- drop stale libvirt socket mount + LIBVIRT_DEFAULT_URI (old KVM cluster) - auto-open an SSH tunnel (local :16443 -> primary 127.0.0.1:6443 over the pfSense SSH NAT) on each run so kubectl/flux/helm reach the cluster with no manual setup; DEV_NO_TUNNEL=1 opts out, K3S_SSH_* env overrides the NAT front - refresh header/usage comments (bpg/proxmox, not dmacvicar/libvirt) Co-Authored-By: Claude Opus 4.8 <[email protected]>
infra/ — Phase 1 node provisioning (local KVM)
OpenTofu (libvirt) + cloud-init + Ansible bring up the 3-node k3s/Cilium cluster. See PHASE1-SCOPE.md. Spec: ../home-network-k3s/docs/02-environments-and-provisioning.md.