fleet.compute

154 options

`fleet.compute`

Every LXC/VM across all providers and envs. Entries live in nix/hosts/**/.nix.

Type: attribute set of (submodule)

Default:

{ }

Example:

{
  app-db = {
    env = "platform";
    stack = "core";
    provider_instance = "proxmox.dev";
    kind = "container";
    vm_id = 204;
    internal_ip = "192.0.2.104";
    cpu_cores = 4;
    memory_mb = 8192;
    tags = [ "postgres" ];
    protect = true;
    mount_points = [
      { datastore = "local-storage"; path = "/data"; size = "64G"; }
    ];
  };
}

Declared by: nix/fleet/compute.nix

`fleet.compute.<name>.ansible_playbook`

Override the Ansible playbook the terranix ansible_playbook emitter chains to this host after provisioning. By convention the framework playbooks apply (non-NixOS containers → fleetkit’s ansible/playbooks/developer.yml, VMs tagged “pve-host” → ansible/playbooks/pve.yml); set this to a path string (absolute, or relative to the tofu working dir .tf//) to substitute a consumer playbook instead. Consumer playbooks resolve roles via ANSIBLE_ROLES_PATH, which the fleet CLI points at both the consumer’s ansible/roles and the framework tree. Only consulted for hosts the emitter’s conventions already match — it does not opt additional hosts into Ansible.

Type: null or string

Default:

null

Declared by: nix/fleet/compute.nix

`fleet.compute.<name>.arch`

Container CPU architecture (PVE arch, bpg cpu.architecture). Emitted only when not amd64. LXC only.

Type: one of "amd64", "arm64", "armhf", "i386"

Default:

"amd64"

Declared by: nix/fleet/compute.nix

`fleet.compute.<name>.bootOrder`

XO VMs: explicit boot order (c=disk n=network d=dvd); null derives from tags (transient => dnc). Authored form of what the post-create boot-order hook applies.

Type: null or one of "cnd", "dnc"

Default:

null

Declared by: nix/fleet/compute.nix

`fleet.compute.<name>.cloneFrom`

If non-null, clone from this source VMID at provision time.

Type: null or signed integer

Default:

null

Declared by: nix/fleet/compute.nix

`fleet.compute.<name>.cloud_init`

Cloud-init user-data for VM guests (users, write_files, runcmd, hostname, VyOS config commands). Ignored for entries that don’t render cloud-init (e.g. LXC containers).

Type: submodule

Default:

{ }

Declared by: nix/fleet/compute.nix

`fleet.compute.<name>.cloud_init.datastore`

PVE storage the cloud-init drive is allocated on. null = fleet.settings.providers.proxmox.defaultDatastore.

Type: null or string

Default:

null

Example:

"local"

Declared by: nix/fleet/compute.nix

`fleet.compute.<name>.cloud_init.enable`

Attach a cloud-init drive and emit the initialization block (hostname, DNS, ip_config, identity). false = no cloud-init at all — appliance images that configure themselves (the legacy CLOUD_INIT=no).

Type: boolean

Default:

true

Declared by: nix/fleet/compute.nix

`fleet.compute.<name>.cloud_init.hostname`

Override hostname (defaults to fleet.compute key).

Type: string

Default:

""

Declared by: nix/fleet/compute.nix

`fleet.compute.<name>.cloud_init.install_nix`

If true, append a Determinate Nix install command to cloud-init runcmd.

Type: boolean

Default:

false

Declared by: nix/fleet/compute.nix

`fleet.compute.<name>.cloud_init.runcmd`

Extra runcmd lines appended after install_nix. YAML quoting is the caller’s responsibility.

Type: list of string

Default:

[ ]

Declared by: nix/fleet/compute.nix

`fleet.compute.<name>.cloud_init.users`

Local users created by cloud-init’s users: directive.

Type: list of (submodule)

Default:

[ ]

Example:

[ { ref = "alice"; extra_groups = [ "docker" ]; } ]

Declared by: nix/fleet/compute.nix

`fleet.compute.<name>.cloud_init.users.*.extra_groups`

Linux groups added on this VM (e.g. “docker”). Independent of LDAP groups in fleet.access.users.

Type: list of string

Default:

[ ]

Declared by: nix/fleet/compute.nix

`fleet.compute.<name>.cloud_init.users.*.name`

Username (inline mode; ignored when ref is set).

Type: null or string

Default:

null

Declared by: nix/fleet/compute.nix

`fleet.compute.<name>.cloud_init.users.*.ref`

Registry key into fleet.access.users.

Type: null or string

Default:

null

Declared by: nix/fleet/compute.nix

`fleet.compute.<name>.cloud_init.users.*.ssh_keys`

SSH keys (inline mode; ignored when ref is set).

Type: list of string

Default:

[ ]

Declared by: nix/fleet/compute.nix

`fleet.compute.<name>.cloud_init.users.*.sudo`

Grant passwordless sudo on this VM.

