tofu(proxmox): API-only native cloud-init; move node baseline to Ansible node_baseline role

Co-Authored-By: Claude Opus 4.8 <[email protected]>

infra/cloud-init/README.md

@@ -1,6 +1,14 @@
 # infra/cloud-init — first-boot baseline templates
 
-The "Baseline" node lifecycle stage (docs/02 stage 2). `user-data.yaml.tftpl` is
+> **RETIRED (API-only migration):** the `user-data.yaml.tftpl` snippet was removed
+> when Proxmox provisioning moved to **API-only native cloud-init**. Custom snippets
+> require SSH/SFTP to the Proxmox host, which is not reachable here, so bpg's native
+> `initialization` block now sets only the login user + SSH keys and static IP/DNS
+> (via the built-in cloud-init API options). The rich first-boot baseline (packages,
+> kernel modules, Longhorn disk, swap-off) now lives in the Ansible **`node_baseline`
+> role** (`infra/ansible`), run before k3s. The notes below are historical context.
+
+The "Baseline" node lifecycle stage (docs/02 stage 2). `user-data.yaml.tftpl` was
 rendered by OpenTofu (`templatefile()`) and shipped to Proxmox as a **cloud-init
 user-data snippet** (`proxmox_virtual_environment_file`, one per node), referenced
 by each VM's `initialization.user_data_file_id`. **Authoring only — never applied.**

infra/cloud-init/user-data.yaml.tftpl

@@ -1,75 +0,0 @@
-#cloud-config
-# user-data — first-boot BASELINE only (docs/02 stage 2 "Baseline"). Rendered by
-# OpenTofu templatefile() ($${...} = tofu vars, NOT cloud-init). Everything here is
-# the node prerequisite floor for k3s / Cilium / Longhorn / KubeVirt. Cluster join,
-# k3s, and Cilium install are ANSIBLE's job (T-1.3) — deliberately NOT done here.
-
-hostname: ${hostname}
-fqdn: ${fqdn}
-preserve_hostname: false
-
-# Login user (also the Ansible ansible_user). Public key only — no passwords.
-users:
-  - name: ${username}
-    groups: [sudo]
-    shell: /bin/bash
-    sudo: "ALL=(ALL) NOPASSWD:ALL"
-    lock_passwd: true
-    ssh_authorized_keys:
-      - ${ssh_authorized_key}
-
-# Baseline packages: guest agent (tofu/Proxmox), and Longhorn's node prerequisites
-# (open-iscsi provides iscsid + iscsiadm; nfs-common provides the NFS client).
-package_update: true
-packages:
-  - qemu-guest-agent
-  - open-iscsi
-  - nfs-common
-  - curl
-
-# Kernel modules required by Cilium (overlay, br_netfilter) and Longhorn
-# (iscsi_tcp, dm_crypt, nfs). Loaded now and persisted for reboots.
-write_files:
-  - path: /etc/modules-load.d/k3s-cilium-longhorn.conf
-    permissions: "0644"
-    content: |
-      overlay
-      br_netfilter
-      iscsi_tcp
-      dm_crypt
-      nfs
-  - path: /etc/sysctl.d/99-k3s-cilium.conf
-    permissions: "0644"
-    content: |
-      net.bridge.bridge-nf-call-iptables  = 1
-      net.bridge.bridge-nf-call-ip6tables = 1
-      net.ipv4.ip_forward                 = 1
-      net.ipv6.conf.all.forwarding        = 1
-      fs.inotify.max_user_instances       = 8192
-      fs.inotify.max_user_watches         = 524288
-
-# Dedicated Longhorn data disk (/dev/vdb, the VM's virtio1 disk) → ext4 mounted at
-# /var/lib/longhorn. nofail so a node still boots if the disk is absent during a rebuild.
-fs_setup:
-  - label: longhorn
-    filesystem: ext4
-    device: /dev/vdb
-    partition: none
-    overwrite: false
-mounts:
-  - ["LABEL=longhorn", "/var/lib/longhorn", "ext4", "defaults,nofail,x-systemd.device-timeout=5s", "0", "2"]
-
-runcmd:
-  # Apply modules + sysctls now (cloud-init runs after they're written).
-  - ["modprobe", "overlay"]
-  - ["modprobe", "br_netfilter"]
-  - ["modprobe", "iscsi_tcp"]
-  - ["sysctl", "--system"]
-  # Longhorn needs iscsid running; guest agent for Proxmox/tofu.
-  - ["systemctl", "enable", "--now", "iscsid"]
-  - ["systemctl", "enable", "--now", "qemu-guest-agent"]
-  # k3s/kubelet baseline: disable swap.
-  - ["swapoff", "-a"]
-  - ["sed", "-i", "/\\sswap\\s/d", "/etc/fstab"]
-
-# NOTE: no reboot here — the baseline is live after runcmd. Ansible connects next.