---
# node_baseline — first-boot floor for k3s/Cilium/Longhorn, moved out of cloud-init
# (Proxmox provisioning is API-only). Runs before k3s (site.yml). Idempotent.
node_baseline_packages:
  # VM-only in practice (binds the virtio-serial channel Proxmox attaches) but harmless to install
  # unconditionally: the task below only *starts* it when that channel exists, so on bare metal
  # (prod) it installs and stays a dormant, disabled unit. Kept in the shared list rather than
  # split per-platform so dev and prod install from the exact same package set (R-ENV-02 reuse).
  - qemu-guest-agent
  - open-iscsi
  - nfs-common
  - curl
  - cryptsetup   # Longhorn >=1.12 RequiredPackages check needs the cryptsetup userspace tool (dm_crypt module alone isn't enough)
  # Drive health (smartctl) is a PERMANENT part of a bare-metal node's baseline, not a one-off
  # manual install: prod runs on real disks that can fail/degrade (see infra/PROD-PROVISIONING.md
  # §2/§5 — a ~15-year-old consumer SSD on node 1), where dev's virtio disks never needed it.
  # Installed here (not hand-run with apt-get) so it's declared, idempotent, and present on every
  # node from first baseline — package installation is the role's job, never a manual step
  # (operator ruling, 2026-08-31; same click-ops-never principle as the rest of the repo).
  - smartmontools
node_baseline_kernel_modules:
  - overlay
  - br_netfilter
  - iscsi_tcp
  - dm_crypt
  - nfs
node_baseline_longhorn_device: /dev/vdb
node_baseline_longhorn_mount: /var/lib/longhorn
node_baseline_longhorn_fs_label: longhorn
# Dedicated SSD etcd disk (tofu virtio2 -> /dev/vdc), mounted at the k3s etcd data dir
# so etcd WAL fsync is isolated from Longhorn rebuild I/O on the HDD data disk.
# See docs/plans/ssd-etcd-isolation.md. FS label keeps the fstab entry stable across
# device renames (matches the Longhorn LABEL= approach).
node_baseline_etcd_device: /dev/vdc
node_baseline_etcd_mount: /var/lib/rancher/k3s/server/db
node_baseline_etcd_fs_label: k3s-etcd