Type: boolean

Default:

true

Declared by: nix/fleet/compute.nix

`fleet.compute.<name>.cloud_init.vyos_config_commands`

VyOS-specific cloud-init: a list of VyOS configuration tree commands (e.g. “set system host-name ‘router’”). When non-empty, renders as a top-level vyos_config_commands: block in the user-data — VyOS’s cloud-init module reads this and applies the commands at first boot inside a config transaction (load → set → commit → save). Non-VyOS substrates ignore the block. Used to bootstrap hostname, HTTPS API + token, base interface IPs, and SSH on a fresh VyOS install so the Terraform provider can take over from there.

Type: list of string

Default:

[ ]

Declared by: nix/fleet/compute.nix

`fleet.compute.<name>.cloud_init.write_files`

Files written to the VM filesystem before runcmd runs.

Type: list of (submodule)

Default:

[ ]

Declared by: nix/fleet/compute.nix

`fleet.compute.<name>.cloud_init.write_files.*.content`

Literal file contents, embedded verbatim in the cloud-init user-data.

Type: string

Default: none (required when its feature is enabled)

Declared by: nix/fleet/compute.nix

`fleet.compute.<name>.cloud_init.write_files.*.owner`

“user:group” ownership passed to cloud-init write_files.

Type: string

Default:

"root:root"

Declared by: nix/fleet/compute.nix

`fleet.compute.<name>.cloud_init.write_files.*.path`

Absolute destination path of the file inside the guest.

Type: string

Default: none (required when its feature is enabled)

Declared by: nix/fleet/compute.nix

`fleet.compute.<name>.cloud_init.write_files.*.permissions`

Octal file mode string passed to cloud-init write_files.

Type: string

Default:

"0644"

Declared by: nix/fleet/compute.nix

`fleet.compute.<name>.cpu_cores`

Number of CPU cores allocated to the guest.

Type: signed integer

Default:

Declared by: nix/fleet/compute.nix

`fleet.compute.<name>.data_disks`

Additional virtio data disks. Emitted as virtio1, virtio2, … and formatted/mounted by cloud-init.

Type: list of (submodule)

Default:

[ ]

Example:

[ { size_gb = 100; mount_path = "/data"; } ]

Declared by: nix/fleet/compute.nix

`fleet.compute.<name>.data_disks.*.datastore_id`

PVE storage to allocate the disk on. Defaults to fleet.settings.providers.proxmox.defaultDatastore.

Type: string

Default:

config.fleet.settings.providers.proxmox.defaultDatastore

Declared by: nix/fleet/compute.nix

`fleet.compute.<name>.data_disks.*.filesystem`

Filesystem to format with on first boot.

Type: string

Default:

"ext4"

Declared by: nix/fleet/compute.nix

`fleet.compute.<name>.data_disks.*.mount_path`

Mountpoint (e.g. /data).

Type: string

Default: none (required when its feature is enabled)

Declared by: nix/fleet/compute.nix

`fleet.compute.<name>.data_disks.*.size_gb`

Disk size in GiB.

Type: signed integer

Default: none (required when its feature is enabled)

Declared by: nix/fleet/compute.nix

`fleet.compute.<name>.devices`

Host device nodes passed through into the container (bpg device_passthrough → PVE devN entries): TUN for VPN software, /dev/dri + /dev/kfd + /dev/nvidia* for GPU transcoding, /dev/apex_0 for a Coral TPU. Replaces the lxc.conf edits the community scripts made. LXC only.

Type: list of (submodule)

Default:

[ ]

Example:

[ { path = "/dev/net/tun"; }
  { path = "/dev/dri/renderD128"; gid = 44; }
  { path = "/dev/dri/card0"; gid = 44; } ]

Declared by: nix/fleet/compute.nix

`fleet.compute.<name>.devices.*.deny_write`

Expose the device read-only.

Type: boolean

Default:

false

Declared by: nix/fleet/compute.nix

`fleet.compute.<name>.devices.*.gid`

Owner gid of the node inside the container (community scripts use 44 = video for /dev/dri). Unprivileged CTs need this to match the guest’s group.

Type: null or integer between 0 and 65535 (both inclusive)

Default:

null

Example:

Declared by: nix/fleet/compute.nix

`fleet.compute.<name>.devices.*.mode`

Access mode of the node inside the container. null = PVE default.

Type: null or string matching the pattern ^0[0-7]{3}$

Default:

null

Example:

"0660"

Declared by: nix/fleet/compute.nix

`fleet.compute.<name>.devices.*.path`

Host device node passed through into the LXC (PVE devN: entry). Examples: /dev/net/tun, /dev/dri/renderD128, /dev/dri/card0, /dev/kfd, /dev/apex_0.

Type: string matching the pattern ^/dev/.+

Default: none (required when its feature is enabled)

Example:

"/dev/dri/renderD128"

Declared by: nix/fleet/compute.nix

`fleet.compute.<name>.devices.*.uid`

Owner uid of the node inside the container. null = PVE default (root).

Type: null or integer between 0 and 65535 (both inclusive)

Default:

null

Declared by: nix/fleet/compute.nix

`fleet.compute.<name>.dns`

Per-guest create-time DNS override ({ servers, domain }); nulls inherit fleet.network.dns_servers / dns_domain. The declarative twin of the legacy var_ns / var_searchdomain.

Type: submodule

Default:

{ }

Declared by: nix/fleet/compute.nix

`fleet.compute.<name>.dns.domain`

Create-time DNS search domain for this guest. null = inherit fleet.network.dns_domain; “” = explicitly none.

