# ----- Infisical Variables: Begin ----- #

/*
Infisical will inject authentication variables into environment
    - PROXMOX_VE_API_TOKEN : terraform/bpg provider automatically discovers this environment variables
        - Unprotected GitLab runner won't have access to Infisical
        - So, we'll set them as empty environment variables in the pipeline configuration
*/

variable "ssh_public_key" {
  # Injected by Infisical as "TF_VAR_ssh_public_key"
  type        = string
  description = "Terraform adds this SSH key for the user defined in TF_VAR_ssh_username"
  default     = ""
}
variable "ssh_username" {
  # Injected by Infisical as "TF_VAR_ssh_username"
  type        = string
  description = "Terraform adds this SSH user, and will login with private key matching TF_VAR_ssh_public_key"
  default     = ""
}

# ----- Infisical Variables: End ----- #

/* Local Variables: Begin
.-----------------------------------------------.
| Locally Sourced Variables: *.auto.pkrvars.hcl |
|     We can commit these to Git, cause         |
|     there are no protected variables          |
'-----------------------------------------------'
*/

# Proxmox Environment
variable "proxmox_node_domain" {
  type    = string
  default = ".lab.home.internal"
}

# Source Template
variable "template_source_node" {
  type        = string
  description = "The name of the Proxmox VE node that holds the source template"
  default     = "pve"
}
variable "template_vm_id" {
  type        = number
  description = "The numerical ID of the VM template in Proxmox VE from which to clone"
  default     = null
}

# New VM General
variable "target_deploy_node" {
  type        = string
  description = "The Proxmox VE node to deploy the new VM on"
  default     = "pve"
}
variable "target_disk_storage_pool" {
  # Defaults to "local-lvm", which would match a default Proxmox VE installation
  # Doing it this way because I do not have shared storage (e.g. ceph, NFS)
  type        = string
  description = "The name of the VM disk storage pool on the target PVE node"
  default     = "local-lvm"
}
variable "vm_id" {
  type        = number
  description = "The numerical ID of the new VM in Proxmox VE. When 'null' Proxmox VE auto-assigns next available."
  default     = null
}
variable "vm_name" {
  type        = string
  description = "The name to give to the new VM"
}
variable "vm_description" {
  type        = string
  description = "Describe the general purpose of the VM"
  default     = "Linux VM deployed by Terraform. Use Ansible to configure."
}
variable "vm_tags" {
  type        = list(string)
  description = "Comma-separated strings in list notation"
  default     = ["terraform-deployed", "cloud-init"]
}
variable "resource_pool" {
  type        = string
  description = "The resource pool in Proxmox VE logical grouping of units"
  default     = ""
}
variable "is_full_clone" {
  type        = bool
  description = "Set 'true' for full clone, 'false' for linked clone"
}
variable "start_at_boot" {
  type        = bool
  description = "Set to 'true' to boot the VM when Proxmox starts up."
  default     = true
}

# New VM Hardware
# Guest Agent
variable "guest_agent_enabled" {
  type        = bool
  description = "Set to true or false, indicating if the QEMU guest agent has been installed and activated on the VM"
  default     = false
}
variable "prefer_ipv4" {
  type        = bool
  description = "Set to true if you want to prefer waiting for IPv4 address allocation"
  default     = false
}
variable "prefer_ipv6" {
  type        = bool
  description = "Set to true if you want to prefer waiting for IPv6 address allocation"
  default     = false
}
# CPU
variable "cpu_type" {
  type        = string
  description = "Defaults to the value when creating VMs in the UI."
  default     = "x86-64-v2-AES"
}
variable "cpu_cores" {
  type    = number
  default = 2
}
variable "cpu_sockets" {
  type    = number
  default = 1
}
# Memory
variable "memory_min" {
  type    = number
  default = 2048
}
variable "memory_max" {
  type    = number
  default = 2048
}
# Disk
variable "storage_controller" {
  type        = string
  description = "Matches the default used with builds in Packer"
  default     = "virtio-scsi-pci"
}
variable "disk_interface" {
  type    = string
  default = "scsi"
}
variable "disk_size_gb" {
  type        = number
  description = "cloud-init will automatically grow the disk to match if larger than Packer template"
  default     = 40
}
variable "disk_file_format" {
  type        = string
  description = "ZFS: 'raw' ; local-lvm: 'qcow2'"
  default     = "qcow2"
}
# Networking
variable "switch_name" {
  type        = string
  description = "The virtual switch in Proxmox VE"
  default     = "vmbr0"
}
variable "nic_driver" {
  type    = string
  default = "virtio"
}
variable "vlan_tag" {
  type    = number
  default = null
}
# Cloud-Init
variable "cloud_init_domain" {
  type        = string
  description = "The domain to use when populating the VM's cloud-init settings"
  default     = null
}
variable "clout_init_dns_servers" {
  type        = list(any)
  description = "The DNS server to use when populating the VM's cloud-init settings"
  default     = null
}

