fleet.providers

285 options

`fleet.providers.ansible`

ansible/ansible — runs ansible-playbook from a terraform resource (ansible_playbook). Used to chain post-install Ansible against compute resources tofu just created, so fleet deploy tf apply does the whole “create the host + converge its config” cycle in one shot. The provider runs ansible-playbook locally on whoever runs tofu, so SSH key + inventory must be reachable there.

Type: null or (submodule)

Default:

null

Declared by: nix/fleet/providers

`fleet.providers.ansible.endpoint`

Daemon/host URL — docker only (e.g. ssh://root@192.0.2.50 or tcp://host:2376).

Type: null or string

Default:

null

Example:

"ssh://root@192.0.2.50"

Declared by: nix/fleet/providers

`fleet.providers.ansible.secrets`

Map of provider-config-key → SOPS path (docker TLS certs, etc.).

Type: attribute set of string

Default:

{ }

Declared by: nix/fleet/providers

`fleet.providers.ansible.source`

Terraform provider source address (e.g. hashicorp/random).

Type: string

Default: none (required when its feature is enabled)

Example:

"hashicorp/random"

Declared by: nix/fleet/providers

`fleet.providers.ansible.version`

Version constraint for required_providers.

Type: string

Default: none (required when its feature is enabled)

Example:

"3.6.2"

Declared by: nix/fleet/providers

`fleet.providers.cloudflare`

Cloudflare provider instances, keyed by name (e.g. prod).

Type: attribute set of (submodule)

Default:

{ }

Declared by: nix/fleet/providers

`fleet.providers.cloudflare.<name>.cluster`

Proxmox-cluster-specific info. Empty for non-Proxmox providers.

Type: submodule

Default:

{ }

Declared by: nix/fleet/providers

`fleet.providers.cloudflare.<name>.cluster.ha_manager`

Whether the cluster runs the PVE HA manager. Informational — not consumed by any emitter yet.

Type: boolean

Default:

false

Declared by: nix/fleet/providers

`fleet.providers.cloudflare.<name>.cluster.node_addresses`

Node name → SSH host used by out-of-band local-exec steps (fleet.compute..lxc_extra_conf). A node missing here is reached by its name.

Type: attribute set of string

Default:

{ }

Example:

{
  pve1 = "198.51.100.11";
  pve2 = "pve2.mgmt.example.internal";
}

Declared by: nix/fleet/providers

`fleet.providers.cloudflare.<name>.cluster.nodes`

Cluster member names. More than one entry makes the instance multi-node, which forces every compute entry on it to set node explicitly (validator-enforced).

Type: list of string

Default:

[ ]

Example:

[
  "pve-alpha"
  "pve-beta"
]

Declared by: nix/fleet/providers

`fleet.providers.cloudflare.<name>.cluster.primary_node`

Fallback placement target: compute/resource entries that leave node empty are provisioned here.

Type: string

Default:

""

Example:

"pve-alpha"

Declared by: nix/fleet/providers

`fleet.providers.cloudflare.<name>.destruction_policy`

strict: emit prevent_destroy=true on EVERY resource in this instance
standard: emit prevent_destroy=true only on stateful-tagged resources
permissive: emit prevent_destroy only on explicit protect=true

Type: one of "strict", "standard", "permissive"

Default:

"standard"

Declared by: nix/fleet/providers

`fleet.providers.cloudflare.<name>.endpoint`

API endpoint URL. Optional — provider may derive from secrets.

Type: null or string

Default:

null

Example:

"https://192.0.2.10:8006/"

Declared by: nix/fleet/providers

`fleet.providers.cloudflare.<name>.insecure`

Skip TLS verification (internal step-ca cert).

Type: boolean

Default:

true

Declared by: nix/fleet/providers

`fleet.providers.cloudflare.<name>.minVersion`

Lowest Proxmox VE major.minor this instance is expected to run. fleetkit’s zero-touch NixOS LXC first boot needs PVE 9 (its NixOS LXC setup plugin writes the guest’s eth0.network from the container’s net0 at create time); fleet pve status warns when the live node is older. Informational for non-PVE providers.

Type: string

Default:

"9.0"

Example:

"9.0"

Declared by: nix/fleet/providers

`fleet.providers.cloudflare.<name>.nodes`

Hypervisor members of this instance, as typed objects (mgmt_ip, placed machines). Complements cluster.nodes (names only); a name present in either counts as a member.

Type: attribute set of (submodule)

Default:

{ }

Declared by: nix/fleet/providers

`fleet.providers.cloudflare.<name>.nodes.<name>.mgmt_ip`

Management/API address of this hypervisor node. Feeds derived scrape targets when the node is not provides-linked to a fleet VM.

Type: null or string

Default:

null

Declared by: nix/fleet/providers

`fleet.providers.cloudflare.<name>.nodes.<name>.resources`

Machines placed on this node.

Type: submodule

Default:

{ }

Declared by: nix/fleet/providers

`fleet.providers.cloudflare.<name>.nodes.<name>.resources.lxc`

LXC containers placed on this node.

Type: attribute set of (open submodule of attribute set of raw value)

Default:

{ }

Declared by: nix/fleet/providers

`fleet.providers.cloudflare.<name>.nodes.<name>.resources.lxc.<name>.bootOrder`

XO VMs: explicit boot order (c=disk n=network d=dvd). null = derived from tags (transient ⇒ dnc). Replaces the tag heuristic as the authored form; emitted via the post-create fix hook either way.

Type: null or one of "cnd", "dnc"

Default:

null

Declared by: nix/fleet/providers

`fleet.providers.cloudflare.<name>.nodes.<name>.resources.lxc.<name>.env`

Logical environment label; with stack selects the leaf tf stack (“env.stack”).

Type: string

Default: none (required when its feature is enabled)

Example:

"platform"

Declared by: nix/fleet/providers

`fleet.providers.cloudflare.<name>.nodes.<name>.resources.lxc.<name>.nixos`

This machine’s NixOS module function ({ config, helpers, … }: { … }). Replaces the parallel fleet.hostsRegistry entry; null = not colmena-managed (installer-provisioned, non-NixOS, …).

Type: null or unspecified value

Default:

null

Declared by: nix/fleet/providers

`fleet.providers.cloudflare.<name>.nodes.<name>.resources.lxc.<name>.provides`

This machine IS a member of the named provider instance — the recursive estate link (a PVE node that is itself an XO VM). Drives derived defaults (hypervisor scrape targets) and makes the layer dependency queryable.

Type: null or string

Default:

null

Example:

"proxmox.skrybit-pve"

Declared by: nix/fleet/providers

`fleet.providers.cloudflare.<name>.nodes.<name>.resources.lxc.<name>.scope`

ADR-097: “estate” marks a singleton serving every fleet on this substrate (may derive from all fleets’ manifests); “fleet” (default) sees only its own namespace.

Type: one of "fleet", "estate"

Default:

"fleet"

Declared by: nix/fleet/providers

`fleet.providers.cloudflare.<name>.nodes.<name>.resources.lxc.<name>.secrets`

Secret declaration facet ({ file; instances. = { secrets.…; envPrefix?; … }; }). Instances declared here are implicitly consumed by THIS machine; shared/host-less secrets belong in fleet.secrets instead.

Type: null or (attribute set of raw value)

Default:

null

Declared by: nix/fleet/providers

`fleet.providers.cloudflare.<name>.nodes.<name>.resources.lxc.<name>.stack`

Stack grouping within env.

Type: string

Default: none (required when its feature is enabled)

Example:

"core"

Declared by: nix/fleet/providers

`fleet.providers.cloudflare.<name>.nodes.<name>.resources.vm`

KVM/QEMU VMs placed on this node.

Type: attribute set of (open submodule of attribute set of raw value)

Default:

{ }

Declared by: nix/fleet/providers

`fleet.providers.cloudflare.<name>.nodes.<name>.resources.vm.<name>.bootOrder`

XO VMs: explicit boot order (c=disk n=network d=dvd). null = derived from tags (transient ⇒ dnc). Replaces the tag heuristic as the authored form; emitted via the post-create fix hook either way.

Type: null or one of "cnd", "dnc"

Default:

null

Declared by: nix/fleet/providers

`fleet.providers.cloudflare.<name>.nodes.<name>.resources.vm.<name>.env`

Logical environment label; with stack selects the leaf tf stack (“env.stack”).

Type: string

Default: none (required when its feature is enabled)

Example:

"platform"

Declared by: nix/fleet/providers

`fleet.providers.cloudflare.<name>.nodes.<name>.resources.vm.<name>.nixos`

This machine’s NixOS module function ({ config, helpers, … }: { … }). Replaces the parallel fleet.hostsRegistry entry; null = not colmena-managed (installer-provisioned, non-NixOS, …).

Type: null or unspecified value

Default:

null

Declared by: nix/fleet/providers

`fleet.providers.cloudflare.<name>.nodes.<name>.resources.vm.<name>.provides`

This machine IS a member of the named provider instance — the recursive estate link (a PVE node that is itself an XO VM). Drives derived defaults (hypervisor scrape targets) and makes the layer dependency queryable.

Type: null or string

Default:

null

Example:

"proxmox.skrybit-pve"

Declared by: nix/fleet/providers

`fleet.providers.cloudflare.<name>.nodes.<name>.resources.vm.<name>.scope`

ADR-097: “estate” marks a singleton serving every fleet on this substrate (may derive from all fleets’ manifests); “fleet” (default) sees only its own namespace.

Type: one of "fleet", "estate"

Default:

"fleet"

Declared by: nix/fleet/providers

`fleet.providers.cloudflare.<name>.nodes.<name>.resources.vm.<name>.secrets`

Secret declaration facet ({ file; instances. = { secrets.…; envPrefix?; … }; }). Instances declared here are implicitly consumed by THIS machine; shared/host-less secrets belong in fleet.secrets instead.

Type: null or (attribute set of raw value)

Default:

null

Declared by: nix/fleet/providers

`fleet.providers.cloudflare.<name>.nodes.<name>.resources.vm.<name>.stack`

Stack grouping within env.

Type: string

Default: none (required when its feature is enabled)

Example:

"core"

Declared by: nix/fleet/providers

`fleet.providers.cloudflare.<name>.pool`

XCP-ng pool info (master host, primary SR/network). Empty for non-XO providers.

Type: attribute set

Default:

{ }

Declared by: nix/fleet/providers

`fleet.providers.cloudflare.<name>.resources`

Provider-scoped resources by kind — pools/acls/zones/checks per this provider’s kind map (v2-types.nix), plus lxc/vm.

