Run oswald-runner, ai and oswl-connector as Flatcar VMs

Replaces the Debian VM that hosted the Gitea Actions runner and adds two
new hosts on goose, all provisioned by Ignition instead of cloud-init:

- oswald-runner: Gitea Actions runner, keeping its registration in
  /var/lib/oswald_runner on disk rather than running ephemeral, which was
  leaving stale offline runners behind whenever a job was interrupted.
- ai: LiteLLM proxy and the Gitea MCP server.
- oswl-connector: tailscaled against headscale, advertising 192.168.7.0/24
  and itself as an exit node.

Their registration tokens and keys come from Infisical through the new
butane_vars plumbing, so nothing secret is committed -- but each one does
land in plaintext in the rendered Ignition snippet on the node, which is
the tradeoff for having no cloud-init here.

The provider gains an ssh block on both nodes because Proxmox has no API
for uploading snippets. That, the snippets content type, and the headscale
preauth key all have to be set up by hand first; flatcar-todo.md has the
steps and the reasoning behind the awkward parts.

Co-Authored-By: Claude Opus 5 <[email protected]>

main.tf

@@ -11,7 +11,8 @@ locals {
   all_declared_hosts = flatten([
     for hv_name, hv in var.nodes : concat(
       [for name, lxc in try(hv.lxc, {}) : { name = name, ip = split("/", lxc.ip)[0] }],
-      [for name, vm in try(hv.machines, {}) : { name = name, ip = split("/", vm.ip)[0] }]
+      [for name, vm in try(hv.machines, {}) : { name = name, ip = split("/", vm.ip)[0] }],
+      [for name, fc in try(hv.flatcar, {}) : { name = name, ip = fc.ip }]
     )
   ])
 
@@ -38,16 +39,20 @@ locals {
 module "proxmox" {
   source = "./opentofu/modules/proxmox_node"
 
-  node_name       = var.hypervisors["proxmox"].node_name
-  storage         = var.hypervisors["proxmox"].storage
-  lxc             = try(var.nodes["proxmox"].lxc, {})
-  machines        = try(var.nodes["proxmox"].machines, {})
-  search_domain   = local.node_common.search_domain
-  dns_nameservers = local.node_common.dns_nameservers
-  ssh_key         = local.node_common.ssh_key
+  node_name            = var.hypervisors["proxmox"].node_name
+  storage              = var.hypervisors["proxmox"].storage
+  lxc                  = try(var.nodes["proxmox"].lxc, {})
+  machines             = try(var.nodes["proxmox"].machines, {})
+  flatcar              = try(var.nodes["proxmox"].flatcar, {})
+  search_domain        = local.node_common.search_domain
+  dns_nameservers      = local.node_common.dns_nameservers
+  ssh_key              = local.node_common.ssh_key
   ansible_user         = local.node_common.ansible_user
   lxc_password         = local.node_common.lxc_password
   ssh_private_key_path = local.node_common.ssh_private_key_path
+  flatcar_image        = var.flatcar_image
+  snippets_datastore   = var.snippets_datastore
+  butane_vars          = data.external.infisical.result
 
   providers = {
     proxmox = proxmox.proxmox
@@ -59,16 +64,20 @@ module "proxmox" {
 module "goose" {
   source = "./opentofu/modules/proxmox_node"
 
-  node_name       = var.hypervisors["goose"].node_name
-  storage         = var.hypervisors["goose"].storage
-  lxc             = try(var.nodes["goose"].lxc, {})
-  machines        = try(var.nodes["goose"].machines, {})
-  search_domain   = local.node_common.search_domain
-  dns_nameservers = local.node_common.dns_nameservers
-  ssh_key         = local.node_common.ssh_key
+  node_name            = var.hypervisors["goose"].node_name
+  storage              = var.hypervisors["goose"].storage
+  lxc                  = try(var.nodes["goose"].lxc, {})
+  machines             = try(var.nodes["goose"].machines, {})
+  flatcar              = try(var.nodes["goose"].flatcar, {})
+  search_domain        = local.node_common.search_domain
+  dns_nameservers      = local.node_common.dns_nameservers
+  ssh_key              = local.node_common.ssh_key
   ansible_user         = local.node_common.ansible_user
   lxc_password         = local.node_common.lxc_password
   ssh_private_key_path = local.node_common.ssh_private_key_path
+  flatcar_image        = var.flatcar_image
+  snippets_datastore   = var.snippets_datastore
+  butane_vars          = data.external.infisical.result
 
   providers = {
     proxmox = proxmox.goose
@@ -77,13 +86,13 @@ module "goose" {
 
 locals {
   hv_hosts = {
-    proxmox = { lxc = module.proxmox.lxc_hosts, vm = module.proxmox.vm_hosts }
-    goose    = { lxc = module.goose.lxc_hosts, vm = module.goose.vm_hosts }
+    proxmox = { lxc = module.proxmox.lxc_hosts, vm = module.proxmox.vm_hosts, flatcar = module.proxmox.flatcar_hosts }
+    goose   = { lxc = module.goose.lxc_hosts, vm = module.goose.vm_hosts, flatcar = module.goose.flatcar_hosts }
   }
 
   all_hosts = flatten([
     for hv_name, hv in local.hv_hosts : [
-      for h in concat(hv.lxc, hv.vm) : [
+      for h in concat(hv.lxc, hv.vm, hv.flatcar) : [
         for tag in h.filtered_tags : {
           tag  = tag
           name = h.name
@@ -138,7 +147,7 @@ module "caddy" {
 
 resource "local_file" "ansible_inventory" {
   filename = "${path.module}/${var.ansible_inventory_path}"
-  content  = templatefile("${path.module}/opentofu/inventory.tpl", {
+  content = templatefile("${path.module}/opentofu/inventory.tpl", {
     hypervisors                  = local.hv_hosts
     tag_groups                   = local.tag_groups
     ansible_user                 = var.ansible_user