# Static inventory — k3s node IPs ALIGNED with infra/tofu defaults (Proxmox migration IPs),
# but the SSH target is the pfSense NAT (see NAT HAND-OFF below) — this file is
# HAND-MAINTAINED and must NOT be regenerated from `tofu output -raw ansible_inventory`.
#
# k3s_primary = the --cluster-init server (embedded-etcd founder + Cilium k8sServiceHost).
# k3s_secondary = the two servers that join it. All three are servers (HA embedded etcd).
#
# NAT HAND-OFF (LIVE): the nodes live on the Proxmox LAN at 192.168.1.50/.51/.52, and
# Ansible reaches them over the pfSense NAT at 192.168.2.102, port-forwarded as
# 2250 -> 192.168.1.50:22, 2251 -> 192.168.1.51:22, 2252 -> 192.168.1.52:22.
# Therefore `ansible_host`/`ansible_port` below are the NAT SSH target (192.168.2.102:225x),
# and each node's REAL 192.168.1.x lives in the `k3s_node_ip` var — consumed for the k3s
# --node-ip, the API/tls-san endpoint (k3s_api_host), and general in-cluster parity.
# This file is HAND-MAINTAINED for the NAT: do NOT blindly regenerate it from
#   tofu output -raw ansible_inventory
# because tofu has no knowledge of the pfSense NAT and would overwrite the mapping below.

[k3s_primary]
k3s-dev-1 ansible_host=192.168.2.102 ansible_port=2250 k3s_node_ip=192.168.1.50

[k3s_secondary]
k3s-dev-2 ansible_host=192.168.2.102 ansible_port=2251 k3s_node_ip=192.168.1.51
k3s-dev-3 ansible_host=192.168.2.102 ansible_port=2252 k3s_node_ip=192.168.1.52

[k3s_servers:children]
k3s_primary
k3s_secondary

# The hypervisor/workstation host itself (target of host-prereqs.yml). Its become
# (sudo) password comes from the vaulted group_vars/hypervisor/vault.yml.
[hypervisor]
localhost ansible_connection=local

# VPN egress-gateway node(s) — run the node-level split-tunnel OpenVPN + kill-switch
# (ADR-0015, playbooks/vpn.egress.gateway.yml). Initially just k3s-dev-3 (single gateway;
# add a second host here for Cilium Egress Gateway HA). Members are already defined above
# with their ansible_host under k3s_secondary; this group only tags the egress role target.
[vpn_egress_gateway]
k3s-dev-3