Type: open submodule of attribute set of attribute set of attribute set of raw value

Default:

{ }

Declared by: nix/fleet/providers

`fleet.providers.cloudflare.<name>.resources.lxc`

Instance-scoped containers (single-node instances; multi-node clusters place under nodes.).

Type: attribute set of (open submodule of attribute set of raw value)

Default:

{ }

Declared by: nix/fleet/providers

`fleet.providers.cloudflare.<name>.resources.lxc.<name>.bootOrder`

XO VMs: explicit boot order (c=disk n=network d=dvd). null = derived from tags (transient ⇒ dnc). Replaces the tag heuristic as the authored form; emitted via the post-create fix hook either way.

Type: null or one of "cnd", "dnc"

Default:

null

Declared by: nix/fleet/providers

`fleet.providers.cloudflare.<name>.resources.lxc.<name>.env`

Logical environment label; with stack selects the leaf tf stack (“env.stack”).

Type: string

Default: none (required when its feature is enabled)

Example:

"platform"

Declared by: nix/fleet/providers

`fleet.providers.cloudflare.<name>.resources.lxc.<name>.nixos`

This machine’s NixOS module function ({ config, helpers, … }: { … }). Replaces the parallel fleet.hostsRegistry entry; null = not colmena-managed (installer-provisioned, non-NixOS, …).

Type: null or unspecified value

Default:

null

Declared by: nix/fleet/providers

`fleet.providers.cloudflare.<name>.resources.lxc.<name>.provides`

This machine IS a member of the named provider instance — the recursive estate link (a PVE node that is itself an XO VM). Drives derived defaults (hypervisor scrape targets) and makes the layer dependency queryable.

Type: null or string

Default:

null

Example:

"proxmox.skrybit-pve"

Declared by: nix/fleet/providers

`fleet.providers.cloudflare.<name>.resources.lxc.<name>.scope`

ADR-097: “estate” marks a singleton serving every fleet on this substrate (may derive from all fleets’ manifests); “fleet” (default) sees only its own namespace.

Type: one of "fleet", "estate"

Default:

"fleet"

Declared by: nix/fleet/providers

`fleet.providers.cloudflare.<name>.resources.lxc.<name>.secrets`

Secret declaration facet ({ file; instances. = { secrets.…; envPrefix?; … }; }). Instances declared here are implicitly consumed by THIS machine; shared/host-less secrets belong in fleet.secrets instead.

Type: null or (attribute set of raw value)

Default:

null

Declared by: nix/fleet/providers

`fleet.providers.cloudflare.<name>.resources.lxc.<name>.stack`

Stack grouping within env.

Type: string

Default: none (required when its feature is enabled)

Example:

"core"

Declared by: nix/fleet/providers

`fleet.providers.cloudflare.<name>.resources.vm`

Instance-scoped VMs (XO VMs are pool-placed, so they belong here).

Type: attribute set of (open submodule of attribute set of raw value)

Default:

{ }

Declared by: nix/fleet/providers

`fleet.providers.cloudflare.<name>.resources.vm.<name>.bootOrder`

XO VMs: explicit boot order (c=disk n=network d=dvd). null = derived from tags (transient ⇒ dnc). Replaces the tag heuristic as the authored form; emitted via the post-create fix hook either way.

Type: null or one of "cnd", "dnc"

Default:

null

Declared by: nix/fleet/providers

`fleet.providers.cloudflare.<name>.resources.vm.<name>.env`

Logical environment label; with stack selects the leaf tf stack (“env.stack”).

Type: string

Default: none (required when its feature is enabled)

Example:

"platform"

Declared by: nix/fleet/providers

`fleet.providers.cloudflare.<name>.resources.vm.<name>.nixos`

This machine’s NixOS module function ({ config, helpers, … }: { … }). Replaces the parallel fleet.hostsRegistry entry; null = not colmena-managed (installer-provisioned, non-NixOS, …).

Type: null or unspecified value

Default:

null

Declared by: nix/fleet/providers

`fleet.providers.cloudflare.<name>.resources.vm.<name>.provides`

This machine IS a member of the named provider instance — the recursive estate link (a PVE node that is itself an XO VM). Drives derived defaults (hypervisor scrape targets) and makes the layer dependency queryable.

Type: null or string

Default:

null

Example:

"proxmox.skrybit-pve"

Declared by: nix/fleet/providers

`fleet.providers.cloudflare.<name>.resources.vm.<name>.scope`

ADR-097: “estate” marks a singleton serving every fleet on this substrate (may derive from all fleets’ manifests); “fleet” (default) sees only its own namespace.

Type: one of "fleet", "estate"

Default:

"fleet"

Declared by: nix/fleet/providers

`fleet.providers.cloudflare.<name>.resources.vm.<name>.secrets`

Secret declaration facet ({ file; instances. = { secrets.…; envPrefix?; … }; }). Instances declared here are implicitly consumed by THIS machine; shared/host-less secrets belong in fleet.secrets instead.

Type: null or (attribute set of raw value)

Default:

null

Declared by: nix/fleet/providers

`fleet.providers.cloudflare.<name>.resources.vm.<name>.stack`

Stack grouping within env.

Type: string

Default: none (required when its feature is enabled)

Example:

"core"

Declared by: nix/fleet/providers

`fleet.providers.cloudflare.<name>.secrets`

Map of provider-config-key → SOPS path. Emitter resolves each to $${data.sops_file.secrets.data["<dotted-path>"]} so secrets never appear in config.tf.json.

Type: attribute set of string

Default:

{ }

Example:

{ api_token = "integrations/proxmox/api_token"; }

Declared by: nix/fleet/providers

`fleet.providers.cloudflare.<name>.source`

Terraform provider source address (e.g. bpg/proxmox).

Type: string

Default: none (required when its feature is enabled)

Example:

"bpg/proxmox"

Declared by: nix/fleet/providers

`fleet.providers.cloudflare.<name>.state.prefix`

S3 key prefix for this instance’s tfstate(s). Full path: s3://///terraform.tfstate

Type: string

Default: none (required when its feature is enabled)

Example:

"proxmox-dev"

Declared by: nix/fleet/providers

`fleet.providers.cloudflare.<name>.version`

Version constraint for required_providers.

Type: string

Default: none (required when its feature is enabled)

Example:

"0.66.3"

Declared by: nix/fleet/providers

`fleet.providers.cloudinit`

hashicorp/cloudinit — renders multipart cloud-config (for dev VMs / Debian first-boot).

Type: null or (submodule)

Default:

null

Declared by: nix/fleet/providers

`fleet.providers.cloudinit.endpoint`

Daemon/host URL — docker only (e.g. ssh://root@192.0.2.50 or tcp://host:2376).

Type: null or string

Default:

null

Example:

"ssh://root@192.0.2.50"

Declared by: nix/fleet/providers

`fleet.providers.cloudinit.secrets`

Map of provider-config-key → SOPS path (docker TLS certs, etc.).

Type: attribute set of string

Default:

{ }

Declared by: nix/fleet/providers

`fleet.providers.cloudinit.source`

Terraform provider source address (e.g. hashicorp/random).

Type: string

Default: none (required when its feature is enabled)

Example:

"hashicorp/random"

Declared by: nix/fleet/providers

`fleet.providers.cloudinit.version`

Version constraint for required_providers.

Type: string

Default: none (required when its feature is enabled)

Example:

"3.6.2"

Declared by: nix/fleet/providers

`fleet.providers.docker`

kreuzwerker/docker provider instances, keyed by daemon host. Manages docker RESOURCES (containers, images, networks, volumes) on a target daemon — NOT the daemon’s own config, which stays in the host’s NixOS module / cloud-init. Each instance’s endpoint is the daemon URL (ssh:// or tcp://).

Type: attribute set of (submodule)

Default:

{ }

Declared by: nix/fleet/providers

`fleet.providers.docker.<name>.endpoint`

Daemon/host URL — docker only (e.g. ssh://root@192.0.2.50 or tcp://host:2376).

Type: null or string

Default:

null

Example:

"ssh://root@192.0.2.50"

Declared by: nix/fleet/providers

`fleet.providers.docker.<name>.secrets`

Map of provider-config-key → SOPS path (docker TLS certs, etc.).

Type: attribute set of string

Default:

{ }

Declared by: nix/fleet/providers

`fleet.providers.docker.<name>.source`

Terraform provider source address (e.g. hashicorp/random).

Type: string

Default: none (required when its feature is enabled)

Example:

"hashicorp/random"

Declared by: nix/fleet/providers

`fleet.providers.docker.<name>.version`

Version constraint for required_providers.

Type: string

Default: none (required when its feature is enabled)

Example:

"3.6.2"

Declared by: nix/fleet/providers

`fleet.providers.grafana`

Grafana provider instances, keyed by name (e.g. cloud). Manages Grafana Cloud stack resources: synthetic monitoring checks, alerting contact points, notification templates (INFRA-144).

Type: attribute set of (submodule)

Default:

{ }

Declared by: nix/fleet/providers

`fleet.providers.grafana.<name>.cluster`

Proxmox-cluster-specific info. Empty for non-Proxmox providers.

Type: submodule

Default:

{ }

Declared by: nix/fleet/providers

`fleet.providers.grafana.<name>.cluster.ha_manager`

Whether the cluster runs the PVE HA manager. Informational — not consumed by any emitter yet.

Type: boolean

Default:

false

Declared by: nix/fleet/providers

`fleet.providers.grafana.<name>.cluster.node_addresses`

Node name → SSH host used by out-of-band local-exec steps (fleet.compute..lxc_extra_conf). A node missing here is reached by its name.

Type: attribute set of string

Default:

{ }

Example:

{
  pve1 = "198.51.100.11";
  pve2 = "pve2.mgmt.example.internal";
}

Declared by: nix/fleet/providers

`fleet.providers.grafana.<name>.cluster.nodes`

Cluster member names. More than one entry makes the instance multi-node, which forces every compute entry on it to set node explicitly (validator-enforced).

Type: list of string

Default:

[ ]

Example:

[
  "pve-alpha"
  "pve-beta"
]

Declared by: nix/fleet/providers

`fleet.providers.grafana.<name>.cluster.primary_node`

Fallback placement target: compute/resource entries that leave node empty are provisioned here.

Type: string

Default:

""

Example:

"pve-alpha"

Declared by: nix/fleet/providers

`fleet.providers.grafana.<name>.destruction_policy`

strict: emit prevent_destroy=true on EVERY resource in this instance
standard: emit prevent_destroy=true only on stateful-tagged resources
permissive: emit prevent_destroy only on explicit protect=true

Type: one of "strict", "standard", "permissive"

Default:

"standard"

Declared by: nix/fleet/providers

`fleet.providers.grafana.<name>.endpoint`

API endpoint URL. Optional — provider may derive from secrets.

