ansible(proxmox): route Ansible via pfSense NAT; decouple k3s node-ip from ansible_host; mount vault-pass into dev container

- inventory routes SSH via 192.168.2.102:2250/2251/2252; new k3s_node_ip carries each node's real 192.168.1.x for --node-ip / k3s_api_host / Cilium parity - dev.sh bind-mounts ~/.config/home-k3s/ansible-vault-pass (ro) so vaulted playbooks can run in the pinned container (ansible.cfg vault_password_file) Co-Authored-By: Claude Opus 4.8 <[email protected]>
2026-08-25 11:55:37 -05:00
1 parent 28d200caf2
commit 1ff25318c9
@@ -43,6 +43,7 @@ run() {
    -v "${REPO_ROOT}:/work" -w /work \
    -v "${HOME}/.ssh:/root/.ssh:ro" \
    -v "${HOME}/.config/sops:/root/.config/sops" \
+    -v "${HOME}/.config/home-k3s/ansible-vault-pass:/root/.config/home-k3s/ansible-vault-pass:ro" \
    -e LIBVIRT_DEFAULT_URI=qemu:///system \
    -e KUBECONFIG="${DEV_KUBECONFIG:-/work/infra/ansible/.cache/dev.kubeconfig}" \
    "$IMAGE" "$@"