infra(tofu): docs + example for the Proxmox migration

Update tofu README (Proxmox targets table, operator prerequisites:
enable Snippets content on `local`, endpoint scheme fix, pfSense NAT),
terraform.tfvars.example (Proxmox vars + env-only auth, token never a
tofu var), and the devcontainer versions.env provider note.

Co-Authored-By: Claude Opus 4.8 <[email protected]>

infra/tofu/terraform.tfvars.example

@@ -4,34 +4,57 @@
 # local values never land in git. This *.example file is safe to commit — it
 # carries NO private material (SSH *public* key only). Never put a private key here.
 #
-# Defaults for everything below already encode the LOCKED PHASE1-SCOPE decisions;
-# the ONLY required value is ssh_authorized_key.
+# The Proxmox API TOKEN is NEVER a tofu var — it is read from the environment
+# (PROXMOX_VE_API_TOKEN) by the provider so it never enters state/vars. Same for
+# the endpoint/insecure flag: source the operator env file before running tofu:
+#   export PROXMOX_VE_ENDPOINT="https://192.168.2.102:8006/"
+#   export PROXMOX_VE_API_TOKEN="user@realm!tokenid=SECRET"
+#   export PROXMOX_VE_INSECURE="true"
+#   # optional — lets tofu normalize a schemeless endpoint (prepend https://):
+#   export TF_VAR_proxmox_endpoint="$PROXMOX_VE_ENDPOINT"
+#
+# Defaults for everything below already encode the VERIFIED Proxmox migration
+# targets; the ONLY required value is ssh_authorized_key.
 
 # REQUIRED — your SSH *public* key (contents of e.g. ~/.ssh/id_ed25519.pub).
 ssh_authorized_key = "ssh-ed25519 AAAA...replace-with-your-public-key... user@host"
 
 # --- optional overrides (defaults shown) -----------------------------------
 
-# libvirt_uri   = "qemu:///system"
-# pool_name     = "default"
+# --- Proxmox placement ---
+# proxmox_node    = "proxmox"
+# datastore       = "Storage"   # ZFS, OS + data disks
+# image_datastore = "local"     # cloud image + cloud-init snippets
+# bridge          = "vmbr0"
+# proxmox_insecure = true
+# proxmox_endpoint = "https://192.168.2.102:8006/"   # or set TF_VAR_proxmox_endpoint
 
+# --- cluster shape ---
 # node_count       = 3
 # node_name_prefix = "k3s-dev-"
-# node_ips         = ["10.73.0.11", "10.73.0.12", "10.73.0.13"]
+# node_ips         = ["192.168.1.50", "192.168.1.51", "192.168.1.52"]
 
-# vcpu          = 4
-# memory_mib    = 6144
-# os_disk_gib   = 20
-# data_disk_gib = 40
-# cpu_mode      = "host-passthrough"
+# --- per-node sizing ---
+# vcpu          = 6
+# memory_mib    = 16384
+# os_disk_gib   = 40
+# data_disk_gib = 100
+# cpu_type      = "host"
 
-# network_name    = "k3s-dev"
-# network_cidr    = "10.73.0.0/24"
-# network_gateway = "10.73.0.1"
+# --- network ---
+# network_cidr    = "192.168.1.0/24"
+# network_gateway = "192.168.1.1"
+# dns_server      = "192.168.1.18"
 # network_prefix  = 24
 
+# --- Cilium L2 VIP reservation (consumed by platform-config/cilium) ---
+# cilium_l2_vip_range_start = "192.168.1.53"
+# cilium_l2_vip_range_end   = "192.168.1.60"
+
+# --- identity ---
 # login_user  = "k3s"
 # node_domain = "k3s.dev.local"
 
-# Point at a locally pre-downloaded image to avoid re-fetching on each apply:
-# image_source = "/var/lib/libvirt/images/debian-12-genericcloud-amd64.qcow2"
+# --- base image ---
+# image_source    = "https://cloud.debian.org/images/cloud/bookworm/latest/debian-12-genericcloud-amd64.qcow2"
+# image_file_name = "debian-12-genericcloud-amd64.img"