Type: null or string

Default:

null

Example:

"https://192.0.2.10:8006/"

Declared by: nix/fleet/providers

`fleet.providers.grafana.<name>.insecure`

Skip TLS verification (internal step-ca cert).

Type: boolean

Default:

true

Declared by: nix/fleet/providers

`fleet.providers.grafana.<name>.minVersion`

Lowest Proxmox VE major.minor this instance is expected to run. fleetkit’s zero-touch NixOS LXC first boot needs PVE 9 (its NixOS LXC setup plugin writes the guest’s eth0.network from the container’s net0 at create time); fleet pve status warns when the live node is older. Informational for non-PVE providers.

Type: string

Default:

"9.0"

Example:

"9.0"

Declared by: nix/fleet/providers

`fleet.providers.grafana.<name>.nodes`

Hypervisor members of this instance, as typed objects (mgmt_ip, placed machines). Complements cluster.nodes (names only); a name present in either counts as a member.

Type: attribute set of (submodule)

Default:

{ }

Declared by: nix/fleet/providers

`fleet.providers.grafana.<name>.nodes.<name>.mgmt_ip`

Management/API address of this hypervisor node. Feeds derived scrape targets when the node is not provides-linked to a fleet VM.

Type: null or string

Default:

null

Declared by: nix/fleet/providers

`fleet.providers.grafana.<name>.nodes.<name>.resources`

Machines placed on this node.

Type: submodule

Default:

{ }

Declared by: nix/fleet/providers

`fleet.providers.grafana.<name>.nodes.<name>.resources.lxc`

LXC containers placed on this node.

Type: attribute set of (open submodule of attribute set of raw value)

Default:

{ }

Declared by: nix/fleet/providers

`fleet.providers.grafana.<name>.nodes.<name>.resources.lxc.<name>.bootOrder`

XO VMs: explicit boot order (c=disk n=network d=dvd). null = derived from tags (transient ⇒ dnc). Replaces the tag heuristic as the authored form; emitted via the post-create fix hook either way.

Type: null or one of "cnd", "dnc"

Default:

null

Declared by: nix/fleet/providers

`fleet.providers.grafana.<name>.nodes.<name>.resources.lxc.<name>.env`

Logical environment label; with stack selects the leaf tf stack (“env.stack”).

Type: string

Default: none (required when its feature is enabled)

Example:

"platform"

Declared by: nix/fleet/providers

`fleet.providers.grafana.<name>.nodes.<name>.resources.lxc.<name>.nixos`

This machine’s NixOS module function ({ config, helpers, … }: { … }). Replaces the parallel fleet.hostsRegistry entry; null = not colmena-managed (installer-provisioned, non-NixOS, …).

Type: null or unspecified value

Default:

null

Declared by: nix/fleet/providers

`fleet.providers.grafana.<name>.nodes.<name>.resources.lxc.<name>.provides`

This machine IS a member of the named provider instance — the recursive estate link (a PVE node that is itself an XO VM). Drives derived defaults (hypervisor scrape targets) and makes the layer dependency queryable.

Type: null or string

Default:

null

Example:

"proxmox.skrybit-pve"

Declared by: nix/fleet/providers

`fleet.providers.grafana.<name>.nodes.<name>.resources.lxc.<name>.scope`

ADR-097: “estate” marks a singleton serving every fleet on this substrate (may derive from all fleets’ manifests); “fleet” (default) sees only its own namespace.

Type: one of "fleet", "estate"

Default:

"fleet"

Declared by: nix/fleet/providers

`fleet.providers.grafana.<name>.nodes.<name>.resources.lxc.<name>.secrets`

Secret declaration facet ({ file; instances. = { secrets.…; envPrefix?; … }; }). Instances declared here are implicitly consumed by THIS machine; shared/host-less secrets belong in fleet.secrets instead.

Type: null or (attribute set of raw value)

Default:

null

Declared by: nix/fleet/providers

`fleet.providers.grafana.<name>.nodes.<name>.resources.lxc.<name>.stack`

Stack grouping within env.

Type: string

Default: none (required when its feature is enabled)

Example:

"core"

Declared by: nix/fleet/providers

`fleet.providers.grafana.<name>.nodes.<name>.resources.vm`

KVM/QEMU VMs placed on this node.

Type: attribute set of (open submodule of attribute set of raw value)

Default:

{ }

Declared by: nix/fleet/providers

`fleet.providers.grafana.<name>.nodes.<name>.resources.vm.<name>.bootOrder`

XO VMs: explicit boot order (c=disk n=network d=dvd). null = derived from tags (transient ⇒ dnc). Replaces the tag heuristic as the authored form; emitted via the post-create fix hook either way.

Type: null or one of "cnd", "dnc"

Default:

null

Declared by: nix/fleet/providers

`fleet.providers.grafana.<name>.nodes.<name>.resources.vm.<name>.env`

Logical environment label; with stack selects the leaf tf stack (“env.stack”).

Type: string

Default: none (required when its feature is enabled)

Example:

"platform"

Declared by: nix/fleet/providers

`fleet.providers.grafana.<name>.nodes.<name>.resources.vm.<name>.nixos`

This machine’s NixOS module function ({ config, helpers, … }: { … }). Replaces the parallel fleet.hostsRegistry entry; null = not colmena-managed (installer-provisioned, non-NixOS, …).

Type: null or unspecified value

Default:

null

Declared by: nix/fleet/providers

`fleet.providers.grafana.<name>.nodes.<name>.resources.vm.<name>.provides`

This machine IS a member of the named provider instance — the recursive estate link (a PVE node that is itself an XO VM). Drives derived defaults (hypervisor scrape targets) and makes the layer dependency queryable.

Type: null or string

Default:

null

Example:

"proxmox.skrybit-pve"

Declared by: nix/fleet/providers

`fleet.providers.grafana.<name>.nodes.<name>.resources.vm.<name>.scope`

ADR-097: “estate” marks a singleton serving every fleet on this substrate (may derive from all fleets’ manifests); “fleet” (default) sees only its own namespace.

Type: one of "fleet", "estate"

Default:

"fleet"

Declared by: nix/fleet/providers

`fleet.providers.grafana.<name>.nodes.<name>.resources.vm.<name>.secrets`

Secret declaration facet ({ file; instances. = { secrets.…; envPrefix?; … }; }). Instances declared here are implicitly consumed by THIS machine; shared/host-less secrets belong in fleet.secrets instead.

Type: null or (attribute set of raw value)

Default:

null

Declared by: nix/fleet/providers

`fleet.providers.grafana.<name>.nodes.<name>.resources.vm.<name>.stack`

Stack grouping within env.

Type: string

Default: none (required when its feature is enabled)

Example:

"core"

Declared by: nix/fleet/providers

`fleet.providers.grafana.<name>.pool`

XCP-ng pool info (master host, primary SR/network). Empty for non-XO providers.

Type: attribute set

Default:

{ }

Declared by: nix/fleet/providers

`fleet.providers.grafana.<name>.resources`

Provider-scoped resources by kind — pools/acls/zones/checks per this provider’s kind map (v2-types.nix), plus lxc/vm.

Type: open submodule of attribute set of attribute set of attribute set of raw value

Default:

{ }

Declared by: nix/fleet/providers

`fleet.providers.grafana.<name>.resources.lxc`

Instance-scoped containers (single-node instances; multi-node clusters place under nodes.).

Type: attribute set of (open submodule of attribute set of raw value)

Default:

{ }

Declared by: nix/fleet/providers

`fleet.providers.grafana.<name>.resources.lxc.<name>.bootOrder`

XO VMs: explicit boot order (c=disk n=network d=dvd). null = derived from tags (transient ⇒ dnc). Replaces the tag heuristic as the authored form; emitted via the post-create fix hook either way.

Type: null or one of "cnd", "dnc"

Default:

null

Declared by: nix/fleet/providers

`fleet.providers.grafana.<name>.resources.lxc.<name>.env`

Logical environment label; with stack selects the leaf tf stack (“env.stack”).

Type: string

Default: none (required when its feature is enabled)

Example:

"platform"

Declared by: nix/fleet/providers

`fleet.providers.grafana.<name>.resources.lxc.<name>.nixos`

This machine’s NixOS module function ({ config, helpers, … }: { … }). Replaces the parallel fleet.hostsRegistry entry; null = not colmena-managed (installer-provisioned, non-NixOS, …).

Type: null or unspecified value

Default:

null

Declared by: nix/fleet/providers

`fleet.providers.grafana.<name>.resources.lxc.<name>.provides`

This machine IS a member of the named provider instance — the recursive estate link (a PVE node that is itself an XO VM). Drives derived defaults (hypervisor scrape targets) and makes the layer dependency queryable.

Type: null or string

Default:

null

Example:

"proxmox.skrybit-pve"

Declared by: nix/fleet/providers

`fleet.providers.grafana.<name>.resources.lxc.<name>.scope`

ADR-097: “estate” marks a singleton serving every fleet on this substrate (may derive from all fleets’ manifests); “fleet” (default) sees only its own namespace.

Type: one of "fleet", "estate"

Default:

"fleet"

Declared by: nix/fleet/providers

`fleet.providers.grafana.<name>.resources.lxc.<name>.secrets`

Secret declaration facet ({ file; instances. = { secrets.…; envPrefix?; … }; }). Instances declared here are implicitly consumed by THIS machine; shared/host-less secrets belong in fleet.secrets instead.

Type: null or (attribute set of raw value)

Default:

null

Declared by: nix/fleet/providers

`fleet.providers.grafana.<name>.resources.lxc.<name>.stack`

Stack grouping within env.

Type: string

Default: none (required when its feature is enabled)

Example:

"core"

Declared by: nix/fleet/providers

`fleet.providers.grafana.<name>.resources.vm`

Instance-scoped VMs (XO VMs are pool-placed, so they belong here).

Type: attribute set of (open submodule of attribute set of raw value)

Default:

{ }

Declared by: nix/fleet/providers

`fleet.providers.grafana.<name>.resources.vm.<name>.bootOrder`

XO VMs: explicit boot order (c=disk n=network d=dvd). null = derived from tags (transient ⇒ dnc). Replaces the tag heuristic as the authored form; emitted via the post-create fix hook either way.

Type: null or one of "cnd", "dnc"

Default:

null

Declared by: nix/fleet/providers

`fleet.providers.grafana.<name>.resources.vm.<name>.env`

Logical environment label; with stack selects the leaf tf stack (“env.stack”).