# Proxmox Environment
proxmox_node_domain = "lab.home.internal"

# Source Template
template_source_node = "proxmox" # proxmox is the hostname in my network
template_vm_id       = 10001

# New VM General
target_deploy_node       = "proxmox-hx90" # proxmox is the hostname in my network
target_disk_storage_pool = "Guest_Disks"
vm_id                    = 5000 # 5000 -- 5999 for Terraform deploys
vm_name                  = "debian-13-tf"
vm_description           = "Debian 13 VM deployed and managed by Terraform"
vm_tags                  = ["terraform-deployed", "cloud-init", "ansible-target"]
resource_pool            = "terraform-managed" # The resource pool as created in initial user / group script
is_full_clone            = true
start_at_boot            = true

# New VM Hardware
# Guest Agent
guest_agent_enabled = true
prefer_ipv4         = true
prefer_ipv6         = false
# CPU
cpu_type    = "x86-64-v2-AES"
cpu_cores   = 4
cpu_sockets = 1
memory_max  = 4096
memory_min  = 4096
# Disk
storage_controller = "virtio-scsi-pci"
disk_interface     = "scsi"
disk_size_gb       = 64
disk_file_format   = "raw"
# Networking
switch_name = "vmbr0"
nic_driver  = "virtio"
vlan_tag    = 302 # You can delete this variable if not using VLANs
# Cloud-Init
cloud_init_domain      = "lab.home.internal" # Set according to the new VM's VLAN
clout_init_dns_servers = ["10.0.32.1"]

data "proxmox_vm" "debian_13_vm_template" {
  /*
  - https://registry.terraform.io/providers/bpg/proxmox/latest/docs/data-sources/vm
  - Perform a lookup of the Packer template on the target PVE node
  - Store the data about the VM in memory, so we can reference information about it
  - See down in the "tags" property and "clone {}" section on how we're using the properties 
      - ".id"
      - ".node_name"
      - ".tags" 
    as reference points for cloning
  */
  node_name = var.template_source_node
  id        = var.template_vm_id
}

resource "proxmox_virtual_environment_vm" "debian_13_vm_clone" {
  # https://registry.terraform.io/providers/bpg/proxmox/latest/docs/resources/virtual_environment_vm
  # New VM General
  # vm_id       = var.vm_id # Environment uses random_vm_ids, uncomment if you want to set a static ID
  name        = var.vm_name
  description = var.vm_description
  node_name   = var.target_deploy_node
  on_boot     = var.start_at_boot
  # Uses the concat() function to use the tags from the packer template AND our local variable
  tags = concat(
    tolist(data.proxmox_vm.debian_13_vm_template.tags),
    tolist(var.vm_tags)
  )
  pool_id = var.resource_pool

  agent {
    enabled = var.guest_agent_enabled
    wait_for_ip {
      ipv4 = var.prefer_ipv4
      ipv6 = var.prefer_ipv6
    }
  }

