Move Terraform password from node.tfvars to environment variable #24

New issue

Open

opened 2026-07-25 19:37:13 +00:00 by lab · 0 comments

lab commented

2026-07-25 19:37:13 +00:00

Owner

Problem

node.tfvars contains proxmox_password directly. While the committed value is not the real password, the pattern is risky — if someone puts a real password here, it gets committed.

Solution

Remove proxmox_password from node.tfvars and read it from TF_VAR_proxmox_password environment variable instead. The variable is already declared as sensitive = true in variables.tf.

Steps

Remove proxmox_password line from terraform/node.tfvars
Add to .env: export TF_VAR_proxmox_password=...
Document in terraform/setup.md that password must be set via env var
Run terraform plan to verify it still works

## Problem `node.tfvars` contains `proxmox_password` directly. While the committed value is not the real password, the pattern is risky — if someone puts a real password here, it gets committed. ## Solution Remove `proxmox_password` from `node.tfvars` and read it from `TF_VAR_proxmox_password` environment variable instead. The variable is already declared as `sensitive = true` in `variables.tf`. ## Steps 1. Remove `proxmox_password` line from `terraform/node.tfvars` 2. Add to `.env`: `export TF_VAR_proxmox_password=...` 3. Document in `terraform/setup.md` that password must be set via env var 4. Run `terraform plan` to verify it still works