2026-07-17 -- D-127 IaC autostart matrix (baked into the deploy tooling) + Office1 guest updates

Guest OS updates (agent-run via passwordless sudo INSIDE the guests)

The vcloud HOST + office1-opnsense stay in the operator's bookend restart; the already-deployed guests I have sudo inside were updated now:

office1-netbox (LXD): apt upgrade (9 pkgs, userland, no kernel) -- no reboot; netbox-docker stack unaffected + still healthy (HTTP 302).
office1-tailscale (LXD): apt full-upgrade (kernel 6.8.0-134 -> 6.8.0-136) + reboot; came back on the new kernel, tailscale online (100.64.0.53) re-advertising 10.10.0.0/22. Not the ProxyJump path, so safe.
voffice1: 0 upgradable -- nothing to do (so its load-bearing reboot risk was moot this round).
LXD boot.autostart=true set on both office1-netbox + office1-tailscale (D-127 non-host layer).

D-127 IaC autostart matrix (operator: bake it into the tooling so DC0/DC1 aren't missed at install)

Advisor-gated. Added an autostart bool var (default false) to modules/cloudinit-vm, modules/opnsense-edge, modules/node-vm, wired to libvirt_domain.autostart; set EXPLICITLY per instance (shared modules => IaC is the source of truth, else it fights the live layer):

instance	root	autostart	why
voffice1	outer	true	foundational Office1 host
office1-opnsense	outer	true	foundational edge (post-DOCFIX-188)
vvr1-dc0	outer	false	DC containment VM -- MANUAL, gated bring-up
vr1-dc0-opnsense	inner	true	DC edge comes up with its container
node-vm (x9)	inner	false	MAAS-power-controlled

HARD GATE verified: tofu plan shows the two EXISTING Office1 domains (voffice1, office1-opnsense) as autostart false->true update-in-place -- NOT replacement (replacement would destroy the live host/edge). vvr1-dc0 is a new create with autostart=false baked in. Outer plan is now 5 add / 2 in-place / 6 destroy; the 2 in-place collapse to 0 once the bookend sets those two autostart live before the fresh-session apply.

Drift guard: tests/opentofu-validate/run-tests.sh T11-T15 pin each matrix value (flipping vvr1-dc0/nodes to true -- auto-booting the 416 GiB nested container / MAAS nodes on host boot -- is the exact defect guarded). opentofu-validate clean; harness ALL PASS.

Standup runbook updated: the composed service VMs' boot.autostart is now a recorded install step (not a manual afterthought). DC0/DC1 create NO LXD instances (inner root = node-vm + opnsense-edge + planes/pool/wan-bridge), so the DC side is purely this VM matrix -- no DC-LXD gap.

Records

D-127 implementation updated (IaC layer DONE); readiness-doc plan line updated (5/2/6, collapses to 0); D-127 as-built already notes the netbox restart policy.

Verification

bash tests/opentofu-validate/run-tests.sh -> ALL PASS (incl. T11-T15 matrix pins).
bash scripts/opentofu-validate.sh -> clean (both roots + 12 modules).
tofu -chdir=opentofu plan -> 5 add / 2 in-place / 6 destroy; no forces-replacement on any existing.
bash scripts/repo-lint.sh -> 0 fail (1 legacy WARN).

Revert

git checkout opentofu/modules/{cloudinit-vm,opnsense-edge,node-vm}/{main,variables}.tf opentofu/main.tf opentofu/vr1-dc0-substrate/main.tf tests/opentofu-validate/run-tests.sh runbooks/dc-dc-phase1-office1-standup.md; drop the D-127 IaC-layer text. Live: sudo lxc config unset <inst> boot.autostart on voffice1. The guest apt upgrades are not repo state (OS state).