feat(fastpass): Talos cluster provisioning and bootstrap

- Terraform: VM provisioning, Unifi DHCP, Technitium DNS
- talhelper: cluster config for 6-node Talos cluster
- Cilium 1.19.4 CNI with Talos-compatible security context
- docs: city-hall setup guide and bootstrap runbook

terraform/talos/modules/node/main.tf

@@ -0,0 +1,94 @@
+# ─── Talos Node Resource ─────────────────────────────────────────────────────
+# Creates a Proxmox VM booting from the Talos ISO.
+# No cloud-init, no template clone — Talos is configured via the Talos API
+# after boot using talhelper-generated machine configs from city-hall.
+#
+# Boot sequence:
+#   1. Terraform creates VM (stopped) + DHCP reservation
+#   2. Unifi assigns reserved IP when VM starts
+#   3. talhelper applies machine config via Talos API (port 50000)
+#   4. Cluster bootstraps; ISO is no longer needed after first boot
+#      (Talos installs itself to disk on first config apply)
+
+resource "proxmox_virtual_environment_vm" "node" {
+  name      = var.hostname
+  vm_id     = var.vm_id
+  node_name = var.target_node
+
+  description = "Talos ${var.node_role} node — fastpass cluster. Managed by mk-labs Terraform."
+  tags        = ["managed", "talos", "fastpass", var.node_role]
+  bios        = "ovmf"
+
+  # ─── EFI Disk ─────────────────────────────────────────────────────────────
+  # Required for OVMF/UEFI boot. Stores EFI variables.
+  efi_disk {
+    datastore_id = var.datastore
+    file_format  = "raw"
+    type         = "4m"
+  }
+
+  # ─── Boot: Talos ISO ──────────────────────────────────────────────────────
+  # Talos boots from ISO, applies machine config via API, then installs
+  # itself to the disk. After first boot the ISO is not needed.
+  cdrom {
+    file_id   = var.iso_file_id
+    interface = "ide2"
+  }
+
+  boot_order = ["scsi0", "ide2"]
+
+  # ─── Disk ─────────────────────────────────────────────────────────────────
+  # Single disk — Talos manages its own partition layout.
+  # No separate data disk; persistent app storage comes from Pure Storage CSI.
+  disk {
+    datastore_id = var.datastore
+    size         = var.disk_size
+    interface    = "scsi0"
+    file_format  = "raw"
+    ssd          = true
+    discard      = "on"
+  }
+
+  # ─── CPU ──────────────────────────────────────────────────────────────────
+  cpu {
+    cores = var.cpu_cores
+    type  = "x86-64-v2-AES"
+  }
+
+  # ─── Memory ───────────────────────────────────────────────────────────────
+  memory {
+    dedicated = var.memory_mb
+  }
+
+  # ─── Network ──────────────────────────────────────────────────────────────
+  # Single NIC on VLAN 71 (Server Trusted).
+  # MAC is deterministic via Terraform so Unifi DHCP reservation matches.
+  network_device {
+    bridge = var.bridge
+    model  = "virtio"
+  }
+
+  # ─── QEMU Guest Agent ─────────────────────────────────────────────────────
+  # Requires the qemu-guest-agent Talos system extension (set in talhelper).
+  agent {
+    enabled = true
+  }
+
+  # ─── Start Behavior ───────────────────────────────────────────────────────
+  # VM starts immediately — Talos needs to boot to accept machine configs.
+  # Unifi DHCP reservation is created before this resource so the IP is
+  # already reserved when the NIC first broadcasts a DHCP request.
+  started = true
+
+  # ─── Lifecycle ────────────────────────────────────────────────────────────
+  lifecycle {
+    ignore_changes = [
+      description,
+      tags,
+      # cdrom can be ejected manually after first boot without Terraform drift
+      cdrom,
+      # node_name changes after HA migrates VMs to their intended hosts
+      node_name,
+    ]
+  }
+}