Proxmox

In production, post-destroy orphan cleanup is not automatic. It requires an explicit justification and acceptance flag, so a destroy never removes more than what was declared without telling you.

• Post-destroy garbage collection deletes orphaned resources automatically in staging; production requires an explicit risk acceptance and written justification first.
• A hybrid blueprint combines AWS DNS at the edge with Proxmox compute behind it, for a sovereign-cloud-with-public-front-door pattern.

This provider isn't yet included in the capability maturity matrix — it has real Terraform generation and validation, but FinOps, drift, day-2, and copilot support aren't independently rated yet.

resource "proxmox_vm_qemu" "web" {
  name        = "web"
  target_node = "pve"
  clone       = "ubuntu-2404-template"
}