# 2026-07-13 -- D-113(a2) COMPLETE: the config.xml path is DELETED

Operator ruling ("I'll defer to your lean"): the OPNsense `config.xml` template is **deleted, not
reduced**.

## Why deleted rather than reduced

The (a2) plan was to shrink the template to a minimal bootstrap (sshd + root key + console + a
seeded API key). That turned out to be **unnecessary** -- every one of those is covered without a
`config.xml` at all:

| bootstrap need | how it is met now |
|---|---|
| sshd + root key | the **D-112(c) console bootstrap** (proven on Office1) |
| an API key | **`opnsense-bootstrap-apikey.sh`** -- calls OPNsense's OWN model over SSH; no GUI click, no re-implemented crypto |
| DHCP / firewall / interfaces | **the REST API** (`opnsense-api.sh`), proven read AND write |

So the provisioning chain contains **no `config.xml` anywhere**:

    boot factory nano -> console bootstrap -> mint API key -> configure over REST

A `config.xml` renderer that nobody should ever run is **not a safety net -- it is a loaded gun
pointed at a live router.** The 2026-07-13 safety sweep is the evidence: the repo still contained
runbook steps telling an operator to render a config and push it to the edge, which by then would
have **clobbered live API-managed DHCP**.

## Deleted

- `opentofu/templates/opnsense-config.xml.tmpl`
- `scripts/opnsense-render-config.sh` + `tests/opnsense-render-config/`
- `scripts/opnsense-build-config-iso.sh` + `tests/opnsense-build-config-iso/`
- the `opnsense-edge` module's `config_seed` volume + cdrom disk, and its `config_iso_path` var
- the `xorriso`/`genisoimage` prereq (it existed ONLY for the ISO builder)

All remain in git history. `opentofu/templates/README.md` is now a **tombstone** explaining what
happened and what to use instead -- people will go looking for that template.

## The live change, and why it was safe

Removing the module's ISO wiring touches an INSTANTIATED resource
(`libvirt_volume.config_seed` is in tfstate). Measured with `tofu plan` BEFORE applying:

    module.office1_opnsense.libvirt_domain.vm will be updated IN-PLACE
    module.office1_opnsense.libvirt_volume.config_seed will be destroyed
    Plan: 0 to add, 1 to change, 1 to destroy.

**No replacement** of the running domain -- confirmed explicitly (a replacement would have
destroyed the live edge). Only the cdrom entry is removed from the disk list and the inert ISO
volume is dropped.

**Applying it now was the SAFE choice, not the risky one.** Leaving the repo/state divergence in
place would mean the next `tofu apply` -- e.g. while building DC1's substrate in Stage 3 --
sweeps up this pending change as a **surprise side effect on the running Office1 edge, mid-stage**.
Deliberate and gated beats incidental and unnoticed.

## A lint guard did its job

`repo-lint`'s **L3** rule (runbooks must not reference missing scripts) went RED on the tombstone
notes, because they named the deleted paths. The rule was RIGHT, and it has no opt-out (only L4
does). Rather than weaken a guard that exists to stop runbooks pointing at dead scripts, the
tombstones were reworded to name the bare filename instead of the `scripts/` path. The guard stays
fully intact; the information is preserved.

## Verification

`repo-lint` 0 fail. `opentofu-validate` PASS -- root + **10/10 modules** standalone. Gauntlet green.

## Revert

    git revert <this commit>          # restores the template, renderer, ISO builder, harnesses
    cd opentofu && tofu apply         # re-creates the (inert) config_seed volume + cdrom

Nothing depends on the ISO: it was never read by anything (D-112).