Type: null or string

Default:

null

Example:

"lab.example.internal"

Declared by: nix/fleet/compute.nix

`fleet.compute.<name>.dns.servers`

Create-time resolvers written into this guest’s PVE config. null = inherit fleet.network.dns_servers.

Type: null or (list of string)

Default:

null

Example:

[
  "192.0.2.53"
  "1.1.1.1"
]

Declared by: nix/fleet/compute.nix

`fleet.compute.<name>.enabled`

Toggle for build-on-demand entries. When false, the entry is filtered out before validation + emission, so fleet deploy tf apply <stack> neither provisions nor preserves it. Flip to true to materialise; flip back to false (and apply) to destroy. See nix/hosts/xoa/xo-installer-v10.nix for the canonical pattern.

Type: boolean

Default:

true

Declared by: nix/fleet/compute.nix

`fleet.compute.<name>.env`

Logical env (infra / platform / dev / prod / …).

Type: string

Default: none (required when its feature is enabled)

Example:

"platform"

Declared by: nix/fleet/compute.nix

`fleet.compute.<name>.features`

PVE container feature flags ({ nesting, fuse, keyctl } default true; { mknod, mount } default off; LXC only).

Type: submodule

Default:

{ }

Declared by: nix/fleet/compute.nix

`fleet.compute.<name>.features.fuse`

Allow FUSE filesystem mounts inside the LXC (PVE fuse feature).

Type: boolean

Default:

true

Declared by: nix/fleet/compute.nix

`fleet.compute.<name>.features.keyctl`

Allow the keyctl() syscall inside the LXC (PVE keyctl feature; needed by systemd-based guests).

Type: boolean

Default:

true

Declared by: nix/fleet/compute.nix

`fleet.compute.<name>.features.mknod`

Allow creating device nodes inside the LXC (PVE mknod feature). Emitted only when true — a non-root API token 403s on the field otherwise.

Type: boolean

Default:

false

Declared by: nix/fleet/compute.nix

`fleet.compute.<name>.features.mount`

Filesystem types the LXC may mount itself (PVE mount feature). PVE accepts nfs and cifs; FUSE is the separate fuse flag. Emitted only when non-empty.

Type: list of (one of "nfs", "cifs")

Default:

[ ]

Example:

[
  "nfs"
  "cifs"
]

Declared by: nix/fleet/compute.nix

`fleet.compute.<name>.features.nesting`

Allow nested containers/namespaces inside the LXC (PVE nesting feature; needed for systemd-nspawn, Docker, nix sandboxed builds).

Type: boolean

Default:

true

Declared by: nix/fleet/compute.nix

`fleet.compute.<name>.fleet_ns`

Fleet namespace this entry belongs to (ADR-097). null = the incumbent/default fleet (top-level provider tree; unprefixed stacks + legacy state keys). Set by the v2 normaliser when lifting from fleet.fleets. — not authored by hand.

Type: null or string

Default:

null

Example:

"jeirslab"

Declared by: nix/fleet/compute.nix

`fleet.compute.<name>.hook_script`

PVE hook script file id (a snippets file, e.g. a kind = "file" resource) run by PVE at the guest’s lifecycle phases. LXC only.

Type: null or string

Default:

null

Example:

"local:snippets/post-create.sh"

Declared by: nix/fleet/compute.nix

`fleet.compute.<name>.host_managed`

Override bpg-provider network_interface.host_managed for this host. null = use provider default (host_managed=0). true = let PVE configure the in-container interface from ip_config (legacy / bootstrap-friendly).

Type: null or boolean

Default:

null

Declared by: nix/fleet/compute.nix

`fleet.compute.<name>.ignore_changes`

Terraform attribute paths emitted into lifecycle.ignore_changes — drift on these attributes is ignored at plan time.

Type: list of string

Default:

[ ]

Declared by: nix/fleet/compute.nix

`fleet.compute.<name>.image`

Explicit guest image. VMs: “file:<file_id>” (a disk image file resource), “clone:” (full clone of a template VM), or “import::import/” (a raw/qcow2 uploaded to a storage with the import content type, e.g. through a kind = "download" resource — the appliance-image path; PVE 8.4+). Containers: a vztmpl reference for a non-NixOS rootfs.

Type: null or string

Default:

null

Example:

"import:local:import/example-cloud-amd64.qcow2"

Declared by: nix/fleet/compute.nix

`fleet.compute.<name>.import`

Cross-provider import settings ({ from_uuid }). Set from_uuid to adopt an existing XO VM instead of creating a fresh one.

Type: submodule

Default:

{ }

Declared by: nix/fleet/compute.nix

`fleet.compute.<name>.import.from_uuid`

XO VM UUID for cross-provider imports (e.g. pve-prod).

Type: string

Default:

""

Declared by: nix/fleet/compute.nix

`fleet.compute.<name>.interfaces`

Ordered NIC list for network_mode = "declared"; index i becomes net (LXC: eth unless name says otherwise). Empty for every other mode (validator-enforced).

