Build Linux server templates on Proxmox with Packer (proxmox-iso)

• Packer (duh)
• Vault (for storing environment secrets)

To minimize the effort required to tailor deployments to your environment, this Packer setup assumes that you're storing all of your environment-specific information (not just sensitive credentials!) in Vault. You shouldn't really need to modify any of the variables stored in the .hcl files to get a functional build.

You should use a kv_v2 secrets engine mounted at packer. It should contain two secrets with the following key/value pairs:

Currently-supported OS flavors:

• Ubuntu Server 22.04 LTS (ubuntu2204)
• Ubuntu Server 24.04 LTS (ubuntu2404)

To run a build locally, you'll need to first export a few Vault-related environment variables:

export VAULT_ADDR="https://vault.example.com/"    # your Vault server
export VAULT_NAMESPACE=""                         # (only need if using namespaces in Vault Enterprise)
export VAULT_TOKEN="hvs.abcdefg"                  # insert a Vault token ID

Alternatively, put those same export commands into a script called vault-env.sh which will be sourced automatically as needed.

Then just run ./build.sh [BUILD], where [BUILD] is one of the descriptors listed above. For example, to build Ubuntu 22.04:

./build.sh ubuntu2204

This repo contains a sample GitHub Actions workflow for running automated builds on a self-hosted runner configured with rootless Docker. The runner will need to have connectivity to the Vault server to be able to retrieve secrets.

NOTE Self-hosted runners should only be used on private GitHub repos. You don't want a PR from a fork to trigger arbitrary code execution on your infrastructure. This public repo is where I share my code with you, but I actually run the workflows from a private repo which is an otherwise exact copy of this one. So if you'd like to use this code for your own automated build process, clone it locally then push it to your own private GitHub repo.

Okay with that disclaimer out of the way, see my notes on runner configuration here.