module.vr1_dc0_planes.libvirt_network.plane["metal-admin"]: Refreshing state... [id=29eca094-9b40-4e8c-9750-d1c7857f0a3c]
module.vr1_dc1_storage.libvirt_pool.dc: Refreshing state... [id=4a1df114-ee04-4c80-9233-cc0c140c8556]
module.vr1_dc0_planes.libvirt_network.plane["storage"]: Refreshing state... [id=e5558f0e-9601-48fc-8eff-6a0e6adad0d7]
module.mesh_vr1_dc1_office1.libvirt_network.link: Refreshing state... [id=38a20d2d-cd91-4604-a5f4-8e2a6609633c]
module.mesh_vr1_dc0_vr1_dc1.libvirt_network.link: Refreshing state... [id=9cbc8589-9f40-48e6-872e-ef3abfe29a93]
module.vr1_dc0_planes.libvirt_network.plane["replication"]: Refreshing state... [id=295dca85-52de-4e78-9894-16e48d969654]
module.vr1_dc0_planes.libvirt_network.plane["metal-internal"]: Refreshing state... [id=99768f9d-256a-4a89-90dd-38de04efea03]
module.vr1_dc0_planes.libvirt_network.plane["provider-public"]: Refreshing state... [id=3bb1e17c-53ce-4c1a-a4af-c9d6ad1f1c1b]
module.vr1_dc0_planes.libvirt_network.plane["data-tenant"]: Refreshing state... [id=31782537-790a-4399-a3a9-64dce7232e7b]
module.voffice1.libvirt_cloudinit_disk.seed: Refreshing state... [id=775234004c2669d9]
module.office1_storage.libvirt_pool.dc: Refreshing state... [id=5f94194c-69c1-4b04-a85f-c18d87303a03]
module.vr1_dc0_storage.libvirt_pool.dc: Refreshing state... [id=7ce1101c-a89e-40ca-9263-5f572bee40a9]
module.mesh_vr1_dc0_office1.libvirt_network.link: Refreshing state... [id=8318548f-c3d6-4e06-bef4-fe3f11d68125]
module.office1_network.libvirt_network.office1_local: Refreshing state... [id=8fdd2a97-417c-44d4-89e4-ae8d65594135]
module.ubuntu_noble_base.libvirt_volume.base: Refreshing state... [id=/var/lib/libvirt/vr1/office1/ubuntu-24.04-base.qcow2]
module.voffice1.libvirt_volume.seed: Refreshing state... [id=/var/lib/libvirt/vr1/office1/voffice1-cloudinit.iso]
module.office1_opnsense.libvirt_volume.disk: Refreshing state... [id=/var/lib/libvirt/vr1/office1/office1-opnsense-disk.qcow2]
module.voffice1.libvirt_volume.disk: Refreshing state... [id=/var/lib/libvirt/vr1/office1/voffice1-disk.qcow2]
module.office1_opnsense.libvirt_domain.vm: Refreshing state... [name=office1-opnsense]
module.voffice1.libvirt_domain.vm: Refreshing state... [name=voffice1]

Note: Objects have changed outside of OpenTofu

OpenTofu detected the following changes made outside of OpenTofu since the
last "tofu apply" which may have affected this plan:

  # module.office1_opnsense.libvirt_domain.vm has changed
  ~ resource "libvirt_domain" "vm" {
      ~ id          = 13 -> 2
        name        = "office1-opnsense"
        # (10 unchanged attributes hidden)
    }

  # module.voffice1.libvirt_cloudinit_disk.seed has been deleted
  - resource "libvirt_cloudinit_disk" "seed" {
        id             = "775234004c2669d9"
        name           = "voffice1-cloudinit"
      - path           = "/tmp/terraform-provider-libvirt-cloudinit/cloudinit-775234004c2669d9.iso" -> null
        # (4 unchanged attributes hidden)
    }

  # module.voffice1.libvirt_domain.vm has changed
  ~ resource "libvirt_domain" "vm" {
      ~ id          = 14 -> 1
        name        = "voffice1"
        # (10 unchanged attributes hidden)
    }


Unless you have made equivalent changes to your configuration, or ignored the
relevant attributes using ignore_changes, the following plan may include
actions to undo or respond to these changes.