Type: string

Default: none (required when its feature is enabled)

Example:

"platform"

Declared by: nix/fleet/providers

`fleet.providers.grafana.<name>.resources.vm.<name>.nixos`

This machine’s NixOS module function ({ config, helpers, … }: { … }). Replaces the parallel fleet.hostsRegistry entry; null = not colmena-managed (installer-provisioned, non-NixOS, …).

Type: null or unspecified value

Default:

null

Declared by: nix/fleet/providers

`fleet.providers.grafana.<name>.resources.vm.<name>.provides`

This machine IS a member of the named provider instance — the recursive estate link (a PVE node that is itself an XO VM). Drives derived defaults (hypervisor scrape targets) and makes the layer dependency queryable.

Type: null or string

Default:

null

Example:

"proxmox.skrybit-pve"

Declared by: nix/fleet/providers

`fleet.providers.grafana.<name>.resources.vm.<name>.scope`

ADR-097: “estate” marks a singleton serving every fleet on this substrate (may derive from all fleets’ manifests); “fleet” (default) sees only its own namespace.

Type: one of "fleet", "estate"

Default:

"fleet"

Declared by: nix/fleet/providers

`fleet.providers.grafana.<name>.resources.vm.<name>.secrets`

Secret declaration facet ({ file; instances. = { secrets.…; envPrefix?; … }; }). Instances declared here are implicitly consumed by THIS machine; shared/host-less secrets belong in fleet.secrets instead.

Type: null or (attribute set of raw value)

Default:

null

Declared by: nix/fleet/providers

`fleet.providers.grafana.<name>.resources.vm.<name>.stack`

Stack grouping within env.

Type: string

Default: none (required when its feature is enabled)

Example:

"core"

Declared by: nix/fleet/providers

`fleet.providers.grafana.<name>.secrets`

Map of provider-config-key → SOPS path. Emitter resolves each to $${data.sops_file.secrets.data["<dotted-path>"]} so secrets never appear in config.tf.json.

Type: attribute set of string

Default:

{ }

Example:

{ api_token = "integrations/proxmox/api_token"; }

Declared by: nix/fleet/providers

`fleet.providers.grafana.<name>.source`

Terraform provider source address (e.g. bpg/proxmox).

Type: string

Default: none (required when its feature is enabled)

Example:

"bpg/proxmox"

Declared by: nix/fleet/providers

`fleet.providers.grafana.<name>.state.prefix`

S3 key prefix for this instance’s tfstate(s). Full path: s3://///terraform.tfstate

Type: string

Default: none (required when its feature is enabled)

Example:

"proxmox-dev"

Declared by: nix/fleet/providers

`fleet.providers.grafana.<name>.version`

Version constraint for required_providers.

Type: string

Default: none (required when its feature is enabled)

Example:

"0.66.3"

Declared by: nix/fleet/providers

`fleet.providers.proxmox`

Proxmox provider instances, keyed by name (e.g. prod, dev).

Type: attribute set of (submodule)

Default:

{ }

Example:

{
  dev = {
    source = "bpg/proxmox";
    version = "0.66.3";
    endpoint = "https://192.0.2.10:8006/";
    secrets.api_token = "integrations/proxmox/api_token";
    state.prefix = "proxmox-dev";
    cluster.primary_node = "pve";
  };
}

Declared by: nix/fleet/providers

`fleet.providers.proxmox-backup-server`

Proxmox Backup Server provider instances, keyed by name. Separate from proxmox because PBS runs on a different daemon (port 8007) and uses a different provider (Tinyblargon/proxmox-backup-server).

Type: attribute set of (submodule)

Default:

{ }

Declared by: nix/fleet/providers

`fleet.providers.proxmox-backup-server.<name>.cluster`

Proxmox-cluster-specific info. Empty for non-Proxmox providers.

Type: submodule

Default:

{ }

Declared by: nix/fleet/providers

`fleet.providers.proxmox-backup-server.<name>.cluster.ha_manager`

Whether the cluster runs the PVE HA manager. Informational — not consumed by any emitter yet.

Type: boolean

Default:

false

Declared by: nix/fleet/providers

`fleet.providers.proxmox-backup-server.<name>.cluster.node_addresses`

Node name → SSH host used by out-of-band local-exec steps (fleet.compute..lxc_extra_conf). A node missing here is reached by its name.

Type: attribute set of string

Default:

{ }

Example:

{
  pve1 = "198.51.100.11";
  pve2 = "pve2.mgmt.example.internal";
}

Declared by: nix/fleet/providers

`fleet.providers.proxmox-backup-server.<name>.cluster.nodes`

Cluster member names. More than one entry makes the instance multi-node, which forces every compute entry on it to set node explicitly (validator-enforced).

Type: list of string

Default:

[ ]

Example:

[
  "pve-alpha"
  "pve-beta"
]

Declared by: nix/fleet/providers

`fleet.providers.proxmox-backup-server.<name>.cluster.primary_node`

Fallback placement target: compute/resource entries that leave node empty are provisioned here.

Type: string

Default:

""

Example:

"pve-alpha"

Declared by: nix/fleet/providers

`fleet.providers.proxmox-backup-server.<name>.destruction_policy`

strict: emit prevent_destroy=true on EVERY resource in this instance
standard: emit prevent_destroy=true only on stateful-tagged resources
permissive: emit prevent_destroy only on explicit protect=true

Type: one of "strict", "standard", "permissive"

Default:

"standard"

Declared by: nix/fleet/providers

`fleet.providers.proxmox-backup-server.<name>.endpoint`

API endpoint URL. Optional — provider may derive from secrets.

Type: null or string

Default:

null

Example:

"https://192.0.2.10:8006/"

Declared by: nix/fleet/providers

`fleet.providers.proxmox-backup-server.<name>.insecure`

Skip TLS verification (internal step-ca cert).

Type: boolean

Default:

true

Declared by: nix/fleet/providers

`fleet.providers.proxmox-backup-server.<name>.minVersion`

Lowest Proxmox VE major.minor this instance is expected to run. fleetkit’s zero-touch NixOS LXC first boot needs PVE 9 (its NixOS LXC setup plugin writes the guest’s eth0.network from the container’s net0 at create time); fleet pve status warns when the live node is older. Informational for non-PVE providers.

Type: string

Default:

"9.0"

Example:

"9.0"

Declared by: nix/fleet/providers

`fleet.providers.proxmox-backup-server.<name>.nodes`

Hypervisor members of this instance, as typed objects (mgmt_ip, placed machines). Complements cluster.nodes (names only); a name present in either counts as a member.

Type: attribute set of (submodule)

Default:

{ }

Declared by: nix/fleet/providers

`fleet.providers.proxmox-backup-server.<name>.nodes.<name>.mgmt_ip`

Management/API address of this hypervisor node. Feeds derived scrape targets when the node is not provides-linked to a fleet VM.

Type: null or string

Default:

null

Declared by: nix/fleet/providers

`fleet.providers.proxmox-backup-server.<name>.nodes.<name>.resources`

Machines placed on this node.

Type: submodule

Default:

{ }

Declared by: nix/fleet/providers

`fleet.providers.proxmox-backup-server.<name>.nodes.<name>.resources.lxc`

LXC containers placed on this node.

Type: attribute set of (open submodule of attribute set of raw value)

Default:

{ }

Declared by: nix/fleet/providers

`fleet.providers.proxmox-backup-server.<name>.nodes.<name>.resources.lxc.<name>.bootOrder`

XO VMs: explicit boot order (c=disk n=network d=dvd). null = derived from tags (transient ⇒ dnc). Replaces the tag heuristic as the authored form; emitted via the post-create fix hook either way.

Type: null or one of "cnd", "dnc"

Default:

null

Declared by: nix/fleet/providers

`fleet.providers.proxmox-backup-server.<name>.nodes.<name>.resources.lxc.<name>.env`

Logical environment label; with stack selects the leaf tf stack (“env.stack”).

Type: string

Default: none (required when its feature is enabled)

Example:

"platform"

Declared by: nix/fleet/providers

`fleet.providers.proxmox-backup-server.<name>.nodes.<name>.resources.lxc.<name>.nixos`

This machine’s NixOS module function ({ config, helpers, … }: { … }). Replaces the parallel fleet.hostsRegistry entry; null = not colmena-managed (installer-provisioned, non-NixOS, …).

Type: null or unspecified value

Default:

null

Declared by: nix/fleet/providers

`fleet.providers.proxmox-backup-server.<name>.nodes.<name>.resources.lxc.<name>.provides`

This machine IS a member of the named provider instance — the recursive estate link (a PVE node that is itself an XO VM). Drives derived defaults (hypervisor scrape targets) and makes the layer dependency queryable.

Type: null or string

Default:

null

Example:

"proxmox.skrybit-pve"

Declared by: nix/fleet/providers

`fleet.providers.proxmox-backup-server.<name>.nodes.<name>.resources.lxc.<name>.scope`

ADR-097: “estate” marks a singleton serving every fleet on this substrate (may derive from all fleets’ manifests); “fleet” (default) sees only its own namespace.

Type: one of "fleet", "estate"

Default:

"fleet"

Declared by: nix/fleet/providers

`fleet.providers.proxmox-backup-server.<name>.nodes.<name>.resources.lxc.<name>.secrets`

Secret declaration facet ({ file; instances. = { secrets.…; envPrefix?; … }; }). Instances declared here are implicitly consumed by THIS machine; shared/host-less secrets belong in fleet.secrets instead.

Type: null or (attribute set of raw value)

Default:

null

Declared by: nix/fleet/providers

`fleet.providers.proxmox-backup-server.<name>.nodes.<name>.resources.lxc.<name>.stack`

Stack grouping within env.

Type: string

Default: none (required when its feature is enabled)

Example:

"core"

Declared by: nix/fleet/providers

`fleet.providers.proxmox-backup-server.<name>.nodes.<name>.resources.vm`

KVM/QEMU VMs placed on this node.

Type: attribute set of (open submodule of attribute set of raw value)

Default:

{ }

Declared by: nix/fleet/providers

`fleet.providers.proxmox-backup-server.<name>.nodes.<name>.resources.vm.<name>.bootOrder`

XO VMs: explicit boot order (c=disk n=network d=dvd). null = derived from tags (transient ⇒ dnc). Replaces the tag heuristic as the authored form; emitted via the post-create fix hook either way.

Type: null or one of "cnd", "dnc"

Default:

null

Declared by: nix/fleet/providers

`fleet.providers.proxmox-backup-server.<name>.nodes.<name>.resources.vm.<name>.env`

Logical environment label; with stack selects the leaf tf stack (“env.stack”).

