10 files changed, 154 insertions, 0 deletions
diff --git a/configure.yml b/configure.yml
index fc307868..200a79c1 100644
--- a/configure.yml
+++ b/configure.yml
@@ -105,3 +105,23 @@
     - role: "prometheus-node-exporter"
     - role: "grafana"
     - role: "neomutt"
+
+- name: "Proxmox VE configure"
+  gather_facts: true
+  hosts:
+    - pve.local
+  roles:
+    - role: "proxmox-ve"
+    - role: "locales"
+    - role: "timezone"
+    - role: "bash"
+    - role: "man"
+    - role: "jq"
+    - role: "ag"
+    - role: "btop"
+    - role: "gpg"
+    - role: "git"
+    - role: "git-crypt"
+    - role: "dotfiles"
+    - role: "password_store"
+    - role: "vim"
diff --git a/host_vars/pve.local.yml b/host_vars/pve.local.yml
index d00c2d95..d9a5c586 100644
--- a/host_vars/pve.local.yml
+++ b/host_vars/pve.local.yml
diff --git a/host_vars/pve.local.yml.example b/host_vars/pve.local.yml.example
index fb84134a..0b211e4c 100644
--- a/host_vars/pve.local.yml.example
+++ b/host_vars/pve.local.yml.example
@@ -1,4 +1,10 @@
 ---
+# Since pve needs to disable ipv6 to install the proxy for some reason
+# SSH connection over ipv6 drops causing the playbook to fail
+# even though pve.local is still accessible on ipv4
+# This configuration ensures that proxmox ssh uses ipv4
+ansible_ssh_extra_args: "-4"
+
 network_ipv4_address: "10.0.0.253"
 network_ipv4_gateway: "10.0.0.254"
 network_ipv4_dns: "10.0.0.254"
diff --git a/roles/proxmox-kernel-helper/meta/argument_specs.yml b/roles/proxmox-kernel-helper/meta/argument_specs.yml
new file mode 100644
index 00000000..5af49897
--- /dev/null
+++ b/roles/proxmox-kernel-helper/meta/argument_specs.yml
@@ -0,0 +1,4 @@
+---
+argument_specs:
+  main:
+    options: {}
diff --git a/roles/proxmox-kernel-helper/meta/main.yml b/roles/proxmox-kernel-helper/meta/main.yml
new file mode 100644
index 00000000..90189e2e
--- /dev/null
+++ b/roles/proxmox-kernel-helper/meta/main.yml
@@ -0,0 +1,10 @@
+---
+galaxy_info:
+  author: "a14m"
+  description: "Initialize proxmox-boot-tool EFI boot management via proxmox-kernel-helper"
+  license: "MIT"
+  min_ansible_version: "2.18"
+  platforms:
+    - name: "Debian"
+      versions:
+        - "bookworm"
diff --git a/roles/proxmox-kernel-helper/tasks/main.yml b/roles/proxmox-kernel-helper/tasks/main.yml
new file mode 100644
index 00000000..8f9aab1f
--- /dev/null
+++ b/roles/proxmox-kernel-helper/tasks/main.yml
@@ -0,0 +1,45 @@
+---
+- name: "Ensure proxmox-kernel-helper is installed"
+  become: true
+  ansible.builtin.apt:
+    name: "proxmox-kernel-helper"
+    state: "present"
+
+- name: "Check if proxmox-boot-tool already initialized"
+  ansible.builtin.stat:
+    path: "/etc/kernel/proxmox-boot-uuids"
+  register: proxmox_boot_tool_uuids
+
+- name: "Initialize proxmox-boot-tool"
+  become: true
+  when: not proxmox_boot_tool_uuids.stat.exists
+  block:
+    - name: "Get EFI partition device"
+      ansible.builtin.command:
+        cmd: "blkid -l -t PARTLABEL=boot -o device"
+      register: proxmox_boot_tool_efi_device
+      changed_when: false
+
+    - name: "Unmount EFI partition"
+      ansible.builtin.command:
+        cmd: "umount /boot/efi"
+      register: proxmox_boot_tool_umount
+      changed_when: proxmox_boot_tool_umount.rc == 0