  # Hardware Overrides (Overrides what was set in Packer if needed)
  cpu {
    sockets = var.cpu_sockets
    cores   = var.cpu_cores
    type    = var.cpu_type
  }

  memory {
    dedicated = var.memory_max
    floating  = var.memory_min
  }

  disk {
    datastore_id = var.target_disk_storage_pool
    file_format  = var.disk_file_format
    interface    = "${var.disk_interface}0" # e.g. scsi0
    size         = var.disk_size_gb
  }

  network_device {
    bridge   = var.switch_name
    model    = var.nic_driver
    vlan_id  = var.vlan_tag
    firewall = false
  }

  # Cloud-Init Configuration (Matches 'cloud_init = true' in Packer)
  # This injects the hostname, SSH keys, and static IP into the cloned VM
  initialization {
    datastore_id = var.target_disk_storage_pool
    ip_config {
      ipv4 {
        address = "dhcp"
      }
    }
    dns {
      domain  = var.cloud_init_domain
      servers = var.clout_init_dns_servers
    }
    user_account {
      username = var.ssh_username
      keys     = [var.ssh_public_key]
    }
  }

  # This clone block is used when cloning between two distinct nodes
  # Comment this "clone {}"" block out if clone will be on the same node as the source
  clone {
    # Uses the ".id" property from the template data source to indicate the VM ID to clone from
    # Uses the ".node_name" property from the template data source to indicate which node to clone from
    # "datastore_id" is the storage pool on the target PVE node
    vm_id        = data.proxmox_vm.debian_13_vm_template.id
    node_name    = data.proxmox_vm.debian_13_vm_template.node_name
    datastore_id = var.target_disk_storage_pool
    full         = var.is_full_clone
  }

  /* Uncomment this "clone {}" block if clone will be on the same node as the source
  # This clone block is used when the cloned VM will be on the same node as the source
  clone {
    # Omits "node_name" because source and target nodes are the same
    vm_id = data.proxmox_vm.debian_13_vm_template.id
    full  = var.is_full_clone
  }
  */
}

# Make an API call with the API token to reboot the VM when the name changes
# This ensures the hostname is always right in Dynamic DNS
resource "null_resource" "vm_reboot" {
  triggers = {
    vm_name = proxmox_virtual_environment_vm.debian_13_vm_clone.name
  }

  provisioner "local-exec" {
    command     = <<-EOT
      curl -X POST \
        https://${var.template_source_node}.${var.proxmox_node_domain}:8006/api2/json/nodes/${var.target_deploy_node}/qemu/${proxmox_virtual_environment_vm.debian_13_vm_clone.vm_id}/status/reboot \
        -H "Authorization: PVEAPIToken=$PROXMOX_VE_API_TOKEN" \
        --insecure \
        --silent \
        --fail
    EOT
    interpreter = ["bash", "-c"]
  }
}

# Will use this in the GitLab CI/CD pipeline to dynamically retrieve the VM FQDN 
output "vm_fqdn" {
  description = "The fully qualified domain name of the provisioned VM"
  value       = "${proxmox_virtual_environment_vm.debian_13_vm_clone.name}.${proxmox_virtual_environment_vm.debian_13_vm_clone.initialization[0].dns[0].domain}"
}

# Hidden job for re-usable 'terraform init' command
# TF_ROOT and TF_STATE_NAME passed in from calling jobs
# convert_report alias formats the JSON document for GitLab Terraform widget
# https://docs.gitlab.com/user/infrastructure/iac/mr_integration/
.tf-init:
  image: $TERRAFORM_IMAGE
  before_script:
    - export TF_HTTP_ADDRESS="${STATE_BASE_URL}/${TF_STATE_NAME}"
    - export TF_HTTP_LOCK_ADDRESS="${TF_HTTP_ADDRESS}/lock"
    - export TF_HTTP_UNLOCK_ADDRESS="${TF_HTTP_ADDRESS}/lock"
    - cd "${TF_ROOT}" && terraform init
    - shopt -s expand_aliases # Allow bash shell to expand aliases
    - alias convert_report="jq -r '([.resource_changes[]?.change.actions?]|flatten)|{\"create\":(map(select(.==\"create\"))|length),\"update\":(map(select(.==\"update\"))|length),\"delete\":(map(select(.==\"delete\"))|length)}'"

