tofu(proxmox): API-only native cloud-init; move node baseline to Ansible node_baseline role

Co-Authored-By: Claude Opus 4.8 <[email protected]>

infra/ansible/roles/node_baseline/tasks/main.yml

@@ -0,0 +1,69 @@
+---
+- name: Install baseline packages (guest agent, Longhorn/iscsi/nfs prereqs)
+  ansible.builtin.apt:
+    name: "{{ node_baseline_packages }}"
+    state: present
+    update_cache: true
+    cache_valid_time: 3600
+
+- name: Persist kernel modules for k3s/Cilium/Longhorn
+  ansible.builtin.copy:
+    dest: /etc/modules-load.d/k3s-cilium-longhorn.conf
+    owner: root
+    group: root
+    mode: "0644"
+    content: "{{ node_baseline_kernel_modules | join('\n') }}\n"
+
+- name: Load kernel modules now
+  community.general.modprobe:
+    name: "{{ item }}"
+    state: present
+  loop: "{{ node_baseline_kernel_modules }}"
+
+- name: Install sysctl tuning for k3s/Cilium
+  ansible.builtin.copy:
+    dest: /etc/sysctl.d/99-k3s-cilium.conf
+    owner: root
+    group: root
+    mode: "0644"
+    content: |
+      net.bridge.bridge-nf-call-iptables  = 1
+      net.bridge.bridge-nf-call-ip6tables = 1
+      net.ipv4.ip_forward                 = 1
+      net.ipv6.conf.all.forwarding        = 1
+      fs.inotify.max_user_instances       = 8192
+      fs.inotify.max_user_watches         = 524288
+  notify: Reload sysctl
+
+- name: Enable and start iscsid (Longhorn) and qemu-guest-agent
+  ansible.builtin.systemd:
+    name: "{{ item }}"
+    enabled: true
+    state: started
+  loop:
+    - iscsid
+    - qemu-guest-agent
+
+- name: Create ext4 filesystem on the Longhorn data disk (data-safe; skips if present)
+  community.general.filesystem:
+    fstype: ext4
+    dev: "{{ node_baseline_longhorn_device }}"
+    opts: "-L {{ node_baseline_longhorn_fs_label }}"
+
+- name: Mount the Longhorn data disk
+  ansible.posix.mount:
+    path: "{{ node_baseline_longhorn_mount }}"
+    src: "LABEL={{ node_baseline_longhorn_fs_label }}"
+    fstype: ext4
+    opts: "defaults,nofail,x-systemd.device-timeout=5s"
+    state: mounted
+
+- name: Disable swap now
+  ansible.builtin.command: swapoff -a
+  changed_when: false
+
+- name: Neutralize swap entries in fstab (kubelet requires swap off)
+  ansible.builtin.replace:
+    path: /etc/fstab
+    regexp: '^([^#].*\sswap\s.*)$'
+    replace: '# \1  # disabled for k3s/kubelet'