Type: string

Default: none (required when its feature is enabled)

Example:

"platform"

Declared by: nix/fleet/providers

`fleet.providers.proxmox-backup-server.<name>.nodes.<name>.resources.vm.<name>.nixos`

This machine’s NixOS module function ({ config, helpers, … }: { … }). Replaces the parallel fleet.hostsRegistry entry; null = not colmena-managed (installer-provisioned, non-NixOS, …).

Type: null or unspecified value

Default:

null

Declared by: nix/fleet/providers

`fleet.providers.proxmox-backup-server.<name>.nodes.<name>.resources.vm.<name>.provides`

This machine IS a member of the named provider instance — the recursive estate link (a PVE node that is itself an XO VM). Drives derived defaults (hypervisor scrape targets) and makes the layer dependency queryable.

Type: null or string

Default:

null

Example:

"proxmox.skrybit-pve"

Declared by: nix/fleet/providers

`fleet.providers.proxmox-backup-server.<name>.nodes.<name>.resources.vm.<name>.scope`

ADR-097: “estate” marks a singleton serving every fleet on this substrate (may derive from all fleets’ manifests); “fleet” (default) sees only its own namespace.

Type: one of "fleet", "estate"

Default:

"fleet"

Declared by: nix/fleet/providers

`fleet.providers.proxmox-backup-server.<name>.nodes.<name>.resources.vm.<name>.secrets`

Secret declaration facet ({ file; instances. = { secrets.…; envPrefix?; … }; }). Instances declared here are implicitly consumed by THIS machine; shared/host-less secrets belong in fleet.secrets instead.

Type: null or (attribute set of raw value)

Default:

null

Declared by: nix/fleet/providers

`fleet.providers.proxmox-backup-server.<name>.nodes.<name>.resources.vm.<name>.stack`

Stack grouping within env.

Type: string

Default: none (required when its feature is enabled)

Example:

"core"

Declared by: nix/fleet/providers

`fleet.providers.proxmox-backup-server.<name>.pool`

XCP-ng pool info (master host, primary SR/network). Empty for non-XO providers.

Type: attribute set

Default:

{ }

Declared by: nix/fleet/providers

`fleet.providers.proxmox-backup-server.<name>.resources`

Provider-scoped resources by kind — pools/acls/zones/checks per this provider’s kind map (v2-types.nix), plus lxc/vm.

Type: open submodule of attribute set of attribute set of attribute set of raw value

Default:

{ }

Declared by: nix/fleet/providers

`fleet.providers.proxmox-backup-server.<name>.resources.lxc`

Instance-scoped containers (single-node instances; multi-node clusters place under nodes.).

Type: attribute set of (open submodule of attribute set of raw value)

Default:

{ }

Declared by: nix/fleet/providers

`fleet.providers.proxmox-backup-server.<name>.resources.lxc.<name>.bootOrder`

XO VMs: explicit boot order (c=disk n=network d=dvd). null = derived from tags (transient ⇒ dnc). Replaces the tag heuristic as the authored form; emitted via the post-create fix hook either way.

Type: null or one of "cnd", "dnc"

Default:

null

Declared by: nix/fleet/providers

`fleet.providers.proxmox-backup-server.<name>.resources.lxc.<name>.env`

Logical environment label; with stack selects the leaf tf stack (“env.stack”).

Type: string

Default: none (required when its feature is enabled)

Example:

"platform"

Declared by: nix/fleet/providers

`fleet.providers.proxmox-backup-server.<name>.resources.lxc.<name>.nixos`

This machine’s NixOS module function ({ config, helpers, … }: { … }). Replaces the parallel fleet.hostsRegistry entry; null = not colmena-managed (installer-provisioned, non-NixOS, …).

Type: null or unspecified value

Default:

null

Declared by: nix/fleet/providers

`fleet.providers.proxmox-backup-server.<name>.resources.lxc.<name>.provides`

This machine IS a member of the named provider instance — the recursive estate link (a PVE node that is itself an XO VM). Drives derived defaults (hypervisor scrape targets) and makes the layer dependency queryable.

Type: null or string

Default:

null

Example:

"proxmox.skrybit-pve"

Declared by: nix/fleet/providers

`fleet.providers.proxmox-backup-server.<name>.resources.lxc.<name>.scope`

ADR-097: “estate” marks a singleton serving every fleet on this substrate (may derive from all fleets’ manifests); “fleet” (default) sees only its own namespace.

Type: one of "fleet", "estate"

Default:

"fleet"

Declared by: nix/fleet/providers

`fleet.providers.proxmox-backup-server.<name>.resources.lxc.<name>.secrets`

Secret declaration facet ({ file; instances. = { secrets.…; envPrefix?; … }; }). Instances declared here are implicitly consumed by THIS machine; shared/host-less secrets belong in fleet.secrets instead.

Type: null or (attribute set of raw value)

Default:

null

Declared by: nix/fleet/providers

`fleet.providers.proxmox-backup-server.<name>.resources.lxc.<name>.stack`

Stack grouping within env.

Type: string

Default: none (required when its feature is enabled)

Example:

"core"

Declared by: nix/fleet/providers

`fleet.providers.proxmox-backup-server.<name>.resources.vm`

Instance-scoped VMs (XO VMs are pool-placed, so they belong here).

Type: attribute set of (open submodule of attribute set of raw value)

Default:

{ }

Declared by: nix/fleet/providers

`fleet.providers.proxmox-backup-server.<name>.resources.vm.<name>.bootOrder`

XO VMs: explicit boot order (c=disk n=network d=dvd). null = derived from tags (transient ⇒ dnc). Replaces the tag heuristic as the authored form; emitted via the post-create fix hook either way.

Type: null or one of "cnd", "dnc"

Default:

null

Declared by: nix/fleet/providers

`fleet.providers.proxmox-backup-server.<name>.resources.vm.<name>.env`

Logical environment label; with stack selects the leaf tf stack (“env.stack”).

Type: string

Default: none (required when its feature is enabled)

Example:

"platform"

Declared by: nix/fleet/providers

`fleet.providers.proxmox-backup-server.<name>.resources.vm.<name>.nixos`

This machine’s NixOS module function ({ config, helpers, … }: { … }). Replaces the parallel fleet.hostsRegistry entry; null = not colmena-managed (installer-provisioned, non-NixOS, …).

Type: null or unspecified value

Default:

null

Declared by: nix/fleet/providers

`fleet.providers.proxmox-backup-server.<name>.resources.vm.<name>.provides`

This machine IS a member of the named provider instance — the recursive estate link (a PVE node that is itself an XO VM). Drives derived defaults (hypervisor scrape targets) and makes the layer dependency queryable.

Type: null or string

Default:

null

Example:

"proxmox.skrybit-pve"

Declared by: nix/fleet/providers

`fleet.providers.proxmox-backup-server.<name>.resources.vm.<name>.scope`

ADR-097: “estate” marks a singleton serving every fleet on this substrate (may derive from all fleets’ manifests); “fleet” (default) sees only its own namespace.

Type: one of "fleet", "estate"

Default:

"fleet"

Declared by: nix/fleet/providers

`fleet.providers.proxmox-backup-server.<name>.resources.vm.<name>.secrets`

Secret declaration facet ({ file; instances. = { secrets.…; envPrefix?; … }; }). Instances declared here are implicitly consumed by THIS machine; shared/host-less secrets belong in fleet.secrets instead.

Type: null or (attribute set of raw value)

Default:

null

Declared by: nix/fleet/providers

`fleet.providers.proxmox-backup-server.<name>.resources.vm.<name>.stack`

Stack grouping within env.

Type: string

Default: none (required when its feature is enabled)

Example:

"core"

Declared by: nix/fleet/providers

`fleet.providers.proxmox-backup-server.<name>.secrets`

Map of provider-config-key → SOPS path. Emitter resolves each to $${data.sops_file.secrets.data["<dotted-path>"]} so secrets never appear in config.tf.json.

Type: attribute set of string

Default:

{ }

Example:

{ api_token = "integrations/proxmox/api_token"; }

Declared by: nix/fleet/providers

`fleet.providers.proxmox-backup-server.<name>.source`

Terraform provider source address (e.g. bpg/proxmox).

Type: string

Default: none (required when its feature is enabled)

Example:

"bpg/proxmox"

Declared by: nix/fleet/providers

`fleet.providers.proxmox-backup-server.<name>.state.prefix`

S3 key prefix for this instance’s tfstate(s). Full path: s3://///terraform.tfstate

Type: string

Default: none (required when its feature is enabled)

Example:

"proxmox-dev"

Declared by: nix/fleet/providers

`fleet.providers.proxmox-backup-server.<name>.version`

Version constraint for required_providers.

Type: string

Default: none (required when its feature is enabled)

Example:

"0.66.3"

Declared by: nix/fleet/providers

`fleet.providers.proxmox.<name>.cluster`

Proxmox-cluster-specific info. Empty for non-Proxmox providers.

Type: submodule

Default:

{ }

Declared by: nix/fleet/providers

`fleet.providers.proxmox.<name>.cluster.ha_manager`

Whether the cluster runs the PVE HA manager. Informational — not consumed by any emitter yet.

Type: boolean

Default:

false

Declared by: nix/fleet/providers

`fleet.providers.proxmox.<name>.cluster.node_addresses`

Node name → SSH host used by out-of-band local-exec steps (fleet.compute..lxc_extra_conf). A node missing here is reached by its name.

Type: attribute set of string

Default:

{ }

Example:

{
  pve1 = "198.51.100.11";
  pve2 = "pve2.mgmt.example.internal";
}

Declared by: nix/fleet/providers

`fleet.providers.proxmox.<name>.cluster.nodes`

Cluster member names. More than one entry makes the instance multi-node, which forces every compute entry on it to set node explicitly (validator-enforced).

Type: list of string

Default:

[ ]

Example:

[
  "pve-alpha"
  "pve-beta"
]

Declared by: nix/fleet/providers

`fleet.providers.proxmox.<name>.cluster.primary_node`

Fallback placement target: compute/resource entries that leave node empty are provisioned here.

Type: string

Default:

""

Example:

"pve-alpha"

Declared by: nix/fleet/providers

`fleet.providers.proxmox.<name>.destruction_policy`

strict: emit prevent_destroy=true on EVERY resource in this instance
standard: emit prevent_destroy=true only on stateful-tagged resources
permissive: emit prevent_destroy only on explicit protect=true

Type: one of "strict", "standard", "permissive"

Default:

"standard"

Declared by: nix/fleet/providers

`fleet.providers.proxmox.<name>.endpoint`

API endpoint URL. Optional — provider may derive from secrets.

Type: null or string

Default:

null

Example:

"https://192.0.2.10:8006/"

Declared by: nix/fleet/providers

`fleet.providers.proxmox.<name>.insecure`

Skip TLS verification (internal step-ca cert).

