I got sick of the work around it, so one weekend recently, while my partner was out of town, I used Claude to help re-architect my whole homelab to be effectively 100% IaC with OpenTofu and Salt. Went through the whole architecture, networking, etc. Now I would just need to pull down the repo to my Mac and can spin everything up via PXE to install Proxmox, Ubuntu, etc., and then I have a scheduled golden image build, this can spin up my network devices with a bunch of VLANs and east-west firewalls, Kea and Unbound, even more esoteric things like a VM that passes through a USB ADS-B receiver. It spins up Talos to drive a Kubernetes cluster and everything from there. The only thing it can't (or doesn't?) manage is my Synology servers.

Same stack here — proxmox as the hypervisor, packer for the golden images, opentofu to deploy, ansible to configure, whether the vm runs bare services or hosts containers. The separation is what keeps it low-effort: image build is one job, provisioning another, config a third, so a change only ever touches one layer. Few minutes a week, rollback through captured state or pinned versions.

On your synology holdout: I run two of them plus a custom truenas, and I treat the storage layer as the deliberate boundary of the declarative model rather than fighting to pull it in. Topology is truenas on fast ssd backing the running vms, synology one as primary, synology two as the backup target for both truenas and the primary. The synologys are imperative islands — dsm doesn't want to be config-managed — so I codify the consumption side (the exports, and the vms that mount them) and treat the boxes themselves as data, not infra. Truenas is the exception, since the api gets you closer to declarable.

Are you leaving the synology fully hands-off, or driving any of it through the api?