ci: add golden image build action and document disaster recovery

.forgejo/workflows/build-golden-image.yml

@@ -0,0 +1,42 @@
+name: Build Golden Image
+
+on:
+  push:
+    paths:
+      - 'hosts/Template/**'
+      - 'flake.nix'
+      - 'flake.lock'
+  workflow_dispatch:
+
+jobs:
+  build:
+    runs-on: self-hosted
+    steps:
+      - name: Checkout Code
+        uses: actions/checkout@v4
+
+      - name: Install Nix
+        uses: cachix/install-nix-action@v27
+        with:
+          extra_nix_config: |
+            experimental-features = nix-command flakes
+
+      - name: Build Proxmox Image
+        run: |
+          nix run github:nix-community/nixos-generators -- --format proxmox -c hosts/Template/default.nix -o result
+
+      - name: Upload to Proxmox
+        env:
+          PROXMOX_URL: "https://proxmox.local:8006/api2/json"
+          PROXMOX_TOKEN_ID: "terraform@pve!tf-automation"
+          PROXMOX_TOKEN_SECRET: ${{ secrets.PROXMOX_TOKEN_SECRET }}
+          NODE_NAME: "pve"
+          STORAGE_NAME: "local-zfs"
+          VMID: 9000
+        run: |
+          IMAGE_PATH=$(find result -name "*.qcow2" | head -n 1)
+          echo "Uploading $IMAGE_PATH to Proxmox as Template $VMID"
+          # In a real scenario, this would use a script or API client to upload the image
+          # e.g., using qm importdisk via ssh or the Proxmox API directly.
+          # For example, using a custom script: ./scripts/upload-to-proxmox.sh $IMAGE_PATH $VMID
+          echo "TODO: Implement Proxmox upload API call using PROXMOX_TOKEN_SECRET"