.tf-validate:
  extends: .tf-init # Pull docker image, cd working directory, terraform init
  stage: lint
  tags: [lint] # Triggers unprotected runner
  script:
    - terraform fmt -check -recursive
    - terraform validate . # Backend configured by .tf-init
  rules:
    # Triggers job when merge request created
    # But only if code changed inside the working directory
    # Automatically runs
    - if: $CI_PIPELINE_SOURCE == "merge_request_event" 
      changes:
        - "${TF_ROOT}/**/*"
    # Triggers job any time code is commited to default branch
    # But only if code changed inside the working directory
    # Automatically runs
    - if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH      
      changes:
        - "${TF_ROOT}/**/*"
    # Job automatically runs on manual web trigger
    # Automatically runs
    - if: $CI_PIPELINE_SOURCE == "web"

.tf-plan:
  interruptible: true
  extends: .tf-init # Pull docker image, cd working directory, terraform init
  stage: plan
  tags: [validate] # Triggers unprotected runner
  variables:
    TF_STATE_NAME: "${RESOURCE_NAME}-prod"
  script:
    # Script block uses CI/CD masked variables for Infisical universal auth
    - |
      set -e
      INFISICAL_ACCESS_TOKEN=$(infisical login \
        --domain="https://secrets.lab.home.internal" \
        --method="universal-auth" \
        --client-id="${UR_INFISICAL_MACHINE_ID}" \
        --client-secret="${UR_INFISICAL_CLIENT_SECRET}" \
        --silent \
        --plain)

      echo "Importing the following secrets from prod"
      echo "  TF_VAR_ssh_public_key"
      echo "  TF_VAR_ssh_username"
      eval $(infisical export \
        --domain="https://secrets.lab.home.internal" \
        --token="${INFISICAL_ACCESS_TOKEN}" \
        --projectId="${UR_INFISICAL_PROJECT_ID}" \
        --env=prod \
        --path="/terraform/pve" \
        --format=dotenv-export \
        --silent)

      echo "Importing the read-only PVE API key from staging"
      eval $(infisical export \
        --domain="https://secrets.lab.home.internal" \
        --token="${INFISICAL_ACCESS_TOKEN}" \
        --projectId="${UR_INFISICAL_PROJECT_ID}" \
        --env=staging \
        --path="/terraform/pve" \
        --format=dotenv-export \
        --silent)
    - terraform plan -out "${CI_PROJECT_DIR}/${TF_STATE_NAME}.tfplan"
    - terraform show -json "${CI_PROJECT_DIR}/${TF_STATE_NAME}.tfplan" | convert_report > "${CI_PROJECT_DIR}/plan.json"
  rules:
    # Triggers job when merge request created
    # But only if code changed inside the working directory
    # Automatically runs
    - if: $CI_PIPELINE_SOURCE == "merge_request_event" 
      changes:
        - "${TF_ROOT}/**/*"
    # Triggers job any time code is commited to default branch
    # But only if code changed inside the working directory
    # Automatically runs
    - if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH      
      changes:
        - "${TF_ROOT}/**/*"
    # Job automatically runs on manual web trigger
    # Automatically runs
    - if: $CI_PIPELINE_SOURCE == "web"
  artifacts:
    name: "${TF_STATE_NAME}-plan"
    paths:
      - "${TF_STATE_NAME}.tfplan" # Make the plan file available for the next job
      - "plan.json" # Make the 'plan.json' artifact available for GitLab Terraform widget
    reports:
      terraform: "plan.json" # Output report artifact to show in GitLab UI
    expire_in: 7 days

