feat(tofu): VM module for gitlab-1 + decommission ldap-1

tofu/vms/main.tf

@@ -0,0 +1,56 @@
+# KVM VMs on n150-1 (192.168.1.42)
+#
+# These resources were imported from running VMs — do not destroy without
+# first migrating the workload.
+#
+# Import (first-time setup):
+#   tofu import libvirt_domain.gitlab_1 gitlab-1
+#
+# Disk and network are NOT managed here (they pre-exist on the host).
+# Only the domain definition is imported so CPU/RAM/autostart changes
+# go through git.
+
+# ── gitlab-1 ──────────────────────────────────────────────────────────────────
+# GitLab CE — Ubuntu 22.04 VM on n150-1
+# IP: 192.168.1.50 (static via DHCP reservation)
+# Disk: /var/lib/libvirt/images/gitlab-1.qcow2 (80 GiB virtual, ~23 GiB used)
+
+resource "libvirt_domain" "gitlab_1" {
+  name   = "gitlab-1"
+  uuid   = "6ea193a5-61f9-4b65-8ee1-a90b343aec5f"
+  memory = 8192   # MiB
+  vcpu   = 4
+
+  autostart = true
+
+  disk {
+    file = "/var/lib/libvirt/images/gitlab-1.qcow2"
+  }
+
+  # cloud-init seed ISO — present on disk, not managed by tofu
+  disk {
+    file   = "/var/lib/libvirt/images/gitlab-1-seed.iso"
+    scsi   = false
+  }
+
+  network_interface {
+    bridge     = "br0"
+    mac        = "52:54:00:6b:ab:01"
+    wait_for_lease = false
+  }
+
+  console {
+    type        = "pty"
+    target_port = "0"
+    target_type = "serial"
+  }
+
+  graphics {
+    type   = "vnc"
+    listen_type = "address"
+  }
+
+  cpu {
+    mode = "host-passthrough"
+  }
+}

tofu/vms/outputs.tf

@@ -0,0 +1,9 @@
+output "vms" {
+  description = "KVM VM names and UUIDs"
+  value = {
+    gitlab_1 = {
+      name = libvirt_domain.gitlab_1.name
+      uuid = libvirt_domain.gitlab_1.uuid
+    }
+  }
+}

tofu/vms/terraform.tf

@@ -0,0 +1,32 @@
+terraform {
+  required_version = ">= 1.6"
+
+  required_providers {
+    libvirt = {
+      source  = "dmacvicar/libvirt"
+      # renovate: datasource=github-releases depName=dmacvicar/terraform-provider-libvirt
+      version = "~> 0.8"
+    }
+  }
+
+  # Minio S3 backend — same bucket as dns module, separate key.
+  # Init: tofu init -backend-config=../../backend.hcl
+  backend "s3" {
+    bucket = "tofu-state"
+    key    = "vms/terraform.tfstate"
+    region = "us-east-1"
+
+    endpoints = {
+      s3 = "http://minio-api.minio.svc:9000"
+    }
+
+    skip_credentials_validation = true
+    skip_metadata_api_check     = true
+    skip_region_validation      = true
+    use_path_style              = true
+  }
+}
+
+provider "libvirt" {
+  uri = var.libvirt_uri
+}

tofu/vms/variables.tf

@@ -0,0 +1,5 @@
+variable "libvirt_uri" {
+  description = "libvirt connection URI for the KVM host"
+  type        = string
+  default     = "qemu+ssh://swares@192.168.1.42/system"
+}