update: switch Terraform to NixOS template workflow

- Point clone_template to nixos-template and trim cloud-init to Nix-safe hostname/DNS only
- Remove SSH/Tailscale cloud-init variables and workflow secret dependencies
- Add reusable NixOS template-base config with bootloader, Tailscale, fish, and utility packages

terraform/cloud-init.tf

@@ -2,10 +2,8 @@ data "template_file" "cloud_init_global" {
   template = file("${path.module}/files/cloud_init_global.tpl")
 
   vars = {
-    hostname       = "generic"
-    domain         = "home.arpa"
-    TS_AUTHKEY     = var.TS_AUTHKEY
-    SSH_KEY_PUBLIC = var.SSH_KEY_PUBLIC
+    hostname = "generic"
+    domain   = "home.arpa"
   }
 }
 

terraform/files/cloud_init_global.tpl

@@ -6,42 +6,5 @@ resolv_conf:
     - 8.8.8.8
     - 1.1.1.1
 
-package_update: true
-package_upgrade: true
-
-# APT fails to acquire GPG keys if package dirmngr is missing
-bootcmd:
-  - [ cloud-init-per, once, dirmngr-aptupdate, apt-get, update ]
-  - [ cloud-init-per, once, dirmngr-aptinstall, apt-get, install, dirmngr, -y ]
-  - [ cloud-init-per, once, dirmngr-aptinstall, apt-get, install, gnupg2, -y ]
-
-packages:
-  - jq
-  - curl
-  - qemu-guest-agent
-
-users:
-- name: stuart
-  groups: sudo
-  shell: /bin/bash
-  sudo: ['ALL=(ALL) NOPASSWD:ALL']
-  ssh_authorized_keys:
-    - ${SSH_KEY_PUBLIC}
-
 preserve_hostname: false
 fqdn: ${hostname}.${domain}
-
-#cloud-config
-# The above header must generally appear on the first line of a cloud config
-# file, but all other lines that begin with a # are optional comments.
-
-runcmd:
-  # One-command install, from https://tailscale.com/download/
-  - ['sh', '-c', 'curl -fsSL https://tailscale.com/install.sh | sh']
-  # Set sysctl settings for IP forwarding (useful when configuring an exit node)
-  - ['sh', '-c', "echo 'net.ipv4.ip_forward = 1' | sudo tee -a /etc/sysctl.d/99-tailscale.conf && echo 'net.ipv6.conf.all.forwarding = 1' | sudo tee -a /etc/sysctl.d/99-tailscale.conf && sudo sysctl -p /etc/sysctl.d/99-tailscale.conf" ]
-  # Generate an auth key from your Admin console
-  # https://login.tailscale.com/admin/settings/keys
-  # and replace the placeholder below
-  - ['tailscale', 'up', '--auth-key=${TS_AUTHKEY}']
-

terraform/terraform.tfvars

@@ -1,5 +1,5 @@
 target_node     = "flex"
-clone_template  = "ubuntu-cloudinit"
+clone_template  = "nixos-template"
 cores           = 1
 memory          = 1024
 disk_size       = "15G"

terraform/variables.tf

@@ -66,13 +66,3 @@ variable "llama_vm_count" {
   default     = 1
   description = "How many Llama VMs to create"
 }
-
-variable "TS_AUTHKEY" {
-  type        = string
-  description = "Tailscale auth key used in cloud-init"
-}
-
-variable "SSH_KEY_PUBLIC" {
-  type        = string
-  description = "My Public SSH key for ssh auth list"
-}