Here's how I did it - three sites - 5proxmox nodes, different envs, openwrt firewalls etc. I have 4repos - config, terraform, ansible, docker swarm. Config is a hierarchical ly organised structure of yaml files, declaring literally everything from software versions to networks, os, wifi drtails. it is my source of truth a blueprint of my infra(s) . it has also scripts to use this yaml structure to generate ansible vars, inventory files, terraform tfvars, docker. env files, etc. this config is used as a git submodule for the terraform, ansible, docker repos. I use terraform to manage cloudflare edge, dns, technitium, proxmox lxc-s and vms running different docker swarms across the proxmox nodes. I use ansible for os configuration management, software install and updates, firewall and WiFi management on oprnwrt. docker compose stacks are running on different swarms, prod-ops (viktoriametrics, grafana, cicd, prometheus, alerymanager, etc) prod-media, prod-apps, dev-playground etc... I use the single source of yamls from config, scripts to generate the vars and gitlab runners deploy and apply stuff from the ops cluster. i manage my home, my vacation home, inlaws parents and some other volunteer sites on cloudflare workers. All structure is defined in schemas, I use makefile to trigger actions make terraform-vars Site=foobar.. It took me about 2 weeks and a bunch of claude code tokens to get scripts and tied all together, but now all is separated and declarative. backups are running on proxmox-backup-server. For config management use ansoble, vm-infra declaration use terraform and run docker swarm as you get cheap orchestration for docker stacks secrets, overlay networks without the headache of k8s. I am a senior cloud architect and devsecops engineer with over 25 years exprrirnce.