Type: list of (submodule)

Default:

[ ]

Example:

[ { bridge = "vmbr1"; ipv4 = "192.0.2.10/24"; gateway = "192.0.2.1"; vlan = 42; }
  { bridge = "vmbr0"; ipv4 = "dhcp"; ipv6.method = "auto"; mac = "BC:24:11:00:00:10"; } ]

Declared by: nix/fleet/compute.nix

`fleet.compute.<name>.interfaces.*.bridge`

PVE bridge this NIC attaches to (PVE’s stock default bridge is vmbr0). Ignored when vnet is set.

Type: string

Default:

"vmbr0"

Example:

"vmbr1"

Declared by: nix/fleet/compute.nix

`fleet.compute.<name>.interfaces.*.firewall`

Enable the PVE firewall on this NIC.

Type: boolean

Default:

false

Declared by: nix/fleet/compute.nix

`fleet.compute.<name>.interfaces.*.gateway`

IPv4 default gateway (only with a static CIDR; at most one NIC per guest).

Type: null or string

Default:

null

Example:

"192.0.2.1"

Declared by: nix/fleet/compute.nix

`fleet.compute.<name>.interfaces.*.ipv4`

IPv4 config: “dhcp”, “manual” (PVE ip=manual, the guest configures itself), a CIDR (the prefix is explicit — no hidden /24), or null (no IPv4 block).

Type: null or one of "dhcp", "manual" or string matching the pattern ^([0-9]{1,3}\.){3}[0-9]{1,3}/([0-9]|[12][0-9]|3[0-2])$

Default:

"dhcp"

Example:

"192.0.2.10/24"

Declared by: nix/fleet/compute.nix

`fleet.compute.<name>.interfaces.*.ipv6`

IPv6 config ({ method, address, gateway }).

Type: submodule

Default:

{ }

Declared by: nix/fleet/compute.nix

`fleet.compute.<name>.interfaces.*.ipv6.address`

Static IPv6 address in CIDR notation (method = static).

Type: null or string

Default:

null

Example:

"2001:db8::10/64"

Declared by: nix/fleet/compute.nix

`fleet.compute.<name>.interfaces.*.ipv6.gateway`

IPv6 default gateway (method = static only).

Type: null or string

Default:

null

Example:

"2001:db8::1"

Declared by: nix/fleet/compute.nix

`fleet.compute.<name>.interfaces.*.ipv6.method`

IPv6 configuration for this NIC: none (nothing emitted — the legacy “disable” too), auto (SLAAC), dhcp, or static (address required).

Type: one of "none", "auto", "dhcp", "static"

Default:

"none"

Declared by: nix/fleet/compute.nix

`fleet.compute.<name>.interfaces.*.mac`

Pinned MAC address, uppercase colon-separated. null = PVE assigns one.

Type: null or string matching the pattern ^([0-9A-F]{2}:){5}[0-9A-F]{2}$

Default:

null

Example:

"BC:24:11:00:00:10"

Declared by: nix/fleet/compute.nix

`fleet.compute.<name>.interfaces.*.model`

Virtual NIC model (VMs only; LXC NICs are veth).

Type: one of "virtio", "e1000", "e1000e", "rtl8139", "vmxnet3"

Default:

"virtio"

Declared by: nix/fleet/compute.nix

`fleet.compute.<name>.interfaces.*.mtu`

NIC MTU (PVE mtu=): 576-65535, or 1 on a VM NIC to inherit the bridge MTU.

Type: null or signed integer

Default:

null

Example:

Declared by: nix/fleet/compute.nix

`fleet.compute.<name>.interfaces.*.name`

In-guest interface name (LXC). null = eth. Ignored for VMs (the guest kernel names NICs).

Type: null or string

Default:

null

Example:

"eth0"

Declared by: nix/fleet/compute.nix

`fleet.compute.<name>.interfaces.*.rate_limit_mbps`

Egress rate limit in MB/s (PVE rate=).

Type: null or (positive integer, meaning >0)

Default:

null

Example:

Declared by: nix/fleet/compute.nix

`fleet.compute.<name>.interfaces.*.vlan`

802.1Q VLAN tag (PVE tag=).

Type: null or integer between 1 and 4094 (both inclusive)

Default:

null

Example:

Declared by: nix/fleet/compute.nix

`fleet.compute.<name>.interfaces.*.vnet`

PVE SDN VNet id to attach to instead of a bridge (PVE writes it into the bridge= field). Declare the VNet as a kind = "sdn-vnet" resource on the same provider instance.

Type: null or string

Default:

null

Example:

"lab"

Declared by: nix/fleet/compute.nix

`fleet.compute.<name>.internal_bridge`

Bridge the legacy single-internal mode attaches eth0 to. null = vmbr1, or vmbr0 when the provider instance is listed in fleet.settings.providers.proxmox.singleBridgeInstances. (Declared-mode hosts set the bridge per interface instead.)

Type: null or string

Default:

null

Example:

"vmbr2"

Declared by: nix/fleet/compute.nix

`fleet.compute.<name>.internal_ip`

Internal fleet-LAN IPv4 address (bare, no prefix). Statically configured into the guest at create time and used as the host’s inventory/SSH address (hosts.json, DNS A records). Empty for hosts without an internal interface (e.g. DHCP’d XCP-ng VMs).