Type: boolean

Default:

true

Declared by: nix/fleet/providers

`fleet.providers.proxmox.<name>.minVersion`

Lowest Proxmox VE major.minor this instance is expected to run. fleetkit’s zero-touch NixOS LXC first boot needs PVE 9 (its NixOS LXC setup plugin writes the guest’s eth0.network from the container’s net0 at create time); fleet pve status warns when the live node is older. Informational for non-PVE providers.

Type: string

Default:

"9.0"

Example:

"9.0"

Declared by: nix/fleet/providers

`fleet.providers.proxmox.<name>.nodes`

Hypervisor members of this instance, as typed objects (mgmt_ip, placed machines). Complements cluster.nodes (names only); a name present in either counts as a member.

Type: attribute set of (submodule)

Default:

{ }

Declared by: nix/fleet/providers

`fleet.providers.proxmox.<name>.nodes.<name>.mgmt_ip`

Management/API address of this hypervisor node. Feeds derived scrape targets when the node is not provides-linked to a fleet VM.

Type: null or string

Default:

null

Declared by: nix/fleet/providers

`fleet.providers.proxmox.<name>.nodes.<name>.resources`

Machines placed on this node.

Type: submodule

Default:

{ }

Declared by: nix/fleet/providers

`fleet.providers.proxmox.<name>.nodes.<name>.resources.lxc`

LXC containers placed on this node.

Type: attribute set of (open submodule of attribute set of raw value)

Default:

{ }

Declared by: nix/fleet/providers

`fleet.providers.proxmox.<name>.nodes.<name>.resources.lxc.<name>.bootOrder`

XO VMs: explicit boot order (c=disk n=network d=dvd). null = derived from tags (transient ⇒ dnc). Replaces the tag heuristic as the authored form; emitted via the post-create fix hook either way.

Type: null or one of "cnd", "dnc"

Default:

null

Declared by: nix/fleet/providers

`fleet.providers.proxmox.<name>.nodes.<name>.resources.lxc.<name>.env`

Logical environment label; with stack selects the leaf tf stack (“env.stack”).

Type: string

Default: none (required when its feature is enabled)

Example:

"platform"

Declared by: nix/fleet/providers

`fleet.providers.proxmox.<name>.nodes.<name>.resources.lxc.<name>.nixos`

This machine’s NixOS module function ({ config, helpers, … }: { … }). Replaces the parallel fleet.hostsRegistry entry; null = not colmena-managed (installer-provisioned, non-NixOS, …).

Type: null or unspecified value

Default:

null

Declared by: nix/fleet/providers

`fleet.providers.proxmox.<name>.nodes.<name>.resources.lxc.<name>.provides`

This machine IS a member of the named provider instance — the recursive estate link (a PVE node that is itself an XO VM). Drives derived defaults (hypervisor scrape targets) and makes the layer dependency queryable.

Type: null or string

Default:

null

Example:

"proxmox.skrybit-pve"

Declared by: nix/fleet/providers

`fleet.providers.proxmox.<name>.nodes.<name>.resources.lxc.<name>.scope`

ADR-097: “estate” marks a singleton serving every fleet on this substrate (may derive from all fleets’ manifests); “fleet” (default) sees only its own namespace.

Type: one of "fleet", "estate"

Default:

"fleet"

Declared by: nix/fleet/providers

`fleet.providers.proxmox.<name>.nodes.<name>.resources.lxc.<name>.secrets`

Secret declaration facet ({ file; instances. = { secrets.…; envPrefix?; … }; }). Instances declared here are implicitly consumed by THIS machine; shared/host-less secrets belong in fleet.secrets instead.

Type: null or (attribute set of raw value)

Default:

null

Declared by: nix/fleet/providers

`fleet.providers.proxmox.<name>.nodes.<name>.resources.lxc.<name>.stack`

Stack grouping within env.

Type: string

Default: none (required when its feature is enabled)

Example:

"core"

Declared by: nix/fleet/providers

`fleet.providers.proxmox.<name>.nodes.<name>.resources.vm`

KVM/QEMU VMs placed on this node.

Type: attribute set of (open submodule of attribute set of raw value)

Default:

{ }

Declared by: nix/fleet/providers

`fleet.providers.proxmox.<name>.nodes.<name>.resources.vm.<name>.bootOrder`

XO VMs: explicit boot order (c=disk n=network d=dvd). null = derived from tags (transient ⇒ dnc). Replaces the tag heuristic as the authored form; emitted via the post-create fix hook either way.

Type: null or one of "cnd", "dnc"

Default:

null

Declared by: nix/fleet/providers

`fleet.providers.proxmox.<name>.nodes.<name>.resources.vm.<name>.env`

Logical environment label; with stack selects the leaf tf stack (“env.stack”).

Type: string

Default: none (required when its feature is enabled)

Example:

"platform"

Declared by: nix/fleet/providers

`fleet.providers.proxmox.<name>.nodes.<name>.resources.vm.<name>.nixos`

This machine’s NixOS module function ({ config, helpers, … }: { … }). Replaces the parallel fleet.hostsRegistry entry; null = not colmena-managed (installer-provisioned, non-NixOS, …).

Type: null or unspecified value

Default:

null

Declared by: nix/fleet/providers

`fleet.providers.proxmox.<name>.nodes.<name>.resources.vm.<name>.provides`

This machine IS a member of the named provider instance — the recursive estate link (a PVE node that is itself an XO VM). Drives derived defaults (hypervisor scrape targets) and makes the layer dependency queryable.

Type: null or string

Default:

null

Example:

"proxmox.skrybit-pve"

Declared by: nix/fleet/providers

`fleet.providers.proxmox.<name>.nodes.<name>.resources.vm.<name>.scope`

ADR-097: “estate” marks a singleton serving every fleet on this substrate (may derive from all fleets’ manifests); “fleet” (default) sees only its own namespace.

Type: one of "fleet", "estate"

Default:

"fleet"

Declared by: nix/fleet/providers

`fleet.providers.proxmox.<name>.nodes.<name>.resources.vm.<name>.secrets`

Secret declaration facet ({ file; instances. = { secrets.…; envPrefix?; … }; }). Instances declared here are implicitly consumed by THIS machine; shared/host-less secrets belong in fleet.secrets instead.

Type: null or (attribute set of raw value)

Default:

null

Declared by: nix/fleet/providers

`fleet.providers.proxmox.<name>.nodes.<name>.resources.vm.<name>.stack`

Stack grouping within env.

Type: string

Default: none (required when its feature is enabled)

Example:

"core"

Declared by: nix/fleet/providers

`fleet.providers.proxmox.<name>.pool`

XCP-ng pool info (master host, primary SR/network). Empty for non-XO providers.

Type: attribute set

Default:

{ }

Declared by: nix/fleet/providers

`fleet.providers.proxmox.<name>.resources`

Provider-scoped resources by kind — pools/acls/zones/checks per this provider’s kind map (v2-types.nix), plus lxc/vm.

Type: open submodule of attribute set of attribute set of attribute set of raw value

Default:

{ }

Declared by: nix/fleet/providers

`fleet.providers.proxmox.<name>.resources.lxc`

Instance-scoped containers (single-node instances; multi-node clusters place under nodes.).

Type: attribute set of (open submodule of attribute set of raw value)

Default:

{ }

Declared by: nix/fleet/providers

`fleet.providers.proxmox.<name>.resources.lxc.<name>.bootOrder`

XO VMs: explicit boot order (c=disk n=network d=dvd). null = derived from tags (transient ⇒ dnc). Replaces the tag heuristic as the authored form; emitted via the post-create fix hook either way.

Type: null or one of "cnd", "dnc"

Default:

null

Declared by: nix/fleet/providers

`fleet.providers.proxmox.<name>.resources.lxc.<name>.env`

Logical environment label; with stack selects the leaf tf stack (“env.stack”).

Type: string

Default: none (required when its feature is enabled)

Example:

"platform"

Declared by: nix/fleet/providers

`fleet.providers.proxmox.<name>.resources.lxc.<name>.nixos`

This machine’s NixOS module function ({ config, helpers, … }: { … }). Replaces the parallel fleet.hostsRegistry entry; null = not colmena-managed (installer-provisioned, non-NixOS, …).

Type: null or unspecified value

Default:

null

Declared by: nix/fleet/providers

`fleet.providers.proxmox.<name>.resources.lxc.<name>.provides`

This machine IS a member of the named provider instance — the recursive estate link (a PVE node that is itself an XO VM). Drives derived defaults (hypervisor scrape targets) and makes the layer dependency queryable.

Type: null or string

Default:

null

Example:

"proxmox.skrybit-pve"

Declared by: nix/fleet/providers

`fleet.providers.proxmox.<name>.resources.lxc.<name>.scope`

ADR-097: “estate” marks a singleton serving every fleet on this substrate (may derive from all fleets’ manifests); “fleet” (default) sees only its own namespace.

Type: one of "fleet", "estate"

Default:

"fleet"

Declared by: nix/fleet/providers

`fleet.providers.proxmox.<name>.resources.lxc.<name>.secrets`

Secret declaration facet ({ file; instances. = { secrets.…; envPrefix?; … }; }). Instances declared here are implicitly consumed by THIS machine; shared/host-less secrets belong in fleet.secrets instead.

Type: null or (attribute set of raw value)

Default:

null

Declared by: nix/fleet/providers

`fleet.providers.proxmox.<name>.resources.lxc.<name>.stack`

Stack grouping within env.

Type: string

Default: none (required when its feature is enabled)

Example:

"core"

Declared by: nix/fleet/providers

`fleet.providers.proxmox.<name>.resources.vm`

Instance-scoped VMs (XO VMs are pool-placed, so they belong here).

Type: attribute set of (open submodule of attribute set of raw value)

Default:

{ }

Declared by: nix/fleet/providers

`fleet.providers.proxmox.<name>.resources.vm.<name>.bootOrder`

XO VMs: explicit boot order (c=disk n=network d=dvd). null = derived from tags (transient ⇒ dnc). Replaces the tag heuristic as the authored form; emitted via the post-create fix hook either way.

Type: null or one of "cnd", "dnc"

Default:

null

Declared by: nix/fleet/providers

`fleet.providers.proxmox.<name>.resources.vm.<name>.env`

Logical environment label; with stack selects the leaf tf stack (“env.stack”).

Type: string

Default: none (required when its feature is enabled)

Example:

"platform"

Declared by: nix/fleet/providers

`fleet.providers.proxmox.<name>.resources.vm.<name>.nixos`

This machine’s NixOS module function ({ config, helpers, … }: { … }). Replaces the parallel fleet.hostsRegistry entry; null = not colmena-managed (installer-provisioned, non-NixOS, …).