.tf-apply:
  extends:
    - .infisical-auth
    - .tf-init
  before_script:
    - !reference [.infisical-auth, before_script]
    - !reference [.tf-init, before_script]
  tags: [terraform] # Triggers the protected runner
  stage: apply
  variables:
    TF_STATE_NAME: "${RESOURCE_NAME}-prod"
    INFISICAL_SECRET_PATH: "/terraform/pve" # Pull prod secrets using Infisial OIDC
  script:
    - terraform apply "${CI_PROJECT_DIR}/${TF_STATE_NAME}.tfplan"
    - terraform output -raw vm_fqdn > "${CI_PROJECT_DIR}/${RESOURCE_NAME}-hostnames.txt" # Output a list of hostnames for SSH test login
  rules:
    # Triggers job any time code is commited to default branch
    # But only if code changed inside the working directory
    # User must trigger the job
    - if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH
      changes:
        - "${TF_ROOT}/**/*"
      when: manual
    # Job automatically runs on manual web trigger
    # User must trigger the job
    - if: $CI_PIPELINE_SOURCE == "web"
      when: manual
  artifacts:
    name: "${TF_STATE_NAME}-hosts"
    paths:
      - "${RESOURCE_NAME}-hostnames.txt" # Make the list of hostnames available to the next job
    expire_in: 1 day

.test-ssh:
  extends:
    - .infisical-auth
    - .tf-init
  before_script:
    - !reference [.infisical-auth, before_script]
    - !reference [.tf-init, before_script]
  tags: [terraform] # Triggers the protected runner
  stage: verify
  variables:
    TF_STATE_NAME: "${RESOURCE_NAME}-prod"
    INFISICAL_SECRET_PATH: "/terraform/pve" # Pull prod secrets using Infisial OIDC
  script:
    - |
      echo "========================================================"
      echo " Phase 1: Environment Setup"
      echo "========================================================"
      eval $(ssh-agent -s)
      
      # Strip potential carriage returns before loading the key
      echo -e "$TERRAFORM_SSH_PRIVATE_KEY" | ssh-add -
      
      # Abstract SSH options to remove visual clutter in the loop
      SSH_OPTS="-o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no -o BatchMode=yes -o ConnectTimeout=5"
      SSH_USER="${TF_VAR_ssh_username}"
      
      export TESTING_FAILED=0

      echo ""
      echo "========================================================"
      echo " Phase 2: Connection Verification"
      echo "========================================================"
      
      for TARGET_HOST in $(cat "${CI_PROJECT_DIR}/${RESOURCE_NAME}-hostnames.txt"); do
        echo "-> Commencing verification for: ${TARGET_HOST}"
        HOST_UP=0
        
        for attempt in {1..30}; do
          
          # Step A: Wait for DNS resolution and Network routing (Port 22)
          if nc -w 5 -vz "$TARGET_HOST" 22 2>/dev/null; then
            
            # Step B: Wait for Cloud-Init and SSH Daemon to accept keys
            if ssh $SSH_OPTS ${SSH_USER}@${TARGET_HOST} 'echo "Ping"' > /dev/null 2>&1; then
               echo "   [OK] SSH authentication successful on attempt ${attempt}!"
               HOST_UP=1
               break
            else
               echo "   [WAIT] Port 22 is open, but auth rejected (Attempt ${attempt}/30). Retrying in 30s..."
            fi
            
          else
             echo "   [WAIT] Waiting for DNS / Network routing (Attempt ${attempt}/30). Retrying in 30s..."
          fi
          
          sleep 30
        done
        
        # If the loop exhausts all 30 attempts without breaking
        if [ $HOST_UP -eq 0 ]; then
           echo "-> [ERROR] Failed to verify ${TARGET_HOST} after 15 minutes."
           export TESTING_FAILED=1
        fi
        
      done

      echo ""
      echo "========================================================"
      echo " Phase 3: Rollback Evaluation"
      echo "========================================================"
      
      if [ $TESTING_FAILED -eq 1 ] ; then
        echo "-> [FATAL] Verification failed. Initiating automated rollback..."
        terraform plan -destroy -out "${TF_STATE_NAME}.tfplan"
        terraform apply "${TF_STATE_NAME}.tfplan"
        exit 1
      fi
      
      echo "-> [SUCCESS] All hosts verified. Deployment complete!"
  rules:
    # Triggers job any time code is commited to default branch
    # But only if code changed inside the working directory
    # Chained after apply, so no manual trigger
    - if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH
      changes:
        - "${TF_ROOT}/**/*"
    # Job automatically runs on manual web trigger
    # Automatically runs
    # Chained after apply, so no manual trigger
    - if: $CI_PIPELINE_SOURCE == "web"

