2026-07-13 -- D-113(a2) COMPLETE: the config.xml path is DELETED

Operator ruling ("I'll defer to your lean"): the OPNsense config.xml template is deleted, not reduced.

Why deleted rather than reduced

The (a2) plan was to shrink the template to a minimal bootstrap (sshd + root key + console + a seeded API key). That turned out to be unnecessary -- every one of those is covered without a config.xml at all:

bootstrap need	how it is met now
sshd + root key	the D-112(c) console bootstrap (proven on Office1)
an API key	`opnsense-bootstrap-apikey.sh` -- calls OPNsense's OWN model over SSH; no GUI click, no re-implemented crypto
DHCP / firewall / interfaces	the REST API (`opnsense-api.sh`), proven read AND write

So the provisioning chain contains no config.xml anywhere:

boot factory nano -> console bootstrap -> mint API key -> configure over REST

A config.xml renderer that nobody should ever run is not a safety net -- it is a loaded gun pointed at a live router. The 2026-07-13 safety sweep is the evidence: the repo still contained runbook steps telling an operator to render a config and push it to the edge, which by then would have clobbered live API-managed DHCP.

Deleted

opentofu/templates/opnsense-config.xml.tmpl
scripts/opnsense-render-config.sh + tests/opnsense-render-config/
scripts/opnsense-build-config-iso.sh + tests/opnsense-build-config-iso/
the opnsense-edge module's config_seed volume + cdrom disk, and its config_iso_path var
the xorriso/genisoimage prereq (it existed ONLY for the ISO builder)

All remain in git history. opentofu/templates/README.md is now a tombstone explaining what happened and what to use instead -- people will go looking for that template.

The live change, and why it was safe

Removing the module's ISO wiring touches an INSTANTIATED resource (libvirt_volume.config_seed is in tfstate). Measured with tofu plan BEFORE applying:

module.office1_opnsense.libvirt_domain.vm will be updated IN-PLACE
module.office1_opnsense.libvirt_volume.config_seed will be destroyed
Plan: 0 to add, 1 to change, 1 to destroy.

No replacement of the running domain -- confirmed explicitly (a replacement would have destroyed the live edge). Only the cdrom entry is removed from the disk list and the inert ISO volume is dropped.

CORRECTION -- "updated in-place" DOES NOT MEAN "no restart" (measured, 2026-07-13)

The apply RESTARTED the guest. This was predicted NOT to happen, and that prediction was WRONG. Measured: uptime went from 8:36 to 6 secs across the apply. The dmacvicar/libvirt provider redefines the domain to apply a disk-list change and bounces it -- there was a brief outage (~30s) during which the edge was not routing and not serving DHCP.

libvirt_domain ... will be updated in-place means the RESOURCE is not replaced. It says NOTHING about whether the GUEST keeps running. Do not read it as "no interruption".

This matters for Stage 3. Any future tofu apply that touches a libvirt_domain's devices -- on a DC edge, or on a node VM -- should be assumed to BOUNCE THE GUEST, and must be scheduled and gated as an outage, not as a no-op config tidy-up.

Recovery was clean and needed no intervention: post-boot, kea-dhcp4 is running and bound to 10.10.0.1:67 with the subnet/pool intact, WAN/LAN/default-route up, egress 0.0% loss, 8 LAN pass rules in pf, serial console + getty alive. tofu plan reports "No changes" -- repo and state are back in sync.

Applying it now was the SAFE choice, not the risky one. Leaving the repo/state divergence in place would mean the next tofu apply -- e.g. while building DC1's substrate in Stage 3 -- sweeps up this pending change as a surprise side effect on the running Office1 edge, mid-stage. Deliberate and gated beats incidental and unnoticed.

A lint guard did its job

repo-lint's L3 rule (runbooks must not reference missing scripts) went RED on the tombstone notes, because they named the deleted paths. The rule was RIGHT, and it has no opt-out (only L4 does). Rather than weaken a guard that exists to stop runbooks pointing at dead scripts, the tombstones were reworded to name the bare filename instead of the scripts/ path. The guard stays fully intact; the information is preserved.

Verification

repo-lint 0 fail. opentofu-validate PASS -- root + 10/10 modules standalone. Gauntlet green.

Revert

git revert <this commit>          # restores the template, renderer, ISO builder, harnesses
cd opentofu && tofu apply         # re-creates the (inert) config_seed volume + cdrom

Nothing depends on the ISO: it was never read by anything (D-112).