# Static inventory — ALIGNED with infra/tofu defaults (Proxmox migration IPs).
# Regenerate from tofu when IPs/names are overridden:
#   cd ../tofu && tofu output -raw ansible_inventory > ../ansible/inventory/hosts.ini
#
# k3s_primary = the --cluster-init server (embedded-etcd founder + Cilium k8sServiceHost).
# k3s_secondary = the two servers that join it. All three are servers (HA embedded etcd).
#
# NAT HAND-OFF (PM to finalize): the nodes now live on the Proxmox LAN at
# 192.168.1.50/.51/.52. The PM reaches them over a pfSense NAT that is NOT yet created.
# Once the NAT/port-forward rule exists, the `ansible_host` (and possibly
# `ansible_port`) below may need to be the NAT-forwarded address:port instead of the
# raw node IP — do NOT guess it here. If the control node has direct LAN reachability
# to 192.168.1.0/24, the raw IPs below are correct as-is.

[k3s_primary]
k3s-dev-1 ansible_host=192.168.1.50

[k3s_secondary]
k3s-dev-2 ansible_host=192.168.1.51
k3s-dev-3 ansible_host=192.168.1.52

[k3s_servers:children]
k3s_primary
k3s_secondary

# The hypervisor/workstation host itself (target of host-prereqs.yml). Its become
# (sudo) password comes from the vaulted group_vars/hypervisor/vault.yml.
[hypervisor]
localhost ansible_connection=local

# VPN egress-gateway node(s) — run the node-level split-tunnel OpenVPN + kill-switch
# (ADR-0015, playbooks/vpn.egress.gateway.yml). Initially just k3s-dev-3 (single gateway;
# add a second host here for Cilium Egress Gateway HA). Members are already defined above
# with their ansible_host under k3s_secondary; this group only tags the egress role target.
[vpn_egress_gateway]
k3s-dev-3