.tf-show-state:
  extends:
    - .infisical-auth
    - .tf-init
  before_script:
    - !reference [.infisical-auth, before_script]
    - !reference [.tf-init, before_script]
  tags: [terraform] # Triggers the protected runner
  stage: check
  variables:
    TF_STATE_NAME: "${RESOURCE_NAME}-prod"
    INFISICAL_SECRET_PATH: "/terraform/pve" # Pull prod secrets using Infisial OIDC
  script:
    - |
      set -e
      echo "Checking production state of resource(s) in: ${TF_ROOT}"
      echo "Outputting terraform state in HCL format"
      echo "Empty output means resource does not exist (destroyed or never created)."
      terraform show
  rules:
    # Triggers job any time code is commited to default branch
    # But only if code changed inside the working directory
    # User must manually trigger
    # But "allow_failure: true" allows the pipeline to show success
    # Because, the user may not WANT to run this job
    - if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH
      changes:
        - "${TF_ROOT}/**/*"
      when: manual
      allow_failure: true
    # Job automatically runs on manual web trigger
    # User must trigger the job
    - if: $CI_PIPELINE_SOURCE == "web"
      when: manual

.tf-destroy:
  extends:
    - .infisical-auth
    - .tf-init
  before_script:
    - !reference [.infisical-auth, before_script]
    - !reference [.tf-init, before_script]
  tags: [terraform] # Triggers the protected runner
  stage: destroy
  variables:
    TF_STATE_NAME: "${RESOURCE_NAME}-prod"
    INFISICAL_SECRET_PATH: "/terraform/pve" # Pull prod secrets using Infisial OIDC
  script:
    - terraform plan -destroy -out "${TF_STATE_NAME}.tfplan"
    - terraform apply "${TF_STATE_NAME}.tfplan"
  rules:
    # Triggers job any time code is commited to default branch
    # But only if code changed inside the working directory
    # User must manually trigger
    # But "allow_failure: true" allows the pipeline to show success
    # Because, the user may not WANT to run this job
    - if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH
      changes:
        - "${TF_ROOT}/**/*"
      when: manual
      allow_failure: true
    # Job automatically runs on manual web trigger
    # User must trigger the job
    - if: $CI_PIPELINE_SOURCE == "web"
      when: manual

# Source in the Infisical authentication helper
include:
  - local: /ci-helpers/tf-helpers.yml
  - project: 'infrastructure/ci-helpers'
    ref: main
    file: '/infisical.gitlab-ci.yml'
  - template: Security/Secret-Detection.gitlab-ci.yml
  - template: Security/SAST.gitlab-ci.yml

# Trigger pipeline in the web and on merge rquests to main (or other default)
workflow:
  rules:
    - if: $CI_PIPELINE_SOURCE == "web"
    - if: $CI_PIPELINE_SOURCE == "merge_request_event"
    - if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH

# Stages to break up pipeline jobs
stages:
  - lint
  - plan
  - apply
  - verify
  - check
  - destroy

# ----- SECRETS SCANNING START ----- #

sast:
  stage: lint

secret_detection:
  stage: lint

# ----- SECRETS SCANNING END ----- #

# Global pipeline variables
# Authentication to container registry to pull Dockerized terraform
variables:
  DOCKER_AUTH_CONFIG: >
    {
      "auths": {
        "$CI_REGISTRY": {
          "username": "$CI_REGISTRY_USER",
          "password": "$CI_JOB_TOKEN"
        }
      }
    }
  TERRAFORM_IMAGE: "$CI_REGISTRY/infrastructure/runner-images/terraform:${TERRAFORM_VERSION}" # References version variable from group CI/CD settings
  TF_HTTP_USERNAME: "gitlab-ci-token" # GitLab CI pre-defined username
  TF_HTTP_PASSWORD: "${CI_JOB_TOKEN}" # Injected into the runner environment dynamically
  TF_HTTP_LOCK_METHOD: "POST"
  TF_HTTP_UNLOCK_METHOD: "DELETE"
  TF_HTTP_RETRY_WAIT_MIN: "5"
  STATE_BASE_URL: "${CI_SERVER_URL}/api/v4/projects/${CI_PROJECT_ID}/terraform/state"

