gihyeon/proxmox-iac
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Deploy Hermes Agent LXC (#118) on gihyeon + IaC hygiene #1

Merged
gihyeon merged 11 commits from hermes-agent-lxc into main 2026-06-19 11:04:17 +09:00
Conversation 0 Commits 11 Files Changed 10 +13 -5
1 changed files with 13 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Showing only changes of commit 721fb55e05 - Show all commits

18
hermes.tf
View File

@@ -6,11 +6,14 @@ resource "proxmox_virtual_environment_download_file" "debian12_template_gihyeon"
url = "http://download.proxmox.com/images/system/debian-12-standard_12.12-1_amd64.tar.zst" url = "http://download.proxmox.com/images/system/debian-12-standard_12.12-1_amd64.tar.zst"
} }
# Hermes Agent LXC — token-safe skeleton. # Hermes Agent LXC.
# IMPORTANT: container `features` (nesting/keyctl) and bind mounts are NOT set # `features` (nesting/keyctl) ARE set here: on an unprivileged container these need
# here. The Proxmox API token cannot set host-security settings; they are applied # only VM.Allocate, which the API token has, so Terraform can set them. nesting is
# once via the PVE web console with `pct set` (see scripts/hermes-bootstrap.sh # also required so the systemd-252 (Debian 12) create does not emit the "enable
# and docs/superpowers/specs/2026-06-18-hermes-agent-lxc-design.md). # nesting" warning that Proxmox returns as TASK WARNINGS (which fails the apply).
# Bind mounts (mp0/mp1, host paths) genuinely DO require root@pam, so those are still
# added via the PVE web console with `pct set` (see scripts/hermes-bootstrap.sh and
# docs/superpowers/specs/2026-06-18-hermes-agent-lxc-design.md).
resource "proxmox_virtual_environment_container" "hermes" { resource "proxmox_virtual_environment_container" "hermes" {
description = "Hermes Agent (Nous Research) - Managed by Terraform" description = "Hermes Agent (Nous Research) - Managed by Terraform"
node_name = var.hermes_node node_name = var.hermes_node
@@ -19,6 +22,11 @@ resource "proxmox_virtual_environment_container" "hermes" {
unprivileged = true unprivileged = true
tags = ["ai", "agent", "terraform"] tags = ["ai", "agent", "terraform"]
features {
nesting = true
keyctl = true
}
operating_system { operating_system {
template_file_id = proxmox_virtual_environment_download_file.debian12_template_gihyeon.id template_file_id = proxmox_virtual_environment_download_file.debian12_template_gihyeon.id
type = "debian" type = "debian"