Type: string

Default:

""

Example:

"192.0.2.104"

Declared by: nix/fleet/compute.nix

`fleet.compute.<name>.ip`

External/LAN IPv4 address (bare, no prefix — the emitter appends the prefix length). Used by the external leg of the dual / single-external / custom network modes. Empty when the host has no external interface.

Type: string

Default:

""

Example:

"198.51.100.20"

Declared by: nix/fleet/compute.nix

`fleet.compute.<name>.kind`

LXC container or KVM VM.

Type: one of "container", "vm"

Default: none (required when its feature is enabled)

Declared by: nix/fleet/compute.nix

`fleet.compute.<name>.lxc_extra_conf`

Raw lines appended to /etc/pve/lxc/.conf inside a “# BEGIN/END fleetkit lxc_extra_conf” marker block — the escape hatch for what PVE’s devN passthrough cannot express (hot-plug USB cgroup wildcards, optional bind mounts, autodev hooks). Applied by a terraform_data local-exec over root SSH to the container’s node (fleet.providers.proxmox..cluster.node_addresses maps node names to SSH hosts), re-run whenever the lines change, rebooting the container if it is running. Emptying the list stops managing the block but leaves it in place. LXC only.

Type: list of string

Default:

[ ]

Example:

[ "lxc.cgroup2.devices.allow: c 188:* rwm"
  "lxc.mount.entry: /dev/serial/by-id dev/serial/by-id none bind,optional,create=dir" ]

Declared by: nix/fleet/compute.nix

`fleet.compute.<name>.mac_address_eth0`

Pin the eth0 MAC address (uppercase colon-separated, e.g. “BC:24:11:5B:EA:26”). null = bpg-provider auto-assigns. Currently honoured by lxc-router mode; extend the network-mode emitters as needed for other modes.

Type: null or string

Default:

null

Declared by: nix/fleet/compute.nix

`fleet.compute.<name>.mac_address_eth1`

Pin the eth1 MAC address. Required by internal-plus-lan-mac mode (a second NIC on the internal bridge carrying an ingress identity a LAN-router port-forward targets by MAC).

Type: null or string

Default:

null

Declared by: nix/fleet/compute.nix

`fleet.compute.<name>.memory_mb`

RAM in MiB. LXC containers pick up changes without a restart; VMs need a reboot.

Type: signed integer

Default:

Declared by: nix/fleet/compute.nix

`fleet.compute.<name>.mount_points`

Extra PVE mount-point volumes ({ datastore, path, size, backup }) attached to the container (LXC only).

Type: list of (submodule)

Default:

[ ]

Example:

[ { datastore = "local-storage"; path = "/data"; size = "64G"; } ]

Declared by: nix/fleet/compute.nix

`fleet.compute.<name>.mount_points.*.backup`

Include this volume in vzdump backups.

Type: boolean

Default:

true

Declared by: nix/fleet/compute.nix

`fleet.compute.<name>.mount_points.*.datastore`

PVE storage the mount-point volume is allocated on (e.g. “local-storage”).

Type: string

Default: none (required when its feature is enabled)

Declared by: nix/fleet/compute.nix

`fleet.compute.<name>.mount_points.*.path`

Mountpoint inside the container (e.g. “/data”).

Type: string

Default: none (required when its feature is enabled)

Declared by: nix/fleet/compute.nix

`fleet.compute.<name>.mount_points.*.size`

Size like “256G”. Stringly-typed to match bpg input.

Type: string

Default: none (required when its feature is enabled)

Declared by: nix/fleet/compute.nix

`fleet.compute.<name>.name`

Hostname for the machine (defaults to the fleet attrset key).

Type: string

Default:

"‹name›"

Declared by: nix/fleet/compute.nix

`fleet.compute.<name>.network_mode`

Which NIC/bridge layout the emitter generates. “declared” = the NICs come from interfaces (any bridge/VNet, DHCP or explicit CIDR, VLAN, MTU, MAC, IPv6) — the general form; single-internal (one NIC on the internal bridge), single-external (one NIC on the LAN bridge), dual (both) and the custom/special-case layouts are the legacy fixed shapes kept for compatibility.

Type: one of "single-internal", "single-external", "dual", "custom-netgate", "custom-btc-testnet", "custom-vm", "lxc-router", "declared", "internal-plus-lan-mac"

Default:

"single-internal"

Declared by: nix/fleet/compute.nix

`fleet.compute.<name>.node`

PVE cluster member name (e.g. “pve-data”). Empty = defaults to provider’s cluster.primary_node.

Type: string

Default:

""

Declared by: nix/fleet/compute.nix

`fleet.compute.<name>.note`

Structured PVE Notes content. Takes precedence over notes when set.

Type: null or (submodule)

Default:

null

Declared by: nix/fleet/compute.nix

`fleet.compute.<name>.note.extra`

Free-form markdown appended last.

Type: string

Default:

""

Declared by: nix/fleet/compute.nix

`fleet.compute.<name>.note.links`

Related links (dashboards, runbooks, tickets) rendered as a bullet list.

Type: list of (submodule)

Default:

[ ]

Declared by: nix/fleet/compute.nix

`fleet.compute.<name>.note.links.*.text`

Link label as rendered in the Notes markdown.