# ---- Debian 13 VM ----

# Runs when merge request opened and files in TF_ROOT changed
debian-13-vm-validate:
  extends: .tf-validate
  variables:
    RESOURCE_NAME: "debian-13-vm" # Variable used by multiple hidden jobs
    TF_ROOT: "proxmox/deploy/linux/debian/debian-13-vm" # Variable used by multiple hidden jobs

# Runs when merge request opened and files in TF_ROOT changed
debian-13-vm-plan:
  extends: .tf-plan
  needs: [debian-13-vm-validate]
  variables:
    RESOURCE_NAME: "debian-13-vm"
    TF_ROOT: "proxmox/deploy/linux/debian/debian-13-vm"

# First job to run on merge to default branch
# Also runs on manual web trigger
debian-13-vm-apply:
  extends: .tf-apply
  variables:
    RESOURCE_NAME: "debian-13-vm"
    TF_ROOT: "proxmox/deploy/linux/debian/debian-13-vm"
  needs: 
    - job: debian-13-vm-plan
      optional: true

# Second job to run on merge to default branch
# Also runs on manual web trigger
debian-13-vm-ssh-test:
  extends: .test-ssh
  variables:
    RESOURCE_NAME: "debian-13-vm"
    TF_ROOT: "proxmox/deploy/linux/debian/debian-13-vm"
  needs: [debian-13-vm-apply]

# Runs on manual web trigger
debian-13-vm-show-state:
  extends: .tf-show-state
  variables:
    RESOURCE_NAME: "debian-13-vm"
    TF_ROOT: "proxmox/deploy/linux/debian/debian-13-vm"

# Runs on manual web trigger
debian-13-vm-destroy:
  extends: .tf-destroy
  variables:
    RESOURCE_NAME: "debian-13-vm"
    TF_ROOT: "proxmox/deploy/linux/debian/debian-13-vm"

# # ---- Debian 13 VM ----
# ...
# ...
# ...

# ---- Ubuntu 24.04 VM ----

# Runs when merge request opened and files in TF_ROOT changed
ubuntu-2404-vm-validate:
  extends: .tf-validate
  variables:
    RESOURCE_NAME: "ubuntu-2404-vm"
    TF_ROOT: "proxmox/deploy/linux/ubuntu/ubuntu-2404-vm"

# Runs when merge request opened and files in TF_ROOT changed
ubuntu-2404-vm-plan:
  extends: .tf-plan
  needs: [ubuntu-2404-vm-validate]
  variables:
    RESOURCE_NAME: "ubuntu-2404-vm"
    TF_ROOT: "proxmox/deploy/linux/ubuntu/ubuntu-2404-vm"

# First job to run on merge to default branch
# Also runs on manual web trigger
ubuntu-2404-vm-apply:
  extends: .tf-apply
  variables:
    RESOURCE_NAME: "ubuntu-2404-vm"
    TF_ROOT: "proxmox/deploy/linux/ubuntu/ubuntu-2404-vm"
  needs: 
    - job: ubuntu-2404-vm-plan
      optional: true

# Second job to run on merge to default branch
# Also runs on manual web trigger
ubuntu-2404-vm-ssh-test:
  extends: .test-ssh
  variables:
    RESOURCE_NAME: "ubuntu-2404-vm"
    TF_ROOT: "proxmox/deploy/linux/ubuntu/ubuntu-2404-vm"
  needs: [debian-13-vm-apply]

# Runs on manual web trigger
ubuntu-2404-vm-show-state:
  extends: .tf-show-state
  variables:
    RESOURCE_NAME: "ubuntu-2404-vm"
    TF_ROOT: "proxmox/deploy/linux/ubuntu/ubuntu-2404-vm"

# Runs on manual web trigger
ubuntu-2404-vm-destroy:
  extends: .tf-destroy
  variables:
    RESOURCE_NAME: "ubuntu-2404-vm"
    TF_ROOT: "proxmox/deploy/linux/ubuntu/ubuntu-2404-vm"