecker-agent.yml and
install-woodpecker-server.yml pipelines (their ansible plays/roles no
longer exist)
REQUIRES `tofu state rm` of the four module resources BEFORE this merges
/ any apply runs, otherwise the plan destroy-plans them. See PR body.
Refs #199
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
RustFS was retired 2026-05-09 (per the comment in
opentofu-bootstrap/rustfs.tf). The S3 endpoint at s3.renner.uno:9000
has been unreachable since then, but a lot of references in code
remained — health checks pinged a dead endpoint, alerts fired
permanently, and the ansible role + playbook + tofu locals would have
broken the next time anyone tried to use them. Cleaning up:
DELETED (pure RustFS, no other consumers):
- opentofu/rustfs.tf.disabled
- opentofu/providers.tf.backup
- ansible/inventory/group_vars/proxmox_rustfs.yml
- ansible/plays/install-rustfs.yml
- ansible/plays/archived/migrate-rustfs-storage.yml
- ansible/roles/rustfs/ (whole role)
EDITED (RustFS sections removed):
- opentofu/variables.tf: drop rustfs_count
- opentofu/locals.tf: drop rustfs_instances local
- opentofu/backup_jobs.tf: drop the rustfs_count VMID-range
- kubernetes/apps/gatus/configmap.yaml: drop the dead s3.renner.uno
health check
- ansible/roles/gatus/templates/config.yaml.j2: same removal in the
ansible-managed gatus template
- ansible/roles/prometheus-server/templates/alert-rules.yml.j2:
drop the RustFSUnhealthy alert
- ansible/roles/grafana-observability/templates/alert-rules.yaml.j2:
drop the rustfs-unhealthy alert
- ansible/plays/check-chaos-testing.yml: drop the RustFS test block
and the rustfs_vip var
NOT TOUCHED (caddy-ha retirement scope, separate cleanup):
- ansible/roles/caddy-ha/defaults/main.yml (still has
caddy_ha_s3_endpoint = "s3.renner.uno:9000")
- ansible/plays/install-crowdsec-caddy.yml (still loads
vars/rustfs_vault.yml)
- ansible/plays/vars/rustfs_vault.yml (loaded by the play above)
- scripts/restore-authentik-db.sh (manual one-off restore script
that still references s3.renner.uno)
- opentofu-bootstrap/{rustfs.tf,variables.tf} (separate tofu
project with local state; cleanup needs manual apply)
The Woodpecker secrets tf_rfs_access and tf_rfs_secret are no longer
consumed by anything in the repo and can be removed manually from the
Woodpecker UI when convenient.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
After the previous commit removed the aws_s3_bucket.{tfstate,migration,
caddy_certificates} resources, nothing in the .tf code references the
AWS provider that pointed at the decommissioned RustFS endpoint
(http://s3.renner.uno:9000). Removing the now-dead config:
- providers.tf: drop required_providers.aws and the provider "aws"
block (with the http://s3.renner.uno:9000 endpoint).
- variables.tf: drop aws_provider_access_key and aws_provider_secret_key
(only consumed by the removed provider block).
- .woodpecker/deploy-infrastructure.yml: drop the corresponding
TF_VAR_aws_provider_* env entries from both plan and apply steps
(sourced from tf_rfs_access/tf_rfs_secret secrets — those Woodpecker
secrets can be removed manually if unused elsewhere).
Backend "s3" config in providers.tf stays — it talks to the NAS-hosted
Garage instance (s3.nas-1.renner.uno) via AWS_ACCESS_KEY_ID/SECRET env
vars from tf_garage_* secrets, which is separate from the dead RustFS
provider being removed here.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Phase 4's cutover to Garage made backend + aws-provider share the
same AWS_ACCESS_KEY_ID env var, which now points at Garage. The aws
provider talks to RustFS (still — for caddy_certificates / migration /
tfstate buckets), and Garage credentials don't authenticate against
RustFS, so plan 794 regressed: refresh of the three aws_s3_bucket
resources returned "doesn't exist" → plan proposed to recreate them.
Give the aws provider explicit credentials via two new TF_VARs sourced
from the still-existing tf_rfs_* Woodpecker secrets. Backend keeps the
env-var path with Garage creds; aws provider gets RustFS creds via
TF_VAR. No state shape change.
This is a transitional separation. When RustFS is fully decommissioned,
the aws provider's endpoint also moves to Garage and the two cred
sources can collapse back together.
The MinIO IAM provider doesn't persist users reliably. Use manually
created credentials instead — stable across rebuilds.
Remove aminueza/minio provider, IAM resources, and credential output.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Use tf_rfs_access/tf_rfs_secret (already in CI secrets) instead of
adding new MinIO-specific secrets. No new env variables needed.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
The provider needs SSH access for qm importdisk. Pass the CI SSH key
as a tofu variable instead of reading from file (file doesn't exist
during plan step).
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Removed after migration to Woodpecker CI:
- Deleted runners.tf module
- Removed gitea_runners local definition
- Removed gitea_runner_count variable
- Cleaned up test trigger comments
The Gitea runner LXC containers (905, 906) will be destroyed
when apply is triggered manually in Woodpecker CI.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude <noreply@anthropic.com>
- Moved VM definitions for netboot, fortress, homeassistant, bind1, uptime_kuma, influxdb, grafana, mosquitto, paperless, homeassistant_dev, netbox, cdns, ntp, kasm, dev, and ubuntu template to new resource names for better readability.
- Updated VM configurations with appropriate settings including memory, CPU, disks, and network configurations.
- Ensured all VMs have consistent lifecycle management and SSH key configurations.
- Adjusted boot orders and other parameters to align with operational requirements.
claude-botandClaude Opus 4.8
k.rennerandClaude Opus 4.7