Type: string

Default: none (required when its feature is enabled)

Declared by: nix/fleet/compute.nix

`fleet.compute.<name>.note.links.*.url`

Link target URL.

Type: string

Default: none (required when its feature is enabled)

Declared by: nix/fleet/compute.nix

`fleet.compute.<name>.note.services`

Services running on the host, rendered as a bullet list (name, address, port).

Type: list of (submodule)

Default:

[ ]

Declared by: nix/fleet/compute.nix

`fleet.compute.<name>.note.services.*.address`

Address/URL the service is reachable at. Empty = omitted from the rendered line.

Type: string

Default:

""

Declared by: nix/fleet/compute.nix

`fleet.compute.<name>.note.services.*.name`

Service name shown in the Notes services table.

Type: string

Default: none (required when its feature is enabled)

Declared by: nix/fleet/compute.nix

`fleet.compute.<name>.note.services.*.port`

Service port. null = omitted from the rendered line.

Type: null or signed integer

Default:

null

Declared by: nix/fleet/compute.nix

`fleet.compute.<name>.note.stateful`

Render the STATEFUL/protected warning banner in the Notes panel. Informational only — destruction protection itself comes from protect / STATEFUL_TAGS.

Type: boolean

Default:

false

Declared by: nix/fleet/compute.nix

`fleet.compute.<name>.note.summary`

One-paragraph description rendered under the title.

Type: string

Default:

""

Declared by: nix/fleet/compute.nix

`fleet.compute.<name>.note.title`

Heading of the rendered Notes markdown. Empty = falls back to the host name.

Type: string

Default:

""

Declared by: nix/fleet/compute.nix

`fleet.compute.<name>.notes`

Free-text audit note. Plain-string fallback rendered in the PVE Notes panel (Summary tab) when the structured note is null.

Type: string

Default:

""

Declared by: nix/fleet/compute.nix

`fleet.compute.<name>.onboot`

Start the guest when the PVE node boots (onboot).

Type: boolean

Default:

true

Declared by: nix/fleet/compute.nix

`fleet.compute.<name>.pool`

Pool membership — pool_id of a fleet.resources pool entry.

Type: null or string

Default:

null

Declared by: nix/fleet/compute.nix

`fleet.compute.<name>.privileged`

Run this LXC in privileged mode (sets unprivileged = false in the Proxmox container). Only needed for hosts that run NAT or other kernel-capability-sensitive workloads.

Type: boolean

Default:

false

Declared by: nix/fleet/compute.nix

`fleet.compute.<name>.protect`

Emit lifecycle.prevent_destroy = true on the generated Terraform resource. Required (or a strict-destruction-policy provider) for entries carrying a fleet.STATEFUL_TAGS tag; fleet tf destroy refuses to target protected resources.

Type: boolean

Default:

false

Declared by: nix/fleet/compute.nix

`fleet.compute.<name>.protection`

PVE guest protection flag (blocks destroy/remove in the PVE UI and API). Distinct from protect, which is the Terraform prevent_destroy lifecycle. Emitted only when true.

Type: boolean

Default:

false

Declared by: nix/fleet/compute.nix

`fleet.compute.<name>.provider_instance`

Pointer to fleet.providers: “.” (e.g. “proxmox.dev”).

Type: string matching the pattern ^[a-z-]+\.[a-z][a-z0-9-]*$

Default: none (required when its feature is enabled)

Example:

"proxmox.dev"

Declared by: nix/fleet/compute.nix

`fleet.compute.<name>.provides`

This machine IS a member (node) of the named provider instance — the ADR-096 recursive estate link. Its resource name must equal the member/node name it provides. Drives derived hypervisor scrape targets and layer-dependency queries.

Type: null or string

Default:

null

Example:

"proxmox.prod"

Declared by: nix/fleet/compute.nix

`fleet.compute.<name>.provisioning`

“managed” = terranix/tofu-provisioned by this repo; “external” = provisioned elsewhere, NixOS-managed only.

Type: one of "managed", "external"

Default:

"managed"

Declared by: nix/fleet/compute.nix

`fleet.compute.<name>.root_disk_datastore`

PVE storage the root disk is allocated on. Defaults to fleet.settings.providers.proxmox.defaultDatastore.

Type: string

Default:

config.fleet.settings.providers.proxmox.defaultDatastore

Declared by: nix/fleet/compute.nix

`fleet.compute.<name>.root_disk_gb`

Root disk size in GiB.

Type: signed integer

Default:

Declared by: nix/fleet/compute.nix

`fleet.compute.<name>.scope`

ADR-097 derivation contract: an “estate”-scoped resource is a singleton serving every fleet on this substrate (router/DNS edge, builder, observability) and may fold ALL fleets’ manifests into its config; “fleet”-scoped resources see only their own namespace. Enforcement lands with the second fleet — today this is declared intent + docs surface.

Type: one of "fleet", "estate"

Default:

"fleet"

Declared by: nix/fleet/compute.nix

`fleet.compute.<name>.ssh_groups`

Authentik groups allowed SSH access (sssd simple_allow_groups).

Type: list of string

Default:

[
  "platform-admins"
]

Declared by: nix/fleet/compute.nix

`fleet.compute.<name>.stack`

Dot-path stack label within env.

