---
# Shared connection + cluster facts for every k3s node.

# cloud-init created this login user (tofu var login_user); it has NOPASSWD sudo.
ansible_user: k3s

# The kube-apiserver endpoint the whole stack agrees on: the primary's REAL node IP.
# NOTE: ansible_host is now the pfSense NAT SSH target (192.168.2.102:225x), NOT the node
# IP — so we read the real 192.168.1.x from k3s_node_ip instead. Used for k3s --tls-san /
# secondary --server AND for Cilium k8sServiceHost so the Ansible bootstrap and the Flux
# HelmRelease stay in PARITY (docs/02 contract).
k3s_api_host: "{{ hostvars[groups['k3s_primary'][0]]['k3s_node_ip'] }}"
k3s_api_port: 6443

# Controller (dev container) reaches the kube-API through an SSH tunnel
# (local 127.0.0.1:16443 -> primary 127.0.0.1:6443), because the API port is not
# NAT-forwarded and 192.168.1.50:6443 is unroutable from the dev host. Only the
# controller kubeconfig uses this; k8sServiceHost (in-cluster) stays the real node IP.
cluster_controller_api_server: "https://127.0.0.1:16443"