# terraform/

Infrastructure provisioning. Terraform owns **VM existence only** — creating and
destroying Proxmox VMs. It writes no DNS records and configures nothing inside a
VM; Ansible owns all of that.

- `modules/proxmox_vm/` — reusable VM module (Proxmox only).
- `environments/{staging,production}/` — separate state per environment. Add a VM by
  editing `local.vms` in that env's `main.tf`, then `make tf-plan` → `tf-apply` →
  `tf-inventory`.

Rationale: **ADR-006**. Handoff to Ansible: **ADR-009**. Secrets via `TF_VAR_*`
only — never in `.tfvars`. Not yet `terraform init`ed — see `STATUS.md`.