refactor: extract generic workload-layer from node configs

opentofu/workload-layer/production/main.tf

@@ -0,0 +1,80 @@
+terraform {
+  required_providers {
+    proxmox = {
+      source  = "bpg/proxmox"
+      version = "~> 0.61.0"
+    }
+  }
+}
+
+provider "proxmox" {
+  # Endpoint and credentials will be picked up from environment variables 
+  # or passed via the bootstrap script.
+  # PROXMOX_VE_ENDPOINT
+  # PROXMOX_VE_USERNAME 
+  # PROXMOX_VE_PASSWORD
+  # PROXMOX_VE_INSECURE=true
+}
+
+module "proxmox_node" {
+  source = "../../modules/proxmox-node"
+  node_name = "mikoshi"
+  zfs_pool_name = "data"
+}
+
+output "control_center_api_token" {
+  value       = module.proxmox_node.control_center_api_token
+  sensitive   = true
+  description = "The secret API token for control-center@pve."
+}
+
+resource "proxmox_virtual_environment_vm" "control_center" {
+  depends_on = [module.proxmox_node]
+  
+  name        = "izanagi"
+  description = "Managed by OpenTofu - GitOps Control Center"
+  tags        = ["infrastructure", "gitops"]
+  node_name   = "mikoshi"
+  vm_id       = 100001000
+
+  on_boot = true
+  
+  pool_id = "core"
+
+  cpu {
+    cores = 2
+    type  = "x86-64-v2-AES"
+  }
+
+  memory {
+    dedicated = 2048
+  }
+
+  agent {
+    enabled = true
+  }
+
+  network_device {
+    bridge = "vmbr0"
+  }
+
+  clone {
+    vm_id = 9000
+    full  = true
+  }
+
+  # Cloud-Init for initial SSH access and SOPS age key injection
+  initialization {
+    ip_config {
+      ipv4 {
+        address = "dhcp"
+      }
+    }
+    user_account {
+      username = "gh0st"
+      keys     = [
+        "sk-ssh-ed25519@openssh.com AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAIHOoTp+e6qWGn4Sco5CZ6G0zrX5NAQBpLlDVirncJ/HqAAAABHNzaDo="
+      ]
+    }
+  }
+}