# 2026-07-17 -- D-127 IaC autostart matrix (baked into the deploy tooling) + Office1 guest updates

## Guest OS updates (agent-run via passwordless sudo INSIDE the guests)

The vcloud HOST + office1-opnsense stay in the operator's bookend restart; the already-deployed guests I
have sudo inside were updated now:
- **office1-netbox** (LXD): `apt upgrade` (9 pkgs, userland, no kernel) -- no reboot; netbox-docker
  stack unaffected + still healthy (HTTP 302).
- **office1-tailscale** (LXD): `apt full-upgrade` (kernel 6.8.0-134 -> 6.8.0-136) + reboot; came back on
  the new kernel, tailscale online (`100.64.0.53`) re-advertising `10.10.0.0/22`. Not the ProxyJump path,
  so safe.
- **voffice1**: 0 upgradable -- nothing to do (so its load-bearing reboot risk was moot this round).
- **LXD `boot.autostart=true`** set on both office1-netbox + office1-tailscale (D-127 non-host layer).

## D-127 IaC autostart matrix (operator: bake it into the tooling so DC0/DC1 aren't missed at install)

Advisor-gated. Added an `autostart` bool var (default false) to `modules/cloudinit-vm`,
`modules/opnsense-edge`, `modules/node-vm`, wired to `libvirt_domain.autostart`; set EXPLICITLY per
instance (shared modules => IaC is the source of truth, else it fights the live layer):

| instance | root | autostart | why |
|---|---|---|---|
| voffice1 | outer | **true** | foundational Office1 host |
| office1-opnsense | outer | **true** | foundational edge (post-DOCFIX-188) |
| vvr1-dc0 | outer | **false** | DC containment VM -- MANUAL, gated bring-up |
| vr1-dc0-opnsense | inner | **true** | DC edge comes up with its container |
| node-vm (x9) | inner | **false** | MAAS-power-controlled |

**HARD GATE verified:** `tofu plan` shows the two EXISTING Office1 domains (voffice1, office1-opnsense) as
`autostart false->true` **update-in-place** -- NOT replacement (replacement would destroy the live
host/edge). vvr1-dc0 is a new create with autostart=false baked in. Outer plan is now
`5 add / 2 in-place / 6 destroy`; the 2 in-place collapse to 0 once the bookend sets those two autostart
live before the fresh-session apply.

**Drift guard:** `tests/opentofu-validate/run-tests.sh` T11-T15 pin each matrix value (flipping
vvr1-dc0/nodes to true -- auto-booting the 416 GiB nested container / MAAS nodes on host boot -- is the
exact defect guarded). opentofu-validate clean; harness ALL PASS.

**Standup runbook** updated: the composed service VMs' `boot.autostart` is now a recorded install step
(not a manual afterthought). **DC0/DC1 create NO LXD instances** (inner root = node-vm + opnsense-edge +
planes/pool/wan-bridge), so the DC side is purely this VM matrix -- no DC-LXD gap.

## Records

D-127 implementation updated (IaC layer DONE); readiness-doc plan line updated (5/2/6, collapses to 0);
D-127 as-built already notes the netbox restart policy.

## Verification

- `bash tests/opentofu-validate/run-tests.sh` -> ALL PASS (incl. T11-T15 matrix pins).
- `bash scripts/opentofu-validate.sh` -> clean (both roots + 12 modules).
- `tofu -chdir=opentofu plan` -> `5 add / 2 in-place / 6 destroy`; no forces-replacement on any existing.
- `bash scripts/repo-lint.sh` -> 0 fail (1 legacy WARN).

## Revert

- `git checkout opentofu/modules/{cloudinit-vm,opnsense-edge,node-vm}/{main,variables}.tf opentofu/main.tf
  opentofu/vr1-dc0-substrate/main.tf tests/opentofu-validate/run-tests.sh runbooks/dc-dc-phase1-office1-standup.md`;
  drop the D-127 IaC-layer text. Live: `sudo lxc config unset <inst> boot.autostart` on voffice1. The guest
  apt upgrades are not repo state (OS state).