─────────────────────────────────────────────────────────────────────────────

OpenTofu used the selected providers to generate the following execution
plan. Resource actions are indicated with the following symbols:
  + create
  ~ update in-place (current -> planned)
  - destroy
-/+ destroy and then create replacement

OpenTofu will perform the following actions:

  # module.office1_opnsense.libvirt_domain.vm will be updated in-place
  ~ resource "libvirt_domain" "vm" {
      + autostart   = true
        id          = 2
        name        = "office1-opnsense"
        # (10 unchanged attributes hidden)
    }

  # module.voffice1.libvirt_cloudinit_disk.seed will be created
  + resource "libvirt_cloudinit_disk" "seed" {
      + id             = (known after apply)
      + meta_data      = <<-EOT
            instance-id: voffice1-d114
            local-hostname: voffice1
        EOT
      + name           = "voffice1-cloudinit"
      + network_config = <<-EOT
            version: 2
            ethernets:
              lan:
                match:
                  name: "en*"
                dhcp4: true
        EOT
      + path           = (known after apply)
      + size           = (known after apply)
      + user_data      = <<-EOT
            #cloud-config
            hostname: voffice1
            fqdn: voffice1.cloud.neumatrix.local
            manage_etc_hosts: true
            users:
              - name: jessea123
                groups: [adm, sudo]
                shell: /bin/bash
                sudo: "ALL=(ALL) NOPASSWD:ALL"
                ssh_authorized_keys:
                  - ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINOgHIEyfMecOJ/G2Tbw5kKMd4ofUfxdyhVb00cjcpUX vr1-office1-svc
            package_update: true
            packages:
              - qemu-guest-agent
            runcmd:
              - [systemctl, enable, --now, qemu-guest-agent]
        EOT
    }

  # module.voffice1.libvirt_domain.vm will be updated in-place
  ~ resource "libvirt_domain" "vm" {
      + autostart   = true
        id          = 1
        name        = "voffice1"
        # (10 unchanged attributes hidden)
    }

  # module.voffice1.libvirt_volume.seed must be replaced
-/+ resource "libvirt_volume" "seed" {
      ~ allocation = 45056 -> (known after apply)
      ~ capacity   = 45056 -> (known after apply)
      ~ create     = { # forces replacement
          ~ content = {
              ~ url = "/tmp/terraform-provider-libvirt-cloudinit/cloudinit-775234004c2669d9.iso" -> (known after apply)
            }
        }
      ~ id         = "/var/lib/libvirt/vr1/office1/voffice1-cloudinit.iso" -> (known after apply)
      ~ key        = "/var/lib/libvirt/vr1/office1/voffice1-cloudinit.iso" -> (known after apply)
        name       = "voffice1-cloudinit.iso"
      ~ path       = "/var/lib/libvirt/vr1/office1/voffice1-cloudinit.iso" -> (known after apply)
      ~ physical   = 45056 -> (known after apply)
        # (1 unchanged attribute hidden)
    }

  # module.vr1_dc0_planes.libvirt_network.plane["data-tenant"] will be destroyed
  # (because libvirt_network.plane is not in configuration)
  - resource "libvirt_network" "plane" {
      - autostart = true -> null
      - domain    = {
          - name = "data-tenant.vr1-dc0.cloud.neumatrix.local" -> null
        } -> null
      - id        = "31782537-790a-4399-a3a9-64dce7232e7b" -> null
      - mtu       = {
          - size = 9000 -> null
        } -> null
      - name      = "vr1-dc0-data-tenant" -> null
      - uuid      = "31782537-790a-4399-a3a9-64dce7232e7b" -> null
    }

  # module.vr1_dc0_planes.libvirt_network.plane["metal-admin"] will be destroyed
  # (because libvirt_network.plane is not in configuration)
  - resource "libvirt_network" "plane" {
      - autostart = true -> null
      - domain    = {
          - name = "metal-admin.vr1-dc0.cloud.neumatrix.local" -> null
        } -> null
      - id        = "29eca094-9b40-4e8c-9750-d1c7857f0a3c" -> null
      - mtu       = {
          - size = 9000 -> null
        } -> null
      - name      = "vr1-dc0-metal-admin" -> null
      - uuid      = "29eca094-9b40-4e8c-9750-d1c7857f0a3c" -> null
    }

