Phase 1 (author-only): node provisioning IaC — tofu + cloud-init + Ansible (T-1.1/1.2/1.3)

OpenTofu libvirt module (k3s-dev NAT 10.73.0.0/24, 3x 6GiB/4vCPU VMs, 20G OS +
40G thin data, host-passthrough), cloud-init baseline (k3s/Cilium/Longhorn
prereqs, static net), Ansible k3s-HA + Cilium (kube-proxy replacement, Gateway
API, Hubble; flannel/kube-proxy/Traefik disabled). PM fix: escape ${...} in a
cloud-init template comment (tofu templatefile parse). tofu fmt/init/validate =
Success; ansible --syntax-check + yamllint pass. NOTHING executed (no apply).

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

infra/tofu/versions.tf

@@ -0,0 +1,25 @@
+# versions.tf — OpenTofu + provider pins (Phase 1 T-1.1).
+#
+# Toolchain is pinned to match the dev container (infra/devcontainer/versions.env):
+#   OpenTofu 1.9.0. The dmacvicar/libvirt provider is pinned HERE (not in the
+#   dev container) per the note in that file.
+#
+# AUTHOR-ONLY: this module is written but NOT applied. The PM static-validates
+# with `tofu fmt -check` / `tofu validate` in the dev container.
+
+terraform {
+  required_version = "1.9.0"
+
+  required_providers {
+    libvirt = {
+      source  = "dmacvicar/libvirt"
+      version = "~> 0.8.1"
+    }
+  }
+}
+
+provider "libvirt" {
+  # System-level libvirt (qemu:///system) so VMs/pools/networks are host-wide,
+  # matching the dev-container mount of the host libvirt socket (PHASE1-SCOPE risks).
+  uri = var.libvirt_uri
+}