sync-inventory

Infrastructure Sync Inventory

The inventory pipeline is automatic: every successful tofu-proxmox Terrakube apply validates ansible_inventory in the OpenTofu graph and publishes it to the homelab RustFS object store with aws_s3_object. There is no post-apply hook or manual mirror step.

Consumers (ansible-proxmox, ansible-proxmox-apps, ansible-splunk) resolve identically via their load_tofu.yml:

1. TOFU_INVENTORY_PATH — explicit pin (tests/overrides)
2. RustFS artifact — native amazon.aws fetch over the homelab network; scoped credentials come from OpenBao, with no IaC checkout or toolchain
3. Local cache — offline fallback only

There is no manual export/transform/copy flow. Never run tofu output -json ansible_inventory > <consumer>/inventory/... by hand — hand-injected inventories bypass the schema gate and create unmanaged drift.

When invoked, do this

1. Verify the published artifact is current

aws s3api head-object \
  --endpoint-url "$RUSTFS_ENDPOINT" \
  --bucket "$TOFU_INVENTORY_BUCKET" \
  --key "$TOFU_INVENTORY_KEY" \
  --query LastModified

If it predates the last intended infrastructure change, the publish boundary was not crossed — run a real apply (next step). Reference docs: tofu-proxmox/docs/INVENTORY_PUBLISHING.md.

2. Refresh = apply

The only way to republish is the publish boundary itself:

cd $GIT_HOME_PUBLIC/homelab/tofu-proxmox/main
tofu apply

The command submits a remote Terrakube run. The workspace lock serializes changes, Terrakube obtains its OpenBao credentials natively, and the apply updates the RustFS object only when content changed.

3. Validate consumers resolve

In any consumer repo (no creds needed if the cache exists):

ansible-playbook <load_tofu path> -i inventory/hosts.yml -c local

• ansible-proxmox: playbooks/load_tofu.yml
• ansible-proxmox-apps / ansible-splunk: inventory/load_tofu.yml

Watch which resolution step wins ("Resolve inventory from …" task output).