---
all:
  children:
    unraid_servers:
      hosts:
        nas01:
          ansible_host: 192.168.50.1
      vars:
        ansible_user: root

    # The Proxmox host itself, not the guests on it — those come from the
    # API-backed dynamic inventory (proxmox.yml) as `proxmox_guests`. Node-level
    # configuration (backup storage, the vzdump schedule) has to be applied over
    # SSH to the node, which the API inventory gives no way to address.
    #
    # VERIFY: depending on its configuration, the community.proxmox inventory
    # plugin can also emit the node as a host. If it does, this static entry and
    # the dynamic one merge under the same name — check with
    # `ansible-inventory --graph` before assuming which vars won.
    proxmox_nodes:
      hosts:
        turtle-proxmox-01:
          ansible_host: 192.168.50.2
        turtle-proxmox-02:
          ansible_host: 192.168.50.3
      vars:
        ansible_user: root

    # Bare-metal K3s cluster (4 Raspberry Pis) — a third platform alongside
    # Unraid and Proxmox, not an app deployed onto either of them. No
    # Terraform: the hosts already exist. See playbooks/k3s.yml and
    # roles/k3s_node. Split into two groups, not one, so the playbook can
    # bootstrap the control plane before any agent tries to join it.
    #
    # ansible_user is `ansible`, not root: create this user on every Pi with
    # NOPASSWD sudo and install the public half of `homelab/ci/ssh-k3s`
    # (docs/vault-secrets.md) as its authorized key before the first run —
    # see README.md "SSH access". The private half doesn't need setting up on
    # the controller: group_vars/k3s_cluster.yml points
    # ansible_ssh_private_key_file at a path playbooks/k3s_ssh_key.yml fetches
    # from that same Vault entry.
    k3s_cluster:
      vars:
        ansible_user: ansible
        ansible_become: true
      children:
        k3s_control_plane:
          hosts:
            k3s-ctrl-01:
              ansible_host: 192.168.50.60
        k3s_workers:
          hosts:
            k3s-wkr-01:
              ansible_host: 192.168.50.61
            k3s-wkr-02:
              ansible_host: 192.168.50.62
            k3s-wkr-03:
              ansible_host: 192.168.50.63