Type: null or unspecified value

Default:

null

Declared by: nix/fleet/providers

`fleet.providers.proxmox.<name>.resources.vm.<name>.provides`

This machine IS a member of the named provider instance — the recursive estate link (a PVE node that is itself an XO VM). Drives derived defaults (hypervisor scrape targets) and makes the layer dependency queryable.

Type: null or string

Default:

null

Example:

"proxmox.skrybit-pve"

Declared by: nix/fleet/providers

`fleet.providers.proxmox.<name>.resources.vm.<name>.scope`

ADR-097: “estate” marks a singleton serving every fleet on this substrate (may derive from all fleets’ manifests); “fleet” (default) sees only its own namespace.

Type: one of "fleet", "estate"

Default:

"fleet"

Declared by: nix/fleet/providers

`fleet.providers.proxmox.<name>.resources.vm.<name>.secrets`

Secret declaration facet ({ file; instances. = { secrets.…; envPrefix?; … }; }). Instances declared here are implicitly consumed by THIS machine; shared/host-less secrets belong in fleet.secrets instead.

Type: null or (attribute set of raw value)

Default:

null

Declared by: nix/fleet/providers

`fleet.providers.proxmox.<name>.resources.vm.<name>.stack`

Stack grouping within env.

Type: string

Default: none (required when its feature is enabled)

Example:

"core"

Declared by: nix/fleet/providers

`fleet.providers.proxmox.<name>.secrets`

Map of provider-config-key → SOPS path. Emitter resolves each to $${data.sops_file.secrets.data["<dotted-path>"]} so secrets never appear in config.tf.json.

Type: attribute set of string

Default:

{ }

Example:

{ api_token = "integrations/proxmox/api_token"; }

Declared by: nix/fleet/providers

`fleet.providers.proxmox.<name>.source`

Terraform provider source address (e.g. bpg/proxmox).

Type: string

Default: none (required when its feature is enabled)

Example:

"bpg/proxmox"

Declared by: nix/fleet/providers

`fleet.providers.proxmox.<name>.state.prefix`

S3 key prefix for this instance’s tfstate(s). Full path: s3://///terraform.tfstate

Type: string

Default: none (required when its feature is enabled)

Example:

"proxmox-dev"

Declared by: nix/fleet/providers

`fleet.providers.proxmox.<name>.version`

Version constraint for required_providers.

Type: string

Default: none (required when its feature is enabled)

Example:

"0.66.3"

Declared by: nix/fleet/providers

`fleet.providers.random`

hashicorp/random — random_password/id/uuid/string/bytes generated in-plan.

Type: null or (submodule)

Default:

null

Declared by: nix/fleet/providers

`fleet.providers.random.endpoint`

Daemon/host URL — docker only (e.g. ssh://root@192.0.2.50 or tcp://host:2376).

Type: null or string

Default:

null

Example:

"ssh://root@192.0.2.50"

Declared by: nix/fleet/providers

`fleet.providers.random.secrets`

Map of provider-config-key → SOPS path (docker TLS certs, etc.).

Type: attribute set of string

Default:

{ }

Declared by: nix/fleet/providers

`fleet.providers.random.source`

Terraform provider source address (e.g. hashicorp/random).

Type: string

Default: none (required when its feature is enabled)

Example:

"hashicorp/random"

Declared by: nix/fleet/providers

`fleet.providers.random.version`

Version constraint for required_providers.

Type: string

Default: none (required when its feature is enabled)

Example:

"3.6.2"

Declared by: nix/fleet/providers

`fleet.providers.time`

hashicorp/time — time_sleep (post-create waits), time_static/rotating.

Type: null or (submodule)

Default:

null

Declared by: nix/fleet/providers

`fleet.providers.time.endpoint`

Daemon/host URL — docker only (e.g. ssh://root@192.0.2.50 or tcp://host:2376).

Type: null or string

Default:

null

Example:

"ssh://root@192.0.2.50"

Declared by: nix/fleet/providers

`fleet.providers.time.secrets`

Map of provider-config-key → SOPS path (docker TLS certs, etc.).

Type: attribute set of string

Default:

{ }

Declared by: nix/fleet/providers

`fleet.providers.time.source`

Terraform provider source address (e.g. hashicorp/random).

Type: string

Default: none (required when its feature is enabled)

Example:

"hashicorp/random"

Declared by: nix/fleet/providers

`fleet.providers.time.version`

Version constraint for required_providers.

Type: string

Default: none (required when its feature is enabled)

Example:

"3.6.2"

Declared by: nix/fleet/providers

`fleet.providers.tls`

hashicorp/tls — private keys, CSRs, self-/locally-signed certs (feeds step-ca).

Type: null or (submodule)

Default:

null

Declared by: nix/fleet/providers

`fleet.providers.tls.endpoint`

Daemon/host URL — docker only (e.g. ssh://root@192.0.2.50 or tcp://host:2376).

Type: null or string

Default:

null

Example:

"ssh://root@192.0.2.50"

Declared by: nix/fleet/providers

`fleet.providers.tls.secrets`

Map of provider-config-key → SOPS path (docker TLS certs, etc.).

Type: attribute set of string

Default:

{ }

Declared by: nix/fleet/providers

`fleet.providers.tls.source`

Terraform provider source address (e.g. hashicorp/random).

Type: string

Default: none (required when its feature is enabled)

Example:

"hashicorp/random"

Declared by: nix/fleet/providers

`fleet.providers.tls.version`

Version constraint for required_providers.

Type: string

Default: none (required when its feature is enabled)

Example:

"3.6.2"

Declared by: nix/fleet/providers

`fleet.providers.xen-orchestra`

Xen Orchestra provider instances, keyed by name (e.g. main).

Type: attribute set of (submodule)

Default:

{ }

Declared by: nix/fleet/providers

`fleet.providers.xen-orchestra.<name>.cluster`

Proxmox-cluster-specific info. Empty for non-Proxmox providers.

Type: submodule

Default:

{ }

Declared by: nix/fleet/providers

`fleet.providers.xen-orchestra.<name>.cluster.ha_manager`

Whether the cluster runs the PVE HA manager. Informational — not consumed by any emitter yet.

Type: boolean

Default:

false

Declared by: nix/fleet/providers

`fleet.providers.xen-orchestra.<name>.cluster.node_addresses`

Node name → SSH host used by out-of-band local-exec steps (fleet.compute..lxc_extra_conf). A node missing here is reached by its name.

Type: attribute set of string

Default:

{ }

Example:

{
  pve1 = "198.51.100.11";
  pve2 = "pve2.mgmt.example.internal";
}

Declared by: nix/fleet/providers

`fleet.providers.xen-orchestra.<name>.cluster.nodes`

Cluster member names. More than one entry makes the instance multi-node, which forces every compute entry on it to set node explicitly (validator-enforced).

Type: list of string

Default:

[ ]

Example:

[
  "pve-alpha"
  "pve-beta"
]

Declared by: nix/fleet/providers

`fleet.providers.xen-orchestra.<name>.cluster.primary_node`

Fallback placement target: compute/resource entries that leave node empty are provisioned here.

Type: string

Default:

""

Example:

"pve-alpha"

Declared by: nix/fleet/providers

`fleet.providers.xen-orchestra.<name>.destruction_policy`

strict: emit prevent_destroy=true on EVERY resource in this instance
standard: emit prevent_destroy=true only on stateful-tagged resources
permissive: emit prevent_destroy only on explicit protect=true

Type: one of "strict", "standard", "permissive"

Default:

"standard"

Declared by: nix/fleet/providers

`fleet.providers.xen-orchestra.<name>.endpoint`

API endpoint URL. Optional — provider may derive from secrets.

Type: null or string

Default:

null

Example:

"https://192.0.2.10:8006/"

Declared by: nix/fleet/providers

`fleet.providers.xen-orchestra.<name>.insecure`

Skip TLS verification (internal step-ca cert).

Type: boolean

Default:

true

Declared by: nix/fleet/providers

`fleet.providers.xen-orchestra.<name>.minVersion`

Lowest Proxmox VE major.minor this instance is expected to run. fleetkit’s zero-touch NixOS LXC first boot needs PVE 9 (its NixOS LXC setup plugin writes the guest’s eth0.network from the container’s net0 at create time); fleet pve status warns when the live node is older. Informational for non-PVE providers.

Type: string

Default:

"9.0"

Example:

"9.0"

Declared by: nix/fleet/providers

`fleet.providers.xen-orchestra.<name>.nodes`

Hypervisor members of this instance, as typed objects (mgmt_ip, placed machines). Complements cluster.nodes (names only); a name present in either counts as a member.

Type: attribute set of (submodule)

Default:

{ }

Declared by: nix/fleet/providers

`fleet.providers.xen-orchestra.<name>.nodes.<name>.mgmt_ip`

Management/API address of this hypervisor node. Feeds derived scrape targets when the node is not provides-linked to a fleet VM.

Type: null or string

Default:

null

Declared by: nix/fleet/providers

`fleet.providers.xen-orchestra.<name>.nodes.<name>.resources`

Machines placed on this node.

Type: submodule

Default:

{ }

Declared by: nix/fleet/providers

`fleet.providers.xen-orchestra.<name>.nodes.<name>.resources.lxc`

LXC containers placed on this node.

Type: attribute set of (open submodule of attribute set of raw value)

Default:

{ }

Declared by: nix/fleet/providers

`fleet.providers.xen-orchestra.<name>.nodes.<name>.resources.lxc.<name>.bootOrder`

XO VMs: explicit boot order (c=disk n=network d=dvd). null = derived from tags (transient ⇒ dnc). Replaces the tag heuristic as the authored form; emitted via the post-create fix hook either way.

Type: null or one of "cnd", "dnc"

Default:

null

Declared by: nix/fleet/providers

`fleet.providers.xen-orchestra.<name>.nodes.<name>.resources.lxc.<name>.env`

Logical environment label; with stack selects the leaf tf stack (“env.stack”).

Type: string

Default: none (required when its feature is enabled)

Example:

"platform"

Declared by: nix/fleet/providers

`fleet.providers.xen-orchestra.<name>.nodes.<name>.resources.lxc.<name>.nixos`

This machine’s NixOS module function ({ config, helpers, … }: { … }). Replaces the parallel fleet.hostsRegistry entry; null = not colmena-managed (installer-provisioned, non-NixOS, …).

Type: null or unspecified value

Default:

null

Declared by: nix/fleet/providers

`fleet.providers.xen-orchestra.<name>.nodes.<name>.resources.lxc.<name>.provides`

This machine IS a member of the named provider instance — the recursive estate link (a PVE node that is itself an XO VM). Drives derived defaults (hypervisor scrape targets) and makes the layer dependency queryable.

