diff --git a/proxmox/.gitignore b/proxmox/.gitignore
new file mode 100644
index 0000000..7ccd5e8
--- /dev/null
+++ b/proxmox/.gitignore
@@ -0,0 +1,7 @@
+.terraform/
+.terraform.lock.hcl
+terraform.tfstate
+terraform.tfstate.backup
+terraform.tfvars
+*.tfvars
+!*.tfvars.example
diff --git a/proxmox/main.tf b/proxmox/main.tf
new file mode 100644
index 0000000..aaba592
--- /dev/null
+++ b/proxmox/main.tf
@@ -0,0 +1,20 @@
+terraform {
+  required_providers {
+    proxmox = {
+      source  = "bpg/proxmox"
+      version = "~> 0.69"
+    }
+  }
+}
+
+provider "proxmox" {
+  endpoint  = "https://192.168.50.201:8006/"
+  api_token = var.proxmox_api_token
+  insecure  = true # self-signed cert on home Proxmox
+
+  ssh {
+    agent    = false
+    username = "root"
+    private_key = file(var.ssh_private_key_path)
+  }
+}
diff --git a/proxmox/scripts/create-debian12-template.sh b/proxmox/scripts/create-debian12-template.sh
new file mode 100644
index 0000000..bcd40b7
--- /dev/null
+++ b/proxmox/scripts/create-debian12-template.sh
@@ -0,0 +1,58 @@
+#!/bin/bash
+# Run this in the Proxmox web shell (node: proxmox → Shell)
+# Creates a Debian 12 cloud-init template (VM ID 9000)
+
+set -euo pipefail
+
+TEMPLATE_ID=9000
+TEMPLATE_NAME="debian-12-cloud"
+STORAGE="local-lvm"
+IMAGE_URL="https://cloud.debian.org/images/cloud/bookworm/latest/debian-12-genericcloud-amd64.qcow2"
+IMAGE_FILE="/tmp/debian-12-genericcloud-amd64.qcow2"
+
+echo "==> Downloading Debian 12 cloud image..."
+wget -q --show-progress -O "$IMAGE_FILE" "$IMAGE_URL"
+
+echo "==> Installing qemu-guest-agent into image..."
+apt-get install -y libguestfs-tools
+virt-customize -a "$IMAGE_FILE" \
+  --install qemu-guest-agent \
+  --truncate /etc/machine-id
+
+echo "==> Removing old template if it exists..."
+if qm status $TEMPLATE_ID &>/dev/null; then
+  qm destroy $TEMPLATE_ID --purge
+fi
+
+echo "==> Creating VM $TEMPLATE_ID..."
+qm create $TEMPLATE_ID \
+  --name "$TEMPLATE_NAME" \
+  --memory 2048 \
+  --cores 2 \
+  --net0 virtio,bridge=vmbr0 \
+  --ostype l26 \
+  --agent enabled=1 \
+  --serial0 socket \
+  --vga serial0
+
+echo "==> Importing disk to $STORAGE..."
+qm importdisk $TEMPLATE_ID "$IMAGE_FILE" $STORAGE
+
+echo "==> Configuring disk and cloud-init..."
+qm set $TEMPLATE_ID \
+  --scsihw virtio-scsi-pci \
+  --scsi0 "$STORAGE:vm-${TEMPLATE_ID}-disk-0,discard=on" \
+  --ide2 "$STORAGE:cloudinit" \
+  --boot c \
+  --bootdisk scsi0 \
+  --ipconfig0 ip=dhcp \
+  --ciupgrade 1
+
+echo "==> Converting to template..."
+qm template $TEMPLATE_ID
+
+echo "==> Cleaning up..."
+rm -f "$IMAGE_FILE"
+
+echo ""
+echo "Done! Template ID $TEMPLATE_ID ($TEMPLATE_NAME) is ready."
diff --git a/proxmox/terraform.tfvars.example b/proxmox/terraform.tfvars.example
new file mode 100644
index 0000000..3a7a9f6
--- /dev/null
+++ b/proxmox/terraform.tfvars.example
@@ -0,0 +1,12 @@
+# Copy this to terraform.tfvars and fill in your values
+# terraform.tfvars is gitignored
+
+proxmox_api_token    = "terraform@pve!terraform=xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"
+ssh_private_key_path = "~/.ssh/id_ecdsa"
+ssh_public_key       = "ecdsa-sha2-nistp256 AAAA... luddie@shadowfax"
+
+vm_name      = "debian-vm"
+vm_id        = 100
+vm_cores     = 2
+vm_memory    = 2048
+vm_disk_size = 20
diff --git a/proxmox/variables.tf b/proxmox/variables.tf
new file mode 100644
index 0000000..c170b7f
--- /dev/null
+++ b/proxmox/variables.tf
@@ -0,0 +1,45 @@
+variable "proxmox_api_token" {
+  description = "Proxmox API token in the format user@realm!token_name=secret"
+  type        = string
+  sensitive   = true
+}
+
+variable "ssh_private_key_path" {
+  description = "Path to SSH private key for Proxmox host access"
+  type        = string
+  default     = "~/.ssh/id_ecdsa"
+}
+
+variable "ssh_public_key" {
+  description = "SSH public key to inject into created VMs"
+  type        = string
+}
+
+variable "vm_name" {
+  description = "Name of the VM to create"
+  type        = string
+  default     = "debian-vm"
+}
+
+variable "vm_id" {
+  description = "Proxmox VM ID (100-999 for regular VMs)"
+  type        = number
+  default     = 100
+}
+
+variable "vm_cores" {
+  type    = number
+  default = 2
+}
+
+variable "vm_memory" {
+  description = "Memory in MiB"
+  type        = number
+  default     = 2048
+}
+
+variable "vm_disk_size" {
+  description = "Disk size in GiB"
+  type        = number
+  default     = 20
+}
diff --git a/proxmox/vm.tf b/proxmox/vm.tf
new file mode 100644
index 0000000..3f491da
--- /dev/null
+++ b/proxmox/vm.tf
@@ -0,0 +1,65 @@
+resource "proxmox_virtual_environment_vm" "vm" {
+  name      = var.vm_name
+  node_name = "proxmox"
+  vm_id     = var.vm_id
+
+  clone {
+    vm_id = 9000 # debian-12-cloud template
+    full  = true
+  }
+
+  agent {
+    enabled = true
+  }
+
+  cpu {
+    cores = var.vm_cores
+    type  = "x86-64-v2-AES"
+  }
+
+  memory {
+    dedicated = var.vm_memory
+  }
+
+  disk {
+    datastore_id = "local-lvm"
+    interface    = "scsi0"
+    size         = var.vm_disk_size
+    discard      = "on"
+    iothread     = true
+  }
+
+  network_device {
+    bridge = "vmbr0"
+    model  = "virtio"
+  }
+
+  operating_system {
+    type = "l26"
+  }
+
+  initialization {
+    datastore_id = "local-lvm"
+
+    ip_config {
+      ipv4 {
+        address = "dhcp"
+      }
+    }
+
+    user_account {
+      username = "debian"
+      keys     = [var.ssh_public_key]
+    }
+  }
+
+  lifecycle {
+    ignore_changes = [
+      initialization[0].user_account[0].password,
+    ]
+  }
+}
+
+output "vm_ipv4_address" {
+  value = proxmox_virtual_environment_vm.vm.ipv4_addresses
+}