  # module.vr1_dc0_planes.libvirt_network.plane["metal-internal"] will be destroyed
  # (because libvirt_network.plane is not in configuration)
  - resource "libvirt_network" "plane" {
      - autostart = true -> null
      - domain    = {
          - name = "metal-internal.vr1-dc0.cloud.neumatrix.local" -> null
        } -> null
      - id        = "99768f9d-256a-4a89-90dd-38de04efea03" -> null
      - mtu       = {
          - size = 9000 -> null
        } -> null
      - name      = "vr1-dc0-metal-internal" -> null
      - uuid      = "99768f9d-256a-4a89-90dd-38de04efea03" -> null
    }

  # module.vr1_dc0_planes.libvirt_network.plane["provider-public"] will be destroyed
  # (because libvirt_network.plane is not in configuration)
  - resource "libvirt_network" "plane" {
      - autostart = true -> null
      - domain    = {
          - name = "provider-public.vr1-dc0.cloud.neumatrix.local" -> null
        } -> null
      - id        = "3bb1e17c-53ce-4c1a-a4af-c9d6ad1f1c1b" -> null
      - mtu       = {
          - size = 9000 -> null
        } -> null
      - name      = "vr1-dc0-provider-public" -> null
      - uuid      = "3bb1e17c-53ce-4c1a-a4af-c9d6ad1f1c1b" -> null
    }

  # module.vr1_dc0_planes.libvirt_network.plane["replication"] will be destroyed
  # (because libvirt_network.plane is not in configuration)
  - resource "libvirt_network" "plane" {
      - autostart = true -> null
      - domain    = {
          - name = "replication.vr1-dc0.cloud.neumatrix.local" -> null
        } -> null
      - id        = "295dca85-52de-4e78-9894-16e48d969654" -> null
      - mtu       = {
          - size = 9000 -> null
        } -> null
      - name      = "vr1-dc0-replication" -> null
      - uuid      = "295dca85-52de-4e78-9894-16e48d969654" -> null
    }

  # module.vr1_dc0_planes.libvirt_network.plane["storage"] will be destroyed
  # (because libvirt_network.plane is not in configuration)
  - resource "libvirt_network" "plane" {
      - autostart = true -> null
      - domain    = {
          - name = "storage.vr1-dc0.cloud.neumatrix.local" -> null
        } -> null
      - id        = "e5558f0e-9601-48fc-8eff-6a0e6adad0d7" -> null
      - mtu       = {
          - size = 9000 -> null
        } -> null
      - name      = "vr1-dc0-storage" -> null
      - uuid      = "e5558f0e-9601-48fc-8eff-6a0e6adad0d7" -> null
    }

  # module.vr1_dc0_uplink.libvirt_network.site_wan will be created
  + resource "libvirt_network" "site_wan" {
      + autostart = true
      + domain    = {
          + name = "vr1-dc0-uplink"
        }
      + forward   = {
          + mode = "nat"
        }
      + id        = (known after apply)
      + ips       = [
          + {
              + address = "172.30.2.1"
              + prefix  = 24
            },
        ]
      + mtu       = {
          + size = 1500
        }
      + name      = "vr1-dc0-uplink"
      + uuid      = (known after apply)
    }

