feat: implement dedicated host-layer opentofu state

opentofu/host-layer/main.tf

@@ -0,0 +1,61 @@
+terraform {
+  # This state is dedicated purely to the physical host configuration.
+  # No providers are required since we use null_resource and ssh.
+}
+
+resource "null_resource" "bare_metal_setup" {
+  triggers = {
+    node         = var.node_ip
+    data_disk_id = var.data_disk_id
+    pool_name    = var.zfs_pool_name
+  }
+
+  connection {
+    type        = "ssh"
+    user        = var.ssh_user
+    host        = var.node_ip
+    private_key = var.ssh_private_key != "" ? var.ssh_private_key : null
+    agent       = var.ssh_private_key == "" ? true : false
+  }
+
+  provisioner "remote-exec" {
+    inline = [
+      "set -euo pipefail",
+
+      "echo '==> Applying post-pve-install fixes (fixing repos)...'",
+      "rm -f /etc/apt/sources.list.d/pve-enterprise.list",
+      "echo 'deb http://download.proxmox.com/debian/pve bookworm pve-no-subscription' > /etc/apt/sources.list.d/pve-no-subscription.list",
+      
+      "echo '==> Disabling the No Valid Subscription nag screen...'",
+      "sed -i.bak \"s/data.status !== 'Active'/false/g\" /usr/share/javascript/proxmox-widget-toolkit/proxmoxlib.js",
+      "systemctl restart pveproxy",
+
+      "echo '==> Setting laptop lid switch to ignore (prevents sleeping when closed)...'",
+      "sed -i 's/^#\\?HandleLidSwitch=.*/HandleLidSwitch=ignore/' /etc/systemd/logind.conf",
+      "systemctl restart systemd-logind",
+      
+      "echo '==> Applying NIC offloading fixes...'",
+      "cat <<'EOF' > /etc/systemd/system/nic-offload-fix.service",
+      "[Unit]",
+      "Description=Disable NIC offloading (TSO/GRO/GSO) for physical interfaces",
+      "After=network-online.target",
+      "",
+      "[Service]",
+      "Type=oneshot",
+      "ExecStart=/bin/bash -c 'for dev in /sys/class/net/*; do if [ \"$(basename \"$dev\")\" != \"lo\" ] && [[ ! \"$(basename \"$dev\")\" =~ ^(vmbr|veth|fwbr|tap|bonding) ]]; then /usr/sbin/ethtool -K \"$(basename \"$dev\")\" tso off gso off gro off || true; fi; done'",
+      "RemainAfterExit=yes",
+      "",
+      "[Install]",
+      "WantedBy=multi-user.target",
+      "EOF",
+      "systemctl daemon-reload",
+      "systemctl enable --now nic-offload-fix.service || true",
+
+      "echo '==> Setting up ZFS pool and Proxmox storage...'",
+      "zpool list ${var.zfs_pool_name} || zpool create -f ${var.zfs_pool_name} /dev/disk/by-id/${var.data_disk_id}",
+      "pvesm status -storage ${var.zfs_pool_name} || pvesm add zfspool ${var.zfs_pool_name} --pool ${var.zfs_pool_name} --content images,rootdir",
+
+      "echo '==> Host layer configuration complete!'"
+    ]
+  }
+}

opentofu/host-layer/variables.tf

@@ -0,0 +1,27 @@
+variable "node_ip" {
+  type        = string
+  description = "The IP address or hostname of the Proxmox node to configure"
+}
+
+variable "ssh_user" {
+  type        = string
+  default     = "root"
+  description = "The SSH user to connect as"
+}
+
+variable "ssh_private_key" {
+  type        = string
+  default     = ""
+  description = "The SSH private key content (if not using ssh-agent)"
+}
+
+variable "data_disk_id" {
+  type        = string
+  description = "The persistent block device ID for the data disk (e.g. wwn-0x500...)"
+}
+
+variable "zfs_pool_name" {
+  type        = string
+  default     = "data"
+  description = "The name of the ZFS pool to create on the data disk"
+}