terraform {
  required_version = ">= 1.5.0"

  required_providers {
    proxmox = {
      source  = "bpg/proxmox"
      version = "~> 0.60"
    }
    random = {
      source  = "hashicorp/random"
      version = "~> 3.6"
    }
  }
}

# Provider config. Endpoint and token can come from PROXMOX_VE_ENDPOINT and
# PROXMOX_VE_API_TOKEN environment variables instead of tfvars -- preferred
# for CI / shared workstations. `insecure` should be true only for a lab PVE
# that presents a self-signed cert.
provider "proxmox" {
  endpoint  = var.pve_endpoint
  api_token = var.pve_api_token
  insecure  = var.pve_insecure

  # SSH is used by the provider for snippet uploads (SCP, not the API --
  # a known bpg quirk). Point it at the same address as the API endpoint
  # rather than letting the provider guess from cluster metadata (which
  # may return a bridge address that's unreachable from here).
  ssh {
    agent           = false
    username        = var.pve_ssh_username
    private_key     = file(var.pve_ssh_private_key_path)

    node {
      name    = var.pve_node
      address = var.pve_ssh_address != "" ? var.pve_ssh_address : replace(replace(var.pve_endpoint, "https://", ""), ":8006/", "")
    }
  }
}