feat(fastpass): Talos cluster provisioning and bootstrap

- Terraform: VM provisioning, Unifi DHCP, Technitium DNS
- talhelper: cluster config for 6-node Talos cluster
- Cilium 1.19.4 CNI with Talos-compatible security context
- docs: city-hall setup guide and bootstrap runbook

talos/talhelper/talconfig.yaml

@@ -0,0 +1,188 @@
+# ─── fastpass Talos Cluster Configuration ────────────────────────────────────
+# Managed by talhelper on city-hall (10.1.71.38)
+# Generate configs:  talhelper genconfig
+# Generate secrets:  talhelper gensecret > talenv.yaml && sops -e -i talenv.yaml
+# Apply configs:     talhelper gencommand apply | bash
+# Bootstrap:         talhelper gencommand bootstrap | bash
+
+clusterName: fastpass
+talosVersion: v1.13.2
+kubernetesVersion: v1.32.3
+
+# ─── Cluster Endpoint ────────────────────────────────────────────────────────
+# Points at the Talos native VIP (10.1.71.65) which floats across
+# control plane nodes. All kubectl and talosctl traffic goes here.
+endpoint: https://10.1.71.65:6443
+
+# ─── Domain ──────────────────────────────────────────────────────────────────
+domain: cluster.local
+
+# ─── CNI ─────────────────────────────────────────────────────────────────────
+# Cilium is installed post-bootstrap via Helm.
+# Talos ships with flannel by default — disable it so Cilium takes over.
+cniConfig:
+  name: none
+
+# ─── Patches applied to ALL nodes ────────────────────────────────────────────
+patches:
+  - |-
+    machine:
+      time:
+        servers:
+          - 10.1.71.21
+      sysctls:
+        net.ipv4.ip_forward: "1"
+      kernel:
+        modules:
+          - name: br_netfilter
+          - name: ip_tables
+      kubelet:
+        extraArgs:
+          rotate-server-certificates: "true"
+
+# ─── Nodes ───────────────────────────────────────────────────────────────────
+
+nodes:
+
+  # ── Control Plane ──────────────────────────────────────────────────────────
+
+  - hostname: space-mountain
+    ipAddress: 10.1.71.66
+    controlPlane: true
+    installDisk: /dev/sda
+    networkInterfaces:
+      - interface: ens18
+        addresses:
+          - 10.1.71.66/24
+        routes:
+          - network: 0.0.0.0/0
+            gateway: 10.1.71.1
+        vip:
+          ip: 10.1.71.65
+    patches:
+      - |-
+        machine:
+          network:
+            nameservers:
+              - 10.1.71.32
+
+  - hostname: big-thunder-mountain
+    ipAddress: 10.1.71.67
+    controlPlane: true
+    installDisk: /dev/sda
+    networkInterfaces:
+      - interface: ens18
+        addresses:
+          - 10.1.71.67/24
+        routes:
+          - network: 0.0.0.0/0
+            gateway: 10.1.71.1
+    patches:
+      - |-
+        machine:
+          network:
+            nameservers:
+              - 10.1.71.32
+
+  - hostname: splash-mountain
+    ipAddress: 10.1.71.68
+    controlPlane: true
+    installDisk: /dev/sda
+    networkInterfaces:
+      - interface: ens18
+        addresses:
+          - 10.1.71.68/24
+        routes:
+          - network: 0.0.0.0/0
+            gateway: 10.1.71.1
+    patches:
+      - |-
+        machine:
+          network:
+            nameservers:
+              - 10.1.71.32
+
+  # ── Workers ────────────────────────────────────────────────────────────────
+
+  - hostname: jungle-cruise
+    ipAddress: 10.1.71.69
+    controlPlane: false
+    installDisk: /dev/sda
+    networkInterfaces:
+      - interface: ens18
+        addresses:
+          - 10.1.71.69/24
+        routes:
+          - network: 0.0.0.0/0
+            gateway: 10.1.71.1
+    patches:
+      - |-
+        machine:
+          network:
+            nameservers:
+              - 10.1.71.32
+
+  - hostname: haunted-mansion
+    ipAddress: 10.1.71.70
+    controlPlane: false
+    installDisk: /dev/sda
+    networkInterfaces:
+      - interface: ens18
+        addresses:
+          - 10.1.71.70/24
+        routes:
+          - network: 0.0.0.0/0
+            gateway: 10.1.71.1
+    patches:
+      - |-
+        machine:
+          network:
+            nameservers:
+              - 10.1.71.32
+
+  - hostname: peter-pans-flight
+    ipAddress: 10.1.71.71
+    controlPlane: false
+    installDisk: /dev/sda
+    networkInterfaces:
+      - interface: ens18
+        addresses:
+          - 10.1.71.71/24
+        routes:
+          - network: 0.0.0.0/0
+            gateway: 10.1.71.1
+    patches:
+      - |-
+        machine:
+          network:
+            nameservers:
+              - 10.1.71.32
+
+# ─── Control Plane Config ────────────────────────────────────────────────────
+controlPlane:
+  patches:
+    - |-
+      machine:
+        features:
+          kubernetesTalosAPIAccess:
+            enabled: true
+            allowedRoles:
+              - os:reader
+            allowedKubernetesNamespaces:
+              - kube-system
+      cluster:
+        etcd:
+          advertisedSubnets:
+            - 10.1.71.64/26
+        coreDNS:
+          disabled: false
+        proxy:
+          disabled: true
+
+# ─── Worker Config ───────────────────────────────────────────────────────────
+worker:
+  patches:
+    - |-
+      machine:
+        kubelet:
+          extraArgs: {}