Type: string

Default: none (required when its feature is enabled)

Example:

"bitcoin.mainnet"

Declared by: nix/fleet/compute.nix

`fleet.compute.<name>.start_on_create`

Start the guest right after Terraform creates it. false = create stopped (appliance images that need a first manual step).

Type: boolean

Default:

true

Declared by: nix/fleet/compute.nix

`fleet.compute.<name>.startup`

PVE startup ordering ({ order, up_delay, down_delay }). null = not managed.

Type: null or (submodule)

Default:

null

Example:

{ order = 10; up_delay = 30; }

Declared by: nix/fleet/compute.nix

`fleet.compute.<name>.startup.down_delay`

Seconds PVE waits after stopping this guest before stopping the next one.

Type: null or (unsigned integer, meaning >=0)

Default:

null

Example:

Declared by: nix/fleet/compute.nix

`fleet.compute.<name>.startup.order`

PVE start/shutdown order (lower starts first). null = PVE default (any order).

Type: null or (unsigned integer, meaning >=0)

Default:

null

Example:

Declared by: nix/fleet/compute.nix

`fleet.compute.<name>.startup.up_delay`

Seconds PVE waits after starting this guest before starting the next one.

Type: null or (unsigned integer, meaning >=0)

Default:

null

Example:

Declared by: nix/fleet/compute.nix

`fleet.compute.<name>.startup_order`

Deprecated flat alias of startup.order — PVE LXC boot ordering (lower boots first). null = PVE default ordering. Prefer the structured startup option.

Type: null or signed integer

Default:

null

Example:

Declared by: nix/fleet/compute.nix

`fleet.compute.<name>.sudo_groups`

Authentik groups granted password-required sudo on this host (sssd → security.sudo.extraRules). In practice a subset of ssh_groups (you cannot sudo on a host you cannot log into). Empty = no LDAP user gets sudo here; local wheel accounts (core.nix) are unaffected. See ADR-028.

Type: list of string

Default:

[ ]

Declared by: nix/fleet/compute.nix

`fleet.compute.<name>.swap_mb`

Swap in MiB (LXC only).

Type: signed integer

Default:

Declared by: nix/fleet/compute.nix

`fleet.compute.<name>.tags`

Free-form tags (shown in the PVE UI, usable as Colmena deploy targets). Tags listed in fleet.STATEFUL_TAGS additionally force destruction protection (validator-enforced).

Type: list of string

Default:

[ ]

Example:

[
  "postgres"
  "monitoring"
]

Declared by: nix/fleet/compute.nix

`fleet.compute.<name>.vm`

VM-only hardware settings ({ machine, bios, efi, cpu_type, scsi_hardware, root_disk, serial_console, agent, boot_order, tablet }). Ignored for containers (validator rejects non-defaults there).

Type: submodule

Default:

{ }

Declared by: nix/fleet/compute.nix

`fleet.compute.<name>.vm.agent`

QEMU guest agent enabled. null = fleetkit’s rule (on for image-based and NixOS-template VMs).

Type: null or boolean

Default:

null

Declared by: nix/fleet/compute.nix

`fleet.compute.<name>.vm.bios`

Firmware. “ovmf” (UEFI) also emits an EFI vars disk from efi. null = PVE default (seabios).

Type: null or one of "seabios", "ovmf"

Default:

null

Declared by: nix/fleet/compute.nix

`fleet.compute.<name>.vm.boot_order`

Explicit boot device order (PVE boot: order=). null = PVE default.

Type: null or (list of string)

Default:

null

Example:

[
  "scsi0"
  "net0"
]

Declared by: nix/fleet/compute.nix

`fleet.compute.<name>.vm.cpu_type`

QEMU CPU model (PVE cpu:). “host” (fleetkit default) passes the node’s CPU through; community VMs default to kvm64 for migratability.

Type: string

Default:

"host"

Example:

"x86-64-v2-AES"

Declared by: nix/fleet/compute.nix

`fleet.compute.<name>.vm.efi`

EFI vars disk settings, used when bios = ovmf.

Type: submodule

Default:

{ }

Declared by: nix/fleet/compute.nix

`fleet.compute.<name>.vm.efi.datastore`

PVE storage for the EFI vars disk. null = fleet.settings.providers.proxmox.defaultDatastore.

Type: null or string

Default:

null

Declared by: nix/fleet/compute.nix

`fleet.compute.<name>.vm.efi.pre_enrolled_keys`

Pre-enrol the distribution Secure Boot keys into the EFI vars disk (community default: off).

Type: boolean

Default:

false

Declared by: nix/fleet/compute.nix

`fleet.compute.<name>.vm.efi.type`

EFI vars disk size/type (PVE efitype; community default 4m).

Type: one of "2m", "4m"

Default:

"4m"

Declared by: nix/fleet/compute.nix

`fleet.compute.<name>.vm.machine`

QEMU machine type: pc (i440fx, community default) or q35. null = PVE default.

Type: null or one of "pc", "q35"

Default:

null

Declared by: nix/fleet/compute.nix

`fleet.compute.<name>.vm.root_disk`

Root disk attributes beyond size/datastore ({ interface, cache, discard, iothread, ssd }).