+      failed_when: proxmox_boot_tool_umount.rc not in [0, 32]
+
+    - name: "Initialize proxmox-boot-tool on EFI partition"
+      ansible.builtin.command:
+        cmd: "proxmox-boot-tool init {{ proxmox_boot_tool_efi_device.stdout | trim }} grub"
+      changed_when: true
+
+    - name: "Sync kernels to EFI partition"
+      ansible.builtin.command:
+        cmd: "proxmox-boot-tool refresh"
+      changed_when: true
+
+    - name: "Remount EFI partition"
+      ansible.posix.mount:
+        path: "/boot/efi"
+        src: "{{ proxmox_boot_tool_efi_device.stdout | trim }}"
+        fstype: "vfat"
+        state: "ephemeral"
diff --git a/roles/proxmox-ve/defaults/main.yml b/roles/proxmox-ve/defaults/main.yml
new file mode 100644
index 00000000..1fb51b74
--- /dev/null
+++ b/roles/proxmox-ve/defaults/main.yml
@@ -0,0 +1,2 @@
+---
+proxmox_ve_repo: "no-subscription"
diff --git a/roles/proxmox-ve/meta/argument_specs.yml b/roles/proxmox-ve/meta/argument_specs.yml
new file mode 100644
index 00000000..915bcc59
--- /dev/null
+++ b/roles/proxmox-ve/meta/argument_specs.yml
@@ -0,0 +1,11 @@
+---
+argument_specs:
+  main:
+    options:
+      proxmox_ve_repo:
+        type: "str"
+        description: "Proxmox VE apt repository type (no-subscription or enterprise)"
+        default: "no-subscription"
+        choices:
+          - "no-subscription"
+          - "enterprise"
diff --git a/roles/proxmox-ve/meta/main.yml b/roles/proxmox-ve/meta/main.yml
new file mode 100644
index 00000000..a116b3b9
--- /dev/null
+++ b/roles/proxmox-ve/meta/main.yml
@@ -0,0 +1,12 @@
+---
+dependencies:
+  - role: "proxmox-kernel-helper"
+galaxy_info:
+  author: "a14m"
+  description: "Install Proxmox VE on Debian"
+  license: "MIT"
+  min_ansible_version: "2.18"
+  platforms:
+    - name: "Debian"
+      versions:
+        - "bookworm"
diff --git a/roles/proxmox-ve/tasks/main.yml b/roles/proxmox-ve/tasks/main.yml
new file mode 100644
index 00000000..25067d43
--- /dev/null
+++ b/roles/proxmox-ve/tasks/main.yml
@@ -0,0 +1,44 @@
+---
+- name: "Configure Proxmox repos"
+  become: true
+  when: proxmox_ve_repo == "no-subscription"
+  block:
+    - name: "Configure no-subuscription repos"
+      ansible.builtin.apt_repository:
+        repo: "deb http://download.proxmox.com/debian/pve bookworm pve-no-subscription"
+        state: "present"
+        filename: "pve-no-subscription"
+
+    - name: "Remove Proxmox enterprise repo"
+      become: true
+      ansible.builtin.file:
+        path: "/etc/apt/sources.list.d/pve-enterprise.list"
+        state: "absent"
+
+- name: "Install proxmox-ve"
+  become: true
+  ansible.builtin.apt:
+    name: "proxmox-ve"
+    state: "present"
+    update_cache: true
+
+- name: "Disable IPv6 on wlan0 (prevents PVE cert generation failures with zone IDs)"
+  become: true
+  ansible.posix.sysctl:
+    name: "net.ipv6.conf.wlan0.disable_ipv6"
+    value: "1"
+    state: "present"
+    sysctl_set: true
+    reload: true
+
+- name: "Enable and start Proxmox VE services"
+  become: true
+  ansible.builtin.systemd_service:
+    name: "{{ item }}"
+    enabled: true
+    state: "started"
+  loop:
+    - "pve-cluster"
+    - "pvedaemon"
+    - "pveproxy"
+    - "pvestatd"