- Python 58.2%
- HCL 19.9%
- Shell 7.3%
- Go Template 7.3%
- Nix 5%
- Other 2.3%
1dbc2fa98a
Real Packer+QEMU unattended install (make image), not just packer validate's syntax check. Targets the dedicated kvm-runner (host-execution, /dev/kvm access) rather than the default Docker-based runner, which has neither KVM nor enough disk for this. Manual/weekly trigger only -- too slow to gate every push. |
||
|---|---|---|
| .forgejo/workflows | ||
| .github/workflows | ||
| base | ||
| docs | ||
| examples | ||
| guest/usr/local/etc/rc.syshook.d/early | ||
| iso | ||
| opnseed | ||
| packer | ||
| terraform | ||
| .envrc | ||
| .gitignore | ||
| flake.lock | ||
| flake.nix | ||
| Makefile | ||
| README.md | ||
| THIRD_PARTY_NOTICES.md | ||
OPNsense unattended provisioning for Proxmox (NoCloud cloud-init)
Automates OPNsense's normally-manual bring-up on Proxmox VE:
- Install OPNsense from ISO to permanent disk storage.
- Assign LAN so the web GUI is reachable.
- Configure interfaces, IP addressing, VLANs, hostname, and SSH/API access — everything the setup wizard would otherwise ask for by hand.
Why not just run cloud-init inside OPNsense?
OPNsense has no official cloud-init support, and stock cloud-init's FreeBSD
network renderer writes addressing into /etc/rc.conf — which OPNsense's own
config (/conf/config.xml) and GUI never see, so the box ends up
misconfigured from OPNsense's point of view even though the network
technically works. See docs/architecture.md for the
full rationale.
Instead, this project builds a base image with a custom first-boot hook that
parses the standard Proxmox NoCloud seed (user-data / meta-data /
network-config, exactly what the Proxmox GUI's Cloud-Init tab or
qm set --ipconfig0/--sshkeys/--ciuser produces) and renders it directly
into /conf/config.xml using OPNsense's own configuration format. No
cloud-init package runs inside the guest.
Documentation
- docs/architecture.md — how the pipeline fits together
- docs/usage.md — deploying a VM (Proxmox GUI/
qm/OpenTofu) - docs/extension-reference.md — the
opnsense:seed extension (VLANs, role overrides, API keys) - docs/development.md — building the image, running tests, repo layout
- docs/testing-new-releases.md — validating against a new OPNsense release
Dev environment
nix develop
# or, with direnv: direnv allow
Provides Packer, QEMU, the Python toolchain for opnseed, OpenTofu, Ansible,
and debugging tools (VNC, guestfish). packer is BUSL-licensed; the flake
whitelists only that package via allowUnfreePredicate rather than a blanket
allowUnfree.
License
See THIRD_PARTY_NOTICES.md for attribution of code derived from other projects.