# Static inventory — ALIGNED with infra/tofu defaults (LOCKED PHASE1-SCOPE IPs).
# Regenerate from tofu when IPs/names are overridden:
#   cd ../tofu && tofu output -raw ansible_inventory > ../ansible/inventory/hosts.ini
#
# k3s_primary = the --cluster-init server (embedded-etcd founder + Cilium k8sServiceHost).
# k3s_secondary = the two servers that join it. All three are servers (HA embedded etcd).

[k3s_primary]
k3s-dev-1 ansible_host=10.73.0.11

[k3s_secondary]
k3s-dev-2 ansible_host=10.73.0.12
k3s-dev-3 ansible_host=10.73.0.13

[k3s_servers:children]
k3s_primary
k3s_secondary

# The hypervisor/workstation host itself (target of host-prereqs.yml). Its become
# (sudo) password comes from the vaulted group_vars/hypervisor/vault.yml.
[hypervisor]
localhost ansible_connection=local

# VPN egress-gateway node(s) — run the node-level split-tunnel OpenVPN + kill-switch
# (ADR-0015, playbooks/vpn.egress.gateway.yml). Initially just k3s-dev-3 (single gateway;
# add a second host here for Cilium Egress Gateway HA). Members are already defined above
# with their ansible_host under k3s_secondary; this group only tags the egress role target.
[vpn_egress_gateway]
k3s-dev-3