4 files changed, 147 insertions, 0 deletions
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 88d817dd..14dcba3f 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -38,6 +38,8 @@ jobs:
             runs_on: "ubuntu-latest"
           - name: debian
             runs_on: "ubuntu-latest"
+          - name: proxmox
+            runs_on: "ubuntu-latest"
           - name: raspberrypi
             runs_on: "ubuntu-24.04-arm"
     runs-on: ${{ matrix.molecule_distro.runs_on }}
diff --git a/molecule/proxmox/Dockerfile.j2 b/molecule/proxmox/Dockerfile.j2
new file mode 100644
index 00000000..39de5170
--- /dev/null
+++ b/molecule/proxmox/Dockerfile.j2
@@ -0,0 +1,29 @@
+# Based on the amazing work of geerlingguy <3
+# FROM docker.io/geerlingguy/docker-debian12-ansible
+FROM docker.io/library/debian:12.12
+
+ARG DEBIAN_FRONTEND=noninteractive
+
+ENV container docker
+
+RUN apt-get update \
+    && apt-get install -y --no-install-recommends \
+        systemd python3 avahi-daemon dhcpcd iproute2 ifupdown udev curl ca-certificates \
+    && curl -fsSL https://enterprise.proxmox.com/debian/proxmox-release-bookworm.gpg \
+        -o /etc/apt/trusted.gpg.d/proxmox-release-bookworm.gpg \
+    && echo "deb http://download.proxmox.com/debian/pve bookworm pve-no-subscription" \
+        > /etc/apt/sources.list.d/pve-no-subscription.list \
+    && rm -Rf /var/lib/apt/lists/* \
+    && rm -Rf /usr/share/doc \
+    && rm -Rf /usr/share/man \
+    && apt-get clean
+
+RUN rm -f /lib/systemd/system/multi-user.target.wants/getty.target
+
+# Mimic Debian OS default boot (for testing)
+RUN systemctl enable avahi-daemon \
+    && touch /etc/locale.gen
+
+VOLUME ["/sys/fs/cgroup", "/tmp", "/run", "/opt"]
+
+CMD ["/lib/systemd/systemd"]
diff --git a/molecule/proxmox/converge.yml b/molecule/proxmox/converge.yml
new file mode 100644
index 00000000..a75f33ce
--- /dev/null
+++ b/molecule/proxmox/converge.yml
@@ -0,0 +1,64 @@
+---
+- name: "Bootstrap"
+  hosts: "proxmox"
+  gather_facts: true
+  vars:
+    ansible_become_method: su
+    user_public_keys:
+      - "ssh-ed25519 AAAA...fMo"
+      - "ssh-rsa AAAA...4I3"
+    user_groups: ["wheel", "test_group"]
+  roles:
+    - role: "hostname"
+    - role: "network"
+    - role: "user"
+    - role: "ssh"
+    - role: "password_policy"
+  pre_tasks:
+    - name: "Update package cache"
+      become: true
+      ansible.builtin.package:
+        update_cache: true
+      async: 60
+      poll: 5
+      failed_when: false
+      tags:
+        - molecule-idempotence-notest
+  tasks:
+    - name: "Configure passwordless sudo for testing"
+      ansible.builtin.copy:
+        content: "%test_group ALL=(ALL) NOPASSWD: ALL\n"
+        dest: "/etc/sudoers.d/test_group"
+        mode: "0440"
+        validate: 'visudo -cf %s'
+
+- name: "Configure"
+  hosts: "proxmox"
+  gather_facts: true
+  remote_user: "{{ username }}"
+  vars:
+    ansible_become_method: sudo
+    locales:
+      - "en_US.UTF-8 UTF-8"
+    timezone: "GMT"
+    vimrc_repo_url: "https://git.sr.ht/~a14m/.vim"
+    password_store_repo_url: "https://github.com/octocat/Spoon-Knife"
+  pre_tasks:
+    - name: "Override is_chroot fact for container environment"
+      ansible.builtin.set_fact:
+        ansible_facts: "{{ ansible_facts | combine({'is_chroot': false}) }}"
+  roles:
+    - role: "proxmox-ve"
+    - role: "locales"
+    - role: "timezone"
+    - role: "bash"
+    - role: "man"
+    - role: "jq"
+    - role: "ag"
+    - role: "btop"
+    - role: "gpg"
+    - role: "git"
+    - role: "git-crypt"
+    - role: "dotfiles"
+    - role: "password_store"
+    - role: "vim"
diff --git a/molecule/proxmox/molecule.yml b/molecule/proxmox/molecule.yml
new file mode 100644
index 00000000..751aa58d
--- /dev/null
+++ b/molecule/proxmox/molecule.yml
@@ -0,0 +1,52 @@
+---
+role_name_check: 1
+dependency:
+  name: galaxy
+  options:
+    requirements-file: ../../requirements.yml
+    ignore-errors: true
+driver:
+  name: podman
+platforms:
+  - name: proxmox
+    image: debian
+    dockerfile: Dockerfile.j2
+    platform: "linux/amd64"
+    pre_build_image: false
+    privileged: true
+    command: ${MOLECULE_COMMAND:-"/lib/systemd/systemd"}
+    tmpfs:
+      "/tmp": "rw"
+      "/run": "rw,exec"
+    volumes:
+      - "/sys/fs/cgroup:/sys/fs/cgroup:rw"
+    cgroupns_mode: host
+
+provisioner:
+  name: ansible
+  inventory:
+    links:
+      host_vars: "../../host_vars/"
+      group_vars: "../../group_vars/"
+  env:
+    ANSIBLE_ROLES_PATH: "../../roles"
+    GITHUB_TOKEN: "{{ lookup('env', 'GITHUB_TOKEN') }}"
+  config_options:
+    defaults:
+      callback_result_format: yaml
+      interpreter_python: /usr/bin/python3
+    ssh_connection:
+      pipelining: true
+  playbooks:
+    converge: converge.yml
+verifier:
+  name: ansible
+
+scenario:
+  test_sequence:
+    - destroy
+    - syntax
+    - create
+    - converge
+    - idempotence
+    - destroy