initial scaffold

terraform/variables.tf

@@ -0,0 +1,68 @@
+variable "libvirt_uri" {
+  description = "libvirt connection URI. Default assumes tofu/kubectl/flux all run directly on the T630 as the 'k8s' user (see docs/SETUP.md step 2) - simplest option, since node IPs (network_cidr) are only directly reachable from the T630 itself. Use qemu+ssh://k8s@t630.lan/system?keyfile=... instead if you'd rather run Terraform from a separate workstation (you'll then need an SSH tunnel for kubectl/flux to reach node IPs - see step 6)."
+  type        = string
+  default     = "qemu:///system"
+}
+
+variable "base_image_url" {
+  description = "Cloud image libvirt clones for every node's disk (downloaded once, cached in the pool)"
+  type        = string
+  default     = "https://cloud-images.ubuntu.com/noble/current/noble-server-cloudimg-amd64.img"
+}
+
+variable "storage_pool" {
+  description = "Name of the libvirt storage pool this project's disks live in (created if missing)"
+  type        = string
+  default     = "k3s-homelab"
+}
+
+variable "storage_pool_path" {
+  description = "Host filesystem path backing the storage pool"
+  type        = string
+  default     = "/var/lib/libvirt/images/k3s-homelab"
+}
+
+variable "network_cidr" {
+  description = "Subnet for the dedicated NAT network this project's VMs live on (isolated from any other libvirt networks already on the host)"
+  type        = string
+  default     = "10.20.30.0/24"
+}
+
+variable "gateway_ip" {
+  description = "Gateway address within network_cidr (libvirt itself, on the host)"
+  type        = string
+  default     = "10.20.30.1"
+}
+
+variable "ssh_public_key" {
+  description = "Public key injected into each VM via cloud-init for the 'k3s' admin user"
+  type        = string
+}
+
+variable "k3s_token" {
+  description = "Shared cluster token agents use to join the k3s server"
+  type        = string
+  sensitive   = true
+}
+
+variable "k8s_api_hostname" {
+  description = "LAN-only hostname for the k3s API server, added to the server's TLS SAN list so client-cert kubeconfigs validate against it. Resolve it via local DNS only (never a public record) - see docs/SETUP.md step 13."
+  type        = string
+  default     = "k8s-api.boglabob.com"
+}
+
+variable "nodes" {
+  description = "k3s nodes to provision. Sizing is deliberately small (2 vCPU/2GB each = 6GB total) so this stays a demo, not a resource hog, alongside the T630's other services."
+  type = map(object({
+    role    = string # "server" or "agent"
+    ip      = string # e.g. "10.20.30.11" - must be inside network_cidr
+    vcpu    = number
+    memory  = number # MiB
+    disk_gb = number
+  }))
+  default = {
+    "k3s-server-1" = { role = "server", ip = "10.20.30.11", vcpu = 2, memory = 2048, disk_gb = 20 }
+    "k3s-agent-1"  = { role = "agent", ip = "10.20.30.12", vcpu = 2, memory = 2048, disk_gb = 20 }
+    "k3s-agent-2"  = { role = "agent", ip = "10.20.30.13", vcpu = 2, memory = 2048, disk_gb = 20 }
+  }
+}