infra(net): repoint ansible inventory + Cilium VIPs to the Proxmox LAN

- ansible hosts.ini: node ansible_host -> 192.168.1.50/.51/.52, with a
  clear note that the PM may need to swap these for the pfSense
  NAT-forwarded address:port once that NAT rule exists (not guessed here).
  k3s_api_host derives from the inventory, so it follows automatically.
- Cilium CiliumLoadBalancerIPPool -> 192.168.1.53-.60 (matches the tofu
  cilium_l2_vip reservation on the new LAN).
- CiliumL2AnnouncementPolicy: broaden interface selector to ^e(n|th) so
  the Proxmox NIC name (ens18/eth0) need not be pinned; flagged
  verify-at-bringup.

Co-Authored-By: Claude Opus 4.8 <[email protected]>

infra/ansible/inventory/hosts.ini

@@ -1,16 +1,23 @@
-# Static inventory — ALIGNED with infra/tofu defaults (LOCKED PHASE1-SCOPE IPs).
+# Static inventory — ALIGNED with infra/tofu defaults (Proxmox migration IPs).
 # Regenerate from tofu when IPs/names are overridden:
 #   cd ../tofu && tofu output -raw ansible_inventory > ../ansible/inventory/hosts.ini
 #
 # k3s_primary = the --cluster-init server (embedded-etcd founder + Cilium k8sServiceHost).
 # k3s_secondary = the two servers that join it. All three are servers (HA embedded etcd).
+#
+# NAT HAND-OFF (PM to finalize): the nodes now live on the Proxmox LAN at
+# 192.168.1.50/.51/.52. The PM reaches them over a pfSense NAT that is NOT yet created.
+# Once the NAT/port-forward rule exists, the `ansible_host` (and possibly
+# `ansible_port`) below may need to be the NAT-forwarded address:port instead of the
+# raw node IP — do NOT guess it here. If the control node has direct LAN reachability
+# to 192.168.1.0/24, the raw IPs below are correct as-is.
 
 [k3s_primary]
-k3s-dev-1 ansible_host=10.73.0.11
+k3s-dev-1 ansible_host=192.168.1.50
 
 [k3s_secondary]
-k3s-dev-2 ansible_host=10.73.0.12
-k3s-dev-3 ansible_host=10.73.0.13
+k3s-dev-2 ansible_host=192.168.1.51
+k3s-dev-3 ansible_host=192.168.1.52
 
 [k3s_servers:children]
 k3s_primary

platform-config/cilium/l2-announcement-policy.yaml

@@ -1,8 +1,10 @@
 ---
 # CiliumL2AnnouncementPolicy — ARP-announce LoadBalancer VIPs on the node LAN so hosts on
-# 10.73.0.0/24 can reach Gateway listeners at the pool IP (l2announcements.enabled=true in the
+# 192.168.1.0/24 can reach Gateway listeners at the pool IP (l2announcements.enabled=true in the
 # Cilium HelmRelease turns on the controller; this policy scopes WHAT/WHERE it announces).
-# Announces on the primary ethernet interface (cloud-init names it ens3; `^en` matches ens*/enp*).
+# Announces on the primary ethernet interface. On Proxmox VMs the NIC is typically ens18/eth0;
+# `^e(n|th)` matches ens*/enp*/eth* so the exact name need not be pinned. VERIFY-AT-BRINGUP: if
+# announcement fails, confirm the node's primary NIC name (`ip -o link`) matches this selector.
 apiVersion: cilium.io/v2alpha1
 kind: CiliumL2AnnouncementPolicy
 metadata:
@@ -11,7 +13,7 @@ spec:
   loadBalancerIPs: true       # announce LoadBalancer Service VIPs (Gateway listeners)
   externalIPs: false
   interfaces:
-    - ^en
+    - ^e(n|th)
   nodeSelector:
     matchLabels:
       kubernetes.io/os: linux

platform-config/cilium/l2-ip-pool.yaml

@@ -1,10 +1,10 @@
 ---
 # CiliumLoadBalancerIPPool — reserved VIP range for LoadBalancer Services. Gateway API listeners
 # (gatewayClassName: cilium) get their address from here. Range matches the tofu reservation
-# (cilium_l2_vip_range 10.73.0.240-.250) on the k3s-dev NAT 10.73.0.0/24; DHCP is OFF on that
-# network so the range can never be leased elsewhere.
+# (cilium_l2_vip_range 192.168.1.53-.60) on the Proxmox LAN 192.168.1.0/24. These addresses sit
+# OUTSIDE the node IPs (.50/.51/.52) and any DHCP scope, so nothing else claims them.
 #
-# NOTE (dev): the range is hardcoded to the dev NAT reservation. A prod overlay must supply the
+# NOTE (dev): the range is hardcoded to the dev LAN reservation. A prod overlay must supply the
 # prod LAN range (parameterize via cluster-vars when prod hardware is built). See DECISIONS-LOG.
 apiVersion: cilium.io/v2alpha1
 kind: CiliumLoadBalancerIPPool
@@ -12,5 +12,5 @@ metadata:
   name: default-pool
 spec:
   blocks:
-    - start: "10.73.0.240"
-      stop: "10.73.0.250"
+    - start: "192.168.1.53"
+      stop: "192.168.1.60"