Type: null or string

Default:

null

Example:

"proxmox.skrybit-pve"

Declared by: nix/fleet/providers

`fleet.providers.xen-orchestra.<name>.nodes.<name>.resources.lxc.<name>.scope`

ADR-097: “estate” marks a singleton serving every fleet on this substrate (may derive from all fleets’ manifests); “fleet” (default) sees only its own namespace.

Type: one of "fleet", "estate"

Default:

"fleet"

Declared by: nix/fleet/providers

`fleet.providers.xen-orchestra.<name>.nodes.<name>.resources.lxc.<name>.secrets`

Secret declaration facet ({ file; instances. = { secrets.…; envPrefix?; … }; }). Instances declared here are implicitly consumed by THIS machine; shared/host-less secrets belong in fleet.secrets instead.

Type: null or (attribute set of raw value)

Default:

null

Declared by: nix/fleet/providers

`fleet.providers.xen-orchestra.<name>.nodes.<name>.resources.lxc.<name>.stack`

Stack grouping within env.

Type: string

Default: none (required when its feature is enabled)

Example:

"core"

Declared by: nix/fleet/providers

`fleet.providers.xen-orchestra.<name>.nodes.<name>.resources.vm`

KVM/QEMU VMs placed on this node.

Type: attribute set of (open submodule of attribute set of raw value)

Default:

{ }

Declared by: nix/fleet/providers

`fleet.providers.xen-orchestra.<name>.nodes.<name>.resources.vm.<name>.bootOrder`

XO VMs: explicit boot order (c=disk n=network d=dvd). null = derived from tags (transient ⇒ dnc). Replaces the tag heuristic as the authored form; emitted via the post-create fix hook either way.

Type: null or one of "cnd", "dnc"

Default:

null

Declared by: nix/fleet/providers

`fleet.providers.xen-orchestra.<name>.nodes.<name>.resources.vm.<name>.env`

Logical environment label; with stack selects the leaf tf stack (“env.stack”).

Type: string

Default: none (required when its feature is enabled)

Example:

"platform"

Declared by: nix/fleet/providers

`fleet.providers.xen-orchestra.<name>.nodes.<name>.resources.vm.<name>.nixos`

This machine’s NixOS module function ({ config, helpers, … }: { … }). Replaces the parallel fleet.hostsRegistry entry; null = not colmena-managed (installer-provisioned, non-NixOS, …).

Type: null or unspecified value

Default:

null

Declared by: nix/fleet/providers

`fleet.providers.xen-orchestra.<name>.nodes.<name>.resources.vm.<name>.provides`

This machine IS a member of the named provider instance — the recursive estate link (a PVE node that is itself an XO VM). Drives derived defaults (hypervisor scrape targets) and makes the layer dependency queryable.

Type: null or string

Default:

null

Example:

"proxmox.skrybit-pve"

Declared by: nix/fleet/providers

`fleet.providers.xen-orchestra.<name>.nodes.<name>.resources.vm.<name>.scope`

ADR-097: “estate” marks a singleton serving every fleet on this substrate (may derive from all fleets’ manifests); “fleet” (default) sees only its own namespace.

Type: one of "fleet", "estate"

Default:

"fleet"

Declared by: nix/fleet/providers

`fleet.providers.xen-orchestra.<name>.nodes.<name>.resources.vm.<name>.secrets`

Secret declaration facet ({ file; instances. = { secrets.…; envPrefix?; … }; }). Instances declared here are implicitly consumed by THIS machine; shared/host-less secrets belong in fleet.secrets instead.

Type: null or (attribute set of raw value)

Default:

null

Declared by: nix/fleet/providers

`fleet.providers.xen-orchestra.<name>.nodes.<name>.resources.vm.<name>.stack`

Stack grouping within env.

Type: string

Default: none (required when its feature is enabled)

Example:

"core"

Declared by: nix/fleet/providers

`fleet.providers.xen-orchestra.<name>.pool`

XCP-ng pool info (master host, primary SR/network). Empty for non-XO providers.

Type: attribute set

Default:

{ }

Declared by: nix/fleet/providers

`fleet.providers.xen-orchestra.<name>.resources`

Provider-scoped resources by kind — pools/acls/zones/checks per this provider’s kind map (v2-types.nix), plus lxc/vm.

Type: open submodule of attribute set of attribute set of attribute set of raw value

Default:

{ }

Declared by: nix/fleet/providers

`fleet.providers.xen-orchestra.<name>.resources.lxc`

Instance-scoped containers (single-node instances; multi-node clusters place under nodes.).

Type: attribute set of (open submodule of attribute set of raw value)

Default:

{ }

Declared by: nix/fleet/providers

`fleet.providers.xen-orchestra.<name>.resources.lxc.<name>.bootOrder`

XO VMs: explicit boot order (c=disk n=network d=dvd). null = derived from tags (transient ⇒ dnc). Replaces the tag heuristic as the authored form; emitted via the post-create fix hook either way.

Type: null or one of "cnd", "dnc"

Default:

null

Declared by: nix/fleet/providers

`fleet.providers.xen-orchestra.<name>.resources.lxc.<name>.env`

Logical environment label; with stack selects the leaf tf stack (“env.stack”).

Type: string

Default: none (required when its feature is enabled)

Example:

"platform"

Declared by: nix/fleet/providers

`fleet.providers.xen-orchestra.<name>.resources.lxc.<name>.nixos`

This machine’s NixOS module function ({ config, helpers, … }: { … }). Replaces the parallel fleet.hostsRegistry entry; null = not colmena-managed (installer-provisioned, non-NixOS, …).

Type: null or unspecified value

Default:

null

Declared by: nix/fleet/providers

`fleet.providers.xen-orchestra.<name>.resources.lxc.<name>.provides`

This machine IS a member of the named provider instance — the recursive estate link (a PVE node that is itself an XO VM). Drives derived defaults (hypervisor scrape targets) and makes the layer dependency queryable.

Type: null or string

Default:

null

Example:

"proxmox.skrybit-pve"

Declared by: nix/fleet/providers

`fleet.providers.xen-orchestra.<name>.resources.lxc.<name>.scope`

ADR-097: “estate” marks a singleton serving every fleet on this substrate (may derive from all fleets’ manifests); “fleet” (default) sees only its own namespace.

Type: one of "fleet", "estate"

Default:

"fleet"

Declared by: nix/fleet/providers

`fleet.providers.xen-orchestra.<name>.resources.lxc.<name>.secrets`

Secret declaration facet ({ file; instances. = { secrets.…; envPrefix?; … }; }). Instances declared here are implicitly consumed by THIS machine; shared/host-less secrets belong in fleet.secrets instead.

Type: null or (attribute set of raw value)

Default:

null

Declared by: nix/fleet/providers

`fleet.providers.xen-orchestra.<name>.resources.lxc.<name>.stack`

Stack grouping within env.

Type: string

Default: none (required when its feature is enabled)

Example:

"core"

Declared by: nix/fleet/providers

`fleet.providers.xen-orchestra.<name>.resources.vm`

Instance-scoped VMs (XO VMs are pool-placed, so they belong here).

Type: attribute set of (open submodule of attribute set of raw value)

Default:

{ }

Declared by: nix/fleet/providers

`fleet.providers.xen-orchestra.<name>.resources.vm.<name>.bootOrder`

XO VMs: explicit boot order (c=disk n=network d=dvd). null = derived from tags (transient ⇒ dnc). Replaces the tag heuristic as the authored form; emitted via the post-create fix hook either way.

Type: null or one of "cnd", "dnc"

Default:

null

Declared by: nix/fleet/providers

`fleet.providers.xen-orchestra.<name>.resources.vm.<name>.env`

Logical environment label; with stack selects the leaf tf stack (“env.stack”).

Type: string

Default: none (required when its feature is enabled)

Example:

"platform"

Declared by: nix/fleet/providers

`fleet.providers.xen-orchestra.<name>.resources.vm.<name>.nixos`

This machine’s NixOS module function ({ config, helpers, … }: { … }). Replaces the parallel fleet.hostsRegistry entry; null = not colmena-managed (installer-provisioned, non-NixOS, …).

Type: null or unspecified value

Default:

null

Declared by: nix/fleet/providers

`fleet.providers.xen-orchestra.<name>.resources.vm.<name>.provides`

This machine IS a member of the named provider instance — the recursive estate link (a PVE node that is itself an XO VM). Drives derived defaults (hypervisor scrape targets) and makes the layer dependency queryable.

Type: null or string

Default:

null

Example:

"proxmox.skrybit-pve"

Declared by: nix/fleet/providers

`fleet.providers.xen-orchestra.<name>.resources.vm.<name>.scope`

ADR-097: “estate” marks a singleton serving every fleet on this substrate (may derive from all fleets’ manifests); “fleet” (default) sees only its own namespace.

Type: one of "fleet", "estate"

Default:

"fleet"

Declared by: nix/fleet/providers

`fleet.providers.xen-orchestra.<name>.resources.vm.<name>.secrets`

Secret declaration facet ({ file; instances. = { secrets.…; envPrefix?; … }; }). Instances declared here are implicitly consumed by THIS machine; shared/host-less secrets belong in fleet.secrets instead.

Type: null or (attribute set of raw value)

Default:

null

Declared by: nix/fleet/providers

`fleet.providers.xen-orchestra.<name>.resources.vm.<name>.stack`

Stack grouping within env.

Type: string

Default: none (required when its feature is enabled)

Example:

"core"

Declared by: nix/fleet/providers

`fleet.providers.xen-orchestra.<name>.secrets`

Map of provider-config-key → SOPS path. Emitter resolves each to $${data.sops_file.secrets.data["<dotted-path>"]} so secrets never appear in config.tf.json.

Type: attribute set of string

Default:

{ }

Example:

{ api_token = "integrations/proxmox/api_token"; }

Declared by: nix/fleet/providers

`fleet.providers.xen-orchestra.<name>.source`

Terraform provider source address (e.g. bpg/proxmox).

Type: string

Default: none (required when its feature is enabled)

Example:

"bpg/proxmox"

Declared by: nix/fleet/providers

`fleet.providers.xen-orchestra.<name>.state.prefix`

S3 key prefix for this instance’s tfstate(s). Full path: s3://///terraform.tfstate

Type: string

Default: none (required when its feature is enabled)

Example:

"proxmox-dev"

Declared by: nix/fleet/providers

`fleet.providers.xen-orchestra.<name>.version`

Version constraint for required_providers.

Type: string

Default: none (required when its feature is enabled)

Example:

"0.66.3"

Declared by: nix/fleet/providers