refactor(security): move staging age key from forgejo secrets to proxmox snippet

terraform/staging-env/main.tf

@@ -17,12 +17,6 @@ variable "pr_number" {
   type        = string
 }
 
-variable "staging_age_key" {
-  description = "The private age key for decrypting staging secrets. Injected via Cloud-Init."
-  type        = string
-  sensitive   = true
-}
-
 provider "proxmox" {
   # Relies on PROXMOX_VE_ENDPOINT and PROXMOX_VE_API_TOKEN environment variables
 }
@@ -58,37 +52,18 @@ resource "proxmox_virtual_environment_vm" "staging_vm" {
 
   # Cloud-Init configuration to inject the staging age key and set up networking
 
-  initialization {
+    initialization {
     ip_config {
       ipv4 {
         address = "dhcp"
       }
     }
 
-    user_data_file_id = proxmox_virtual_environment_file.cloud_config.id
+    user_data_file_id = "local:snippets/staging-key.yaml"
   }
 }
 
-resource "proxmox_virtual_environment_file" "cloud_config" {
-  content_type = "snippets"
-  datastore_id = "local-zfs"
-  node_name    = "pve"
 
-  source_raw {
-    data = <<-EOF
-    #cloud-config
-    write_files:
-      - path: /var/lib/sops-nix/key.txt
-        permissions: '0600'
-        content: |
-          ${indent(10, var.staging_age_key)}
-    runcmd:
-      - echo "Staging age key injected successfully."
-    EOF
-
-    file_name = "staging-pr-${var.pr_number}-cloud-init.yaml"
-  }
-}
 
 resource "proxmox_virtual_environment_firewall_options" "staging_vm_fw_options" {
   vm_id      = proxmox_virtual_environment_vm.staging_vm.vm_id