infra: HA-Ressource und Node-Affinity per pve-host statt tofu, Infra-IP im Inventar

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

platform/proxmox/tofu/main.tf

@@ -157,10 +157,5 @@ resource "proxmox_virtual_environment_container" "infra" {
   }
 }
 
-resource "proxmox_haresource" "infra" {
-  for_each    = { for k, v in local.site.containers : k => v if try(v.ha, false) }
-  resource_id = "ct:${each.value.vmid}"
-  state       = "started"
-  comment     = "knaster ${each.key}"
-  depends_on  = [proxmox_virtual_environment_container.infra]
-}
+# HA (Ressource + Node-Affinity-Regel) und Replikation setzt die Ansible-Rolle pve-host per root-SSH.
+# So braucht der tofu-Token kein Sys.Console auf /.

platform/proxmox/tofu/outputs.tf

@@ -13,14 +13,17 @@ output "gpu_vms" {
 }
 
 output "infra_containers" {
-  value = { for k, v in proxmox_virtual_environment_container.infra : k => { node = v.node_name, vmid = v.vm_id } }
+  value = { for k, v in proxmox_virtual_environment_container.infra : k => { node = v.node_name, vmid = v.vm_id, ipv4 = try(v.ipv4["eth0"], null) } }
 }
 
 # tofu output -raw ansible_inventory > ../ansible/inventory.generated.yml
 output "ansible_inventory" {
   value = yamlencode({
-    all = { children = { gpu_vms = { hosts = {
-      for k, ip in local.gpu_vm_ipv4 : k => { ansible_host = ip } if ip != null
-    } } } }
+    all = { children = {
+      gpu_vms = { hosts = { for k, ip in local.gpu_vm_ipv4 : k => { ansible_host = ip } if ip != null } }
+      infra = { hosts = {
+        for k, v in proxmox_virtual_environment_container.infra : k => { ansible_host = v.ipv4["eth0"] } if try(v.ipv4["eth0"], null) != null
+      } }
+    } }
   })
 }