  # module.vvr1_dc0.libvirt_cloudinit_disk.seed will be created
  + resource "libvirt_cloudinit_disk" "seed" {
      + id             = (known after apply)
      + meta_data      = <<-EOT
            instance-id: vvr1-dc0-d123
            local-hostname: vvr1-dc0
        EOT
      + name           = "vvr1-dc0-cloudinit"
      + network_config = <<-EOT
            version: 2
            ethernets:
              mgmt:
                match:
                  name: "enp1s0"
                set-name: mgmt
                addresses: ["172.31.0.2/30"]
                routes:
                  - to: "10.10.0.0/22"
                    via: "172.31.0.1"
              uplink:
                match:
                  name: "enp2s0"
                set-name: uplink
                dhcp4: false
                dhcp6: false
            bridges:
              br-vr1-dc0-wan:
                interfaces: [uplink]
                dhcp4: false
                dhcp6: false
                parameters:
                  stp: false
                  forward-delay: 0
        EOT
      + path           = (known after apply)
      + size           = (known after apply)
      + user_data      = <<-EOT
            #cloud-config
            hostname: vvr1-dc0
            fqdn: vvr1-dc0.cloud.neumatrix.local
            manage_etc_hosts: true
            users:
              - name: jessea123
                groups: [adm, sudo]
                shell: /bin/bash
                sudo: "ALL=(ALL) NOPASSWD:ALL"
                ssh_authorized_keys:
                  # D-126 per-env-key (ruling 2026-07-16, option a): vvr1-dc0 authorizes the DEDICATED
                  # dc0 key, NOT office1's -- per-env blast-radius isolation. Inner root's qemu+ssh matches.
                  - ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAID54oMqwY4majxq4oWpBviXb6DlVyj99TUPxDkhszcZG vr1-dc0_svc (D-126 per-env key)
            package_update: true
            packages:
              - qemu-guest-agent
            runcmd:
              - [systemctl, enable, --now, qemu-guest-agent]
        EOT
    }

  # module.vvr1_dc0.libvirt_domain.vm will be created
  + resource "libvirt_domain" "vm" {
      + autostart   = false
      + cpu         = {
          + features = []
          + mode     = "host-passthrough"
        }
      + devices     = {
          + disks      = [
              + {
                  + driver = {
                      + type = "qcow2"
                    }
                  + source = {
                      + volume = {
                          + pool   = "vr1-dc0-pool"
                          + volume = "vvr1-dc0-disk.qcow2"
                        }
                    }
                  + target = {
                      + bus = "virtio"
                      + dev = "vda"
                    }
                },
              + {
                  + device = "cdrom"
                  + source = {
                      + volume = {
                          + pool   = "vr1-dc0-pool"
                          + volume = "vvr1-dc0-cloudinit.iso"
                        }
                    }
                  + target = {
                      + bus = "sata"
                      + dev = "sda"
                    }
                },
            ]
          + interfaces = [
              + {
                  + model  = {
                      + type = "virtio"
                    }
                  + source = {
                      + network = {
                          + network = "mesh-vr1-dc0-office1"
                        }
                    }
                },
              + {
                  + model  = {
                      + type = "virtio"
                    }
                  + source = {
                      + network = {
                          + network = "vr1-dc0-uplink"
                        }
                    }
                },
            ]
        }
      + features    = {
          + acpi = true
          + apic = {}
        }
      + id          = (known after apply)
      + memory      = 425984
      + memory_unit = "MiB"
      + name        = "vvr1-dc0"
      + os          = {
          + type         = "hvm"
          + type_arch    = "x86_64"
          + type_machine = "q35"
        }
      + running     = true
      + type        = "kvm"
      + uuid        = (known after apply)
      + vcpu        = 108
    }

  # module.vvr1_dc0.libvirt_volume.disk will be created
  + resource "libvirt_volume" "disk" {
      + allocation    = (known after apply)
      + backing_store = {
          + format = {
              + type = "qcow2"
            }
          + path   = "/var/lib/libvirt/vr1/office1/ubuntu-24.04-base.qcow2"
        }
      + capacity      = 3221225472000
      + id            = (known after apply)
      + key           = (known after apply)
      + name          = "vvr1-dc0-disk.qcow2"
      + path          = (known after apply)
      + physical      = (known after apply)
      + pool          = "vr1-dc0-pool"
      + target        = {
          + format = {
              + type = "qcow2"
            }
          + path   = (known after apply)
        }
    }

  # module.vvr1_dc0.libvirt_volume.seed will be created
  + resource "libvirt_volume" "seed" {
      + allocation = (known after apply)
      + capacity   = (known after apply)
      + create     = {
          + content = {
              + url = (known after apply)
            }
        }
      + id         = (known after apply)
      + key        = (known after apply)
      + name       = "vvr1-dc0-cloudinit.iso"
      + path       = (known after apply)
      + physical   = (known after apply)
      + pool       = "vr1-dc0-pool"
    }

Plan: 7 to add, 2 to change, 7 to destroy.

─────────────────────────────────────────────────────────────────────────────

Note: You didn't use the -out option to save this plan, so OpenTofu can't
guarantee to take exactly these actions if you run "tofu apply" now.