Type: submodule

Default:

{ }

Declared by: nix/fleet/compute.nix

`fleet.compute.<name>.vm.root_disk.cache`

Disk cache mode (PVE cache=). null = PVE default.

Type: null or one of "none", "directsync", "writethrough", "writeback", "unsafe"

Default:

null

Declared by: nix/fleet/compute.nix

`fleet.compute.<name>.vm.root_disk.discard`

Pass discard/TRIM through to the storage (PVE discard=).

Type: null or one of "on", "ignore"

Default:

null

Declared by: nix/fleet/compute.nix

`fleet.compute.<name>.vm.root_disk.interface`

Bus/device of the root disk (community VMs use scsi0 with virtio-scsi-pci; fleetkit’s NixOS images boot from virtio0).

Type: string

Default:

"virtio0"

Example:

"scsi0"

Declared by: nix/fleet/compute.nix

`fleet.compute.<name>.vm.root_disk.iothread`

Use a dedicated I/O thread (PVE iothread=).

Type: null or boolean

Default:

null

Declared by: nix/fleet/compute.nix

`fleet.compute.<name>.vm.root_disk.ssd`

Present the disk as an SSD to the guest (PVE ssd=).

Type: null or boolean

Default:

null

Declared by: nix/fleet/compute.nix

`fleet.compute.<name>.vm.scsi_hardware`

SCSI controller model (PVE scsihw). null = PVE default.

Type: null or one of "virtio-scsi-pci", "virtio-scsi-single", "lsi", "lsi53c810", "megasas", "pvscsi"

Default:

null

Declared by: nix/fleet/compute.nix

`fleet.compute.<name>.vm.serial_console`

Attach a serial socket so qm terminal <vmid> reaches the guest console.

Type: boolean

Default:

true

Declared by: nix/fleet/compute.nix

`fleet.compute.<name>.vm.tablet`

USB tablet device (community VMs pass -tablet 0). null = PVE default (on).

Type: null or boolean

Default:

null

Declared by: nix/fleet/compute.nix

`fleet.compute.<name>.vm_id`

Proxmox VMID.

Type: signed integer

Default: none (required when its feature is enabled)

Declared by: nix/fleet/compute.nix

`fleet.compute.<name>.vm_template`

Legacy: “nixos” clones VMID 9000, “debian-13” imports the prepared Debian qcow2 (ADR-013/018). Prefer image for new entries.

Type: one of "nixos", "debian-13"

Default:

"debian-13"

Declared by: nix/fleet/compute.nix

`fleet.compute.<name>.xoa`

XCP-ng/XOA-specific compute config. Active when provider_instance starts with xen-orchestra.

Type: submodule

Default:

{ }

Declared by: nix/fleet/compute.nix

`fleet.compute.<name>.xoa.cloud_network_config`

Cloud-init network-config (v2 YAML) passed verbatim to xenorchestra_vm.cloud_network_config. Only meaningful for cloud-init guests (non-NixOS); use match: {macaddress: ...} stanzas against pinned xoa.networks[*].mac so the config is immune to guest interface naming (eth0 vs enX0 on Xen). NixOS VMs leave this null — networkd owns their config. (INFRA-194; also the path INFRA-174’s Ubuntu dev box needs.)

Type: null or string

Default:

null

Declared by: nix/fleet/compute.nix

`fleet.compute.<name>.xoa.disks`

Additional VDIs beyond the cloned template root disk.

Type: list of (submodule)

Default:

[ ]

Declared by: nix/fleet/compute.nix

`fleet.compute.<name>.xoa.disks.*.name`

VDI name label as shown in Xen Orchestra.

Type: string

Default: none (required when its feature is enabled)

Declared by: nix/fleet/compute.nix

`fleet.compute.<name>.xoa.disks.*.size_add_gb`

Additional GiB layered on top of size_gb, applied IMPERATIVELY by xoa-cli reconcile-disks (never by terraform — INFRA-172 / ADR-081). Live target = size_gb + size_add_gb; the reconciler grows the VDI when live < target and never shrinks. Grow a disk by editing this field and running the reconciler.

Type: signed integer

Default:

Declared by: nix/fleet/compute.nix

`fleet.compute.<name>.xoa.disks.*.size_gb`

BASE size in GiB — what terranix provisions at CREATE time. ForceNew in the vatesfr/xenorchestra provider; ignored for drift afterwards (mkXoLifecycle). Do NOT bump this to grow a live disk — use size_add_gb.

Type: signed integer

Default: none (required when its feature is enabled)

Declared by: nix/fleet/compute.nix

`fleet.compute.<name>.xoa.disks.*.sr_ref`

Full fleet.resources key for the SR (e.g. “xo-sr-main”).

Type: string

Default: none (required when its feature is enabled)

Declared by: nix/fleet/compute.nix

`fleet.compute.<name>.xoa.iso_ref`

Optional fleet.resources key for an ISO to attach as a CDROM (e.g. “xo-iso-nixos-minimal”). When set, the VM is created with the ISO pre-attached and the underlying VM’s boot order (“dc” — CD then disk in XOA’s UEFI default) makes it boot from the ISO on first power-on. Used for one-shot OS installs onto blank disks. After install, eject via xo-cli vm.ejectCd and the VM boots from disk on next start.

Type: null or string

Default: