chore: split nixos and opentofu

BOOTSTRAP.md

@@ -1,51 +1,64 @@
 # Bootstrap Guide
 
-This document outlines the manual, real-world steps required to initialize the NixOS GitOps environment for the first time. You must perform these steps before the CI/CD pipeline or any automated staging environments can function.
+This document outlines the manual steps required to initialize the NixOS GitOps environment on a fresh Proxmox host. You must perform these steps before the CI/CD pipeline or any automated staging environments can function.
 
 ## Secret Management Initialization
 
-We use `sops-nix` to manage secrets, adhering to a strict separation between Production and Staging. You must generate these keys locally on a secure workstation.
+We use `sops-nix` to manage secrets, separating between Production and Staging.
 
 **Prerequisites:** Install `age` ([age documentation](https://github.com/FiloSottile/age)).
 
-1. **Generate the Production Master Key:**
+1. **Generate the Production Master Key**
 
    ```bash
    age-keygen -o prod-master.age
    ```
-   > [!CAUTION]
-   > It is recommended to move `prod-master.age` to a secure offline USB drive and/or print it on paper.
 
-2. **Generate the Staging Master Key:**
+   It is recommended to generate this key on a secure offline workstation. The private key should be stored in a secure offline location, such as a USB drive or printed on paper. Avoid storing this private key on any server.
+
+2. **Generate the Staging Master Key**
+
    ```bash
    age-keygen -o staging-master.age
    ```
 
-3. **Update Configuration:**
-   Open both `.age` files and copy their **Public Keys** (the strings starting with `age1...`). Open `.sops.yaml` in the root of this repository and replace the placeholders with your newly generated public keys. Commit and push this change.
+3. **Update Configuration**
 
-## Proxmox Hypervisor Authentication & State
+   Replace both placeholders in `.sops.yaml` with the newly generated **public keys**. Commit and push this change.
 
-The CI/CD pipeline needs restricted API access to Proxmox to provision Virtual Machines. 
+## Proxmox Host Initialization & Authentication
 
-### Fresh Install vs. Existing Install
-> [!WARNING]
-> This repository assumes a standard, fresh installation of Proxmox VE. 
-> 
-> **If you are NOT starting from a fresh install, be aware of these potential breaking changes:**
-> * **VM ID Conflicts:** Terraform automatically assigns VM IDs. If you have existing VMs, Terraform might fail to provision or (if misconfigured) attempt to overwrite them. Check your Terraform variables to ensure the ID range (e.g., 8000+) does not conflict.
-> * **Storage Pools:** The automation assumes the default Proxmox storage pools (`local` for snippets/ISOs, and `local-lvm` or `local-zfs` for VM disks). If you renamed your pools, you must update the Terraform configuration.
-> * **Network Bridges:** It assumes `vmbr0` is available for VM networking.
+The CI/CD pipeline needs restricted API access to Proxmox to provision Virtual Machines. We use OpenTofu to provision the bare-metal host.
 
-**Prerequisites:** Install `terraform` ([Terraform installation](https://developer.hashicorp.com/terraform/downloads)).
+### Find your Raw Disk ID
+
+The current OpenTofu configuration assumes that your system has a 2TB disk attached to the Proxmox host. This disk will be formatted and used for VM storage.
+
+1. Determine the persistent hardware ID of your 2TB disk, using the following command:
 
-1. Ensure you have network access to your Proxmox host (e.g., via Tailscale).
-2. Execute the bootstrap script from the root of the repository:
    ```bash
-   ./scripts/control-center-bootstrap.sh
+   ls -l /dev/disk/by-id/
    ```
-3. Terraform will prompt you. You will need to provide your Proxmox `root@pam` credentials via environment variables or prompt.
-4. Upon successful completion, the script will output a secure **API Token**. Copy this token securely.
+
+   It is recommended to use the persistent hardware ID (e.g., `wwn-0x...`, `nvme-eui...`, or `ata-...`) instead of `/dev/sdb` because the latter can change between reboots.
+
+2. **Action Required:** Provide this ID to the system or update the `opentofu/nodes/pve-new/main.tf` configuration with this ID.
+
+### Apply the OpenTofu Host State
+
+**Prerequisites:** Install `opentofu` ([OpenTofu installation](https://opentofu.org/docs/intro/install/)).
+
+1. Initialize and apply the state. You will be prompted to enter your `root@pam` Proxmox credentials.
+
+   ```bash
+   # Navigate to the OpenTofu host directory
+   cd opentofu/host
+   # Initialize and apply the OpenTofu configuration
+   tofu init
+   tofu apply
+   ```
+
+2. Upon successful completion, OpenTofu will output a secure **API Token**. Copy this token securely.
 
 ## Forgejo Secrets Configuration
 
@@ -63,6 +76,7 @@ Instead of relying on Forgejo CI/CD to store the staging private key, we use a s
 
 1. SSH into your Proxmox server (`pve`).
 2. Create the Cloud-Init snippet file:
+
    ```bash
    cat << 'EOF' > /var/lib/vz/snippets/staging-key.yaml
    #cloud-config
@@ -75,7 +89,8 @@ Instead of relying on Forgejo CI/CD to store the staging private key, we use a s
      - echo "Staging age key injected successfully."
    EOF
    ```
-3. This completely removes the secret from Forgejo. When Terraform spins up a staging VM, it simply tells Proxmox to attach this local snippet!
+
+3. This completely removes the secret from Forgejo. When OpenTofu spins up a staging VM, it simply tells Proxmox to attach this local snippet!
 
 ## TrueNAS API Security (RBAC)
 
@@ -83,13 +98,16 @@ To prevent the CI/CD pipeline from having `root` access to your TrueNAS server,
 
 1. Ensure you have network access to your TrueNAS host.
 2. Execute the RBAC setup script:
+
    ```bash
    ./scripts/truenas-rbac-setup.sh
    ```
+
 3. Provide your TrueNAS IP and the `root` Admin API Token when prompted.
 4. The script will automatically create the custom `ci-runner-role` and the `forgejo-ci` user.
 5. Follow the terminal output instructions to log into the TrueNAS Web UI as the new user and generate the restricted API token.
 6. Use this restricted token for the `TRUENAS_API_KEY` secret in Forgejo.
 
 ## Next Steps
+
 Once these bootstrap steps are complete, the foundational authentication is in place. The Forgejo CI actions will now have the necessary permissions to build images, provision VMs, and test staging environments autonomously and securely.