# ─── Talos Node Resource ─────────────────────────────────────────────────────
# Creates a Proxmox VM booting from the Talos ISO.
# No cloud-init, no template clone — Talos is configured via the Talos API
# after boot using talhelper-generated machine configs from city-hall.
#
# Boot sequence:
#   1. Terraform creates VM (stopped) + DHCP reservation
#   2. Unifi assigns reserved IP when VM starts
#   3. talhelper applies machine config via Talos API (port 50000)
#   4. Cluster bootstraps; ISO is no longer needed after first boot
#      (Talos installs itself to disk on first config apply)

resource "proxmox_virtual_environment_vm" "node" {
  name      = var.hostname
  vm_id     = var.vm_id
  node_name = var.target_node

  description = "Talos ${var.node_role} node — fastpass cluster. Managed by mk-labs Terraform."
  tags        = ["managed", "talos", "fastpass", var.node_role]
  bios        = "ovmf"

  # ─── EFI Disk ─────────────────────────────────────────────────────────────
  # Required for OVMF/UEFI boot. Stores EFI variables.
  efi_disk {
    datastore_id = var.datastore
    file_format  = "raw"
    type         = "4m"
  }

  # ─── Boot: Talos ISO ──────────────────────────────────────────────────────
  # Talos boots from ISO, applies machine config via API, then installs
  # itself to the disk. After first boot the ISO is not needed.
  cdrom {
    file_id   = var.iso_file_id
    interface = "ide2"
  }

  boot_order = ["scsi0", "ide2"]

  # ─── Disk ─────────────────────────────────────────────────────────────────
  # Single disk — Talos manages its own partition layout.
  # No separate data disk; persistent app storage comes from Pure Storage CSI.
  disk {
    datastore_id = var.datastore
    size         = var.disk_size
    interface    = "scsi0"
    file_format  = "raw"
    ssd          = true
    discard      = "on"
  }

  # ─── CPU ──────────────────────────────────────────────────────────────────
  cpu {
    cores = var.cpu_cores
    type  = "x86-64-v2-AES"
  }

  # ─── Memory ───────────────────────────────────────────────────────────────
  memory {
    dedicated = var.memory_mb
  }

  # ─── Network ──────────────────────────────────────────────────────────────
  # Single NIC on VLAN 71 (Server Trusted).
  # MAC is deterministic via Terraform so Unifi DHCP reservation matches.
  network_device {
    bridge = var.bridge
    model  = "virtio"
  }

  # ─── QEMU Guest Agent ─────────────────────────────────────────────────────
  # Requires the qemu-guest-agent Talos system extension (set in talhelper).
  agent {
    enabled = true
  }

  # ─── Start Behavior ───────────────────────────────────────────────────────
  # VM starts immediately — Talos needs to boot to accept machine configs.
  # Unifi DHCP reservation is created before this resource so the IP is
  # already reserved when the NIC first broadcasts a DHCP request.
  started = true

  # ─── Lifecycle ────────────────────────────────────────────────────────────
  lifecycle {
    ignore_changes = [
      description,
      tags,
      # cdrom can be ejected manually after first boot without Terraform drift
      cdrom,
      # node_name changes after HA migrates VMs to their intended hosts
      node_name,
    ]
  }
}