build: replace bootstrap script with docker wrapper

scripts/apply-host-layer.sh

@@ -0,0 +1,19 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+# This script runs the host-layer OpenTofu configuration using a Docker container,
+# keeping your laptop and the Proxmox node clean of dependencies.
+
+echo "Running OpenTofu for host-layer..."
+
+docker run --rm -it \
+  -v "$(pwd)":/workspace \
+  -w /workspace/opentofu/host-layer \
+  -v "$HOME/.ssh:/root/.ssh:ro" \
+  ghcr.io/opentofu/opentofu:latest init -upgrade
+
+docker run --rm -it \
+  -v "$(pwd)":/workspace \
+  -w /workspace/opentofu/host-layer \
+  -v "$HOME/.ssh:/root/.ssh:ro" \
+  ghcr.io/opentofu/opentofu:latest apply

scripts/bootstrap.sh

@@ -1,76 +0,0 @@
-#!/usr/bin/env bash
-set -euo pipefail
-
-BANNER="==========================================================="
-printf "%s\n Proxmox Bootstrap\n%s\n\n" "$BANNER" "$BANNER"
-
-echo "Applying post-pve-install fixes (fixing repos)..."
-# Remove enterprise repos and add non-subscription repos safely
-rm -f /etc/apt/sources.list.d/pve-enterprise.list
-
-echo "deb http://download.proxmox.com/debian/pve bookworm pve-no-subscription" > /etc/apt/sources.list.d/pve-no-subscription.list
-
-# Disable the "No Valid Subscription" nag screen
-sed -i.bak "s/data.status !== 'Active'/false/g" /usr/share/javascript/proxmox-widget-toolkit/proxmoxlib.js
-
-echo ""
-echo "Applying NIC offloading fixes..."
-# The community script disables TSO, GSO, and GRO on physical interfaces.
-# We create a systemd service to ensure this applies on boot.
-cat <<'EOF' > /etc/systemd/system/nic-offload-fix.service
-[Unit]
-Description=Disable NIC offloading (TSO/GRO/GSO) for physical interfaces
-After=network-online.target
-
-[Service]
-Type=oneshot
-# Iterate over all physical interfaces (excluding lo, bridges, veth, etc.)
-ExecStart=/bin/bash -c 'for dev in /sys/class/net/*; do if [ "$(basename "$dev")" != "lo" ] && [[ ! "$(basename "$dev")" =~ ^(vmbr|veth|fwbr|tap|bonding) ]]; then /usr/sbin/ethtool -K "$(basename "$dev")" tso off gso off gro off || true; fi; done'
-RemainAfterExit=yes
-
-[Install]
-WantedBy=multi-user.target
-EOF
-systemctl enable --now nic-offload-fix.service || true
-
-echo ""
-echo "Updating system and installing OpenTofu..."
-apt-get update
-# Install curl, git, gnupg, ethtool, and required apt dependencies
-apt-get install -y apt-transport-https ca-certificates curl git gnupg ethtool
-
-# Install OpenTofu repository and binary
-install -m 0755 -d /etc/apt/keyrings
-curl -fsSL https://get.opentofu.org/opentofu.gpg | tee /etc/apt/keyrings/opentofu.gpg >/dev/null
-curl -fsSL https://packages.opentofu.org/opentofu/tofu/gpgkey | gpg --no-tty --batch --dearmor -o /etc/apt/keyrings/opentofu-repo.gpg >/dev/null
-chmod a+r /etc/apt/keyrings/opentofu.gpg /etc/apt/keyrings/opentofu-repo.gpg
-
-printf "deb [signed-by=/etc/apt/keyrings/opentofu.gpg,/etc/apt/keyrings/opentofu-repo.gpg] https://packages.opentofu.org/opentofu/tofu/any/ any main\ndeb-src [signed-by=/etc/apt/keyrings/opentofu.gpg,/etc/apt/keyrings/opentofu-repo.gpg] https://packages.opentofu.org/opentofu/tofu/any/ any main\n" > /etc/apt/sources.list.d/opentofu.list
-chmod a+r /etc/apt/sources.list.d/opentofu.list
-
-apt-get update
-apt-get install -y tofu
-
-echo ""
-echo "Cloning the infrastructure repository..."
-cd /root
-if [ -d "nix-config" ]; then
-    echo "Repository already exists. Pulling latest..."
-    cd nix-config
-    git pull
-else
-    git clone -b v2 https://git.depeuter.dev/Bos55/nix-config.git
-    cd nix-config
-fi
-
-echo ""
-echo "Bootstrapping Proxmox Host State..."
-cd opentofu/nodes/mikoshi
-
-echo "Initializing OpenTofu..."
-tofu init -upgrade
-
-echo "Applying bare-metal state..."
-tofu apply -auto-approve
-
-printf "\n%s\n Bootstrap Complete!\n The ZFS pool, Resource Pools, and the Control Center\n VM have been provisioned.\n\n The Control Center is booting now. Once online, it will automatically\n pull this repository and provision the rest of your VMs!\n%s\n" "$BANNER" "$BANNER"