#cloud-config
# user-data — first-boot BASELINE only (docs/02 stage 2 "Baseline"). Rendered by
# OpenTofu templatefile() ($${...} = tofu vars, NOT cloud-init). Everything here is
# the node prerequisite floor for k3s / Cilium / Longhorn / KubeVirt. Cluster join,
# k3s, and Cilium install are ANSIBLE's job (T-1.3) — deliberately NOT done here.

hostname: ${hostname}
fqdn: ${fqdn}
preserve_hostname: false

# Login user (also the Ansible ansible_user). Public key only — no passwords.
users:
  - name: ${username}
    groups: [sudo]
    shell: /bin/bash
    sudo: "ALL=(ALL) NOPASSWD:ALL"
    lock_passwd: true
    ssh_authorized_keys:
      - ${ssh_authorized_key}

# Baseline packages: guest agent (tofu/Proxmox), and Longhorn's node prerequisites
# (open-iscsi provides iscsid + iscsiadm; nfs-common provides the NFS client).
package_update: true
packages:
  - qemu-guest-agent
  - open-iscsi
  - nfs-common
  - curl

# Kernel modules required by Cilium (overlay, br_netfilter) and Longhorn
# (iscsi_tcp, dm_crypt, nfs). Loaded now and persisted for reboots.
write_files:
  - path: /etc/modules-load.d/k3s-cilium-longhorn.conf
    permissions: "0644"
    content: |
      overlay
      br_netfilter
      iscsi_tcp
      dm_crypt
      nfs
  - path: /etc/sysctl.d/99-k3s-cilium.conf
    permissions: "0644"
    content: |
      net.bridge.bridge-nf-call-iptables  = 1
      net.bridge.bridge-nf-call-ip6tables = 1
      net.ipv4.ip_forward                 = 1
      net.ipv6.conf.all.forwarding        = 1
      fs.inotify.max_user_instances       = 8192
      fs.inotify.max_user_watches         = 524288

# Dedicated Longhorn data disk (/dev/vdb, the VM's virtio1 disk) → ext4 mounted at
# /var/lib/longhorn. nofail so a node still boots if the disk is absent during a rebuild.
fs_setup:
  - label: longhorn
    filesystem: ext4
    device: /dev/vdb
    partition: none
    overwrite: false
mounts:
  - ["LABEL=longhorn", "/var/lib/longhorn", "ext4", "defaults,nofail,x-systemd.device-timeout=5s", "0", "2"]

runcmd:
  # Apply modules + sysctls now (cloud-init runs after they're written).
  - ["modprobe", "overlay"]
  - ["modprobe", "br_netfilter"]
  - ["modprobe", "iscsi_tcp"]
  - ["sysctl", "--system"]
  # Longhorn needs iscsid running; guest agent for Proxmox/tofu.
  - ["systemctl", "enable", "--now", "iscsid"]
  - ["systemctl", "enable", "--now", "qemu-guest-agent"]
  # k3s/kubelet baseline: disable swap.
  - ["swapoff", "-a"]
  - ["sed", "-i", "/\\sswap\\s/d", "/etc/fstab"]

# NOTE: no reboot here — the baseline is live after runcmd. Ansible connects next.