Provision Infisical #9
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # Provision Infisical VM | |
| # | |
| # Provisions the infisical-vm on Proxmox and deploys self-hosted Infisical. | |
| # Infisical is platform infrastructure — it provides centralized secret storage | |
| # for all provisioning workflows across all projects. | |
| # | |
| # Run once. Re-running is safe (idempotent). | |
| # | |
| # vm_ip must match the DHCP reservation you set for MAC BC:24:11:00:01:01. | |
| # | |
| # Secrets are pulled via Infisical/secrets-action with GitHub OIDC. The repo | |
| # must have variables INFISICAL_IDENTITY_ID and INFISICAL_PROJECT_SLUG set. | |
| # | |
| # After this workflow completes (on first install): | |
| # 1. Open http://<vm_ip> and complete the Infisical setup wizard | |
| # 2. Create a project and add all homelab secrets organized into | |
| # /proxmox, /terraform, /ansible folders | |
| # 3. Create one machine identity per consuming repo, with OIDC auth | |
| # trust-bound to that repo | |
| name: Provision Infisical | |
| on: | |
| workflow_dispatch: | |
| inputs: | |
| vm_ip: | |
| description: "IP address of the infisical-vm (must match DHCP reservation for MAC BC:24:11:00:01:01)" | |
| required: true | |
| type: string | |
| permissions: | |
| id-token: write | |
| contents: read | |
| jobs: | |
| provision: | |
| uses: BlakeHastings/homelab-platform/.github/workflows/provision-vm.yml@main | |
| with: | |
| vm_name: "infisical-vm" | |
| cpu_cores: 2 | |
| memory_mb: 4096 | |
| disk_gb: 40 | |
| terraform_working_dir: "terraform/nodes/infisical-vm" | |
| observability_server_ip: "observability-vm.lan" # Alloy ships container logs + journal here | |
| infisical_identity_id: ${{ vars.INFISICAL_IDENTITY_ID }} | |
| infisical_project_slug: ${{ vars.INFISICAL_PROJECT_SLUG }} | |
| deploy: | |
| name: "Deploy Infisical" | |
| needs: provision | |
| runs-on: [self-hosted, self-hosted-infra] | |
| permissions: | |
| id-token: write | |
| contents: read | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@v4 | |
| - name: Load Ansible secrets from Infisical | |
| uses: Infisical/secrets-action@v1.0.15 | |
| with: | |
| method: oidc | |
| identity-id: ${{ vars.INFISICAL_IDENTITY_ID }} | |
| project-slug: ${{ vars.INFISICAL_PROJECT_SLUG }} | |
| env-slug: prod | |
| secret-path: /ansible | |
| domain: ${{ vars.INFISICAL_DOMAIN || 'http://192.168.0.161' }} | |
| export-type: env | |
| - name: Write SSH private key | |
| run: | | |
| mkdir -p "$HOME/.ssh" | |
| printf '%s\n' "$ANSIBLE_PRIVATE_KEY" > "$HOME/.ssh/deploy_key" | |
| chmod 600 "$HOME/.ssh/deploy_key" | |
| - name: Run Ansible | |
| env: | |
| ANSIBLE_HOST_KEY_CHECKING: "False" | |
| run: | | |
| ansible-playbook \ | |
| -i "${{ inputs.vm_ip }}," \ | |
| ansible/infisical.yml \ | |
| -e "ansible_user=ubuntu" \ | |
| -e "ansible_ssh_private_key_file=$HOME/.ssh/deploy_key" \ | |
| -e "ansible_ssh_common_args='-o StrictHostKeyChecking=no'" \ | |
| -e "infisical_url=http://${{ inputs.vm_ip }}" | |
| - name: Cleanup SSH key | |
| if: always() | |
| run: rm -f "$HOME/.ssh/deploy_key" |