Same stack here — proxmox as the hypervisor, packer for the golden images,
opentofu to deploy, ansible to configure, whether the vm runs bare services or
hosts containers. The separation is what keeps it low-effort: image build is one
job, provisioning another, config a third, so a change only ever touches one
layer. Few minutes a week, rollback through captured state or pinned versions.
On your synology holdout: I run two of them plus a custom truenas, and I treat
the storage layer as the deliberate boundary of the declarative model rather
than fighting to pull it in. Topology is truenas on fast ssd backing the running
vms, synology one as primary, synology two as the backup target for both truenas
and the primary. The synologys are imperative islands — dsm doesn't want to be
config-managed — so I codify the consumption side (the exports, and the vms that
mount them) and treat the boxes themselves as data, not infra. Truenas is the
exception, since the api gets you closer to declarable.
Are you leaving the synology fully hands-off, or driving any of it through the api?