Remove null_resources, add bootstrap.sh, fix k3s cert for new LAN IP

servers/legion/adguard.tf

@@ -226,46 +226,8 @@ resource "kubernetes_ingress_v1" "adguard" {
   depends_on = [helm_release.cert_manager]
 }
 
-# Add new LAN IP to k3s TLS SANs so the API cert is valid after network change
-resource "null_resource" "k3s_tls_san" {
-  triggers = {
-    legion_ip = var.legion_ip
-  }
-
-  connection {
-    type        = "ssh"
-    host        = var.legion_ip
-    user        = "will"
-    private_key = file("~/.ssh/id_ed25519")
-  }
-
-  provisioner "remote-exec" {
-    inline = [
-      "sudo mkdir -p /etc/rancher/k3s",
-      "echo 'tls-san:' | sudo tee /etc/rancher/k3s/config.yaml",
-      "echo '  - ${var.legion_ip}' | sudo tee -a /etc/rancher/k3s/config.yaml",
-      "echo '  - 127.0.0.1' | sudo tee -a /etc/rancher/k3s/config.yaml",
-      "sudo k3s certificate rotate",
-      "sudo systemctl restart k3s",
-      "sleep 20",
-    ]
-  }
-}
-
-# systemd-resolved occupies port 53 on the host — must be disabled for AdGuard to bind
-resource "null_resource" "disable_systemd_resolved" {
-  connection {
-    type        = "ssh"
-    host        = var.legion_ip
-    user        = "will"
-    private_key = file("~/.ssh/id_ed25519")
-  }
-
-  provisioner "remote-exec" {
-    inline = [
-      "sudo systemctl disable --now systemd-resolved || true",
-      "sudo rm -f /etc/resolv.conf",
-      "echo 'nameserver 1.1.1.1' | sudo tee /etc/resolv.conf",
-    ]
-  }
-}
+# Host-level bootstrap notes (run bootstrap.sh once on new Legion installs):
+# - systemd-resolved disabled (conflicts with AdGuard on port 53)
+# - k3s config.yaml includes tls-san for LAN IP
+# - /etc/resolv.conf set to 1.1.1.1 fallback
+# See: servers/legion/bootstrap.sh

servers/legion/bootstrap.sh

@@ -0,0 +1,31 @@
+#!/usr/bin/env bash
+# Legion host bootstrap — run once on a fresh install before Terraform
+# Usage: ssh legion "bash -s" < bootstrap.sh
+set -euo pipefail
+
+LEGION_IP="${1:-192.168.68.77}"
+
+echo "==> Disabling systemd-resolved (conflicts with AdGuard on port 53)"
+sudo systemctl disable --now systemd-resolved || true
+sudo rm -f /etc/resolv.conf
+echo "nameserver 1.1.1.1" | sudo tee /etc/resolv.conf
+
+echo "==> Configuring k3s tls-san for LAN IP ${LEGION_IP}"
+sudo mkdir -p /etc/rancher/k3s
+sudo tee /etc/rancher/k3s/config.yaml > /dev/null << EOF
+write-kubeconfig-mode: "644"
+default-runtime: nvidia
+tls-san:
+  - ${LEGION_IP}
+  - 127.0.0.1
+EOF
+
+echo "==> Rotating k3s certificates"
+sudo k3s certificate rotate
+sudo systemctl restart k3s
+
+echo "==> Waiting for k3s to come back up..."
+sleep 20
+sudo k3s kubectl get nodes
+
+echo "==> Bootstrap complete"

servers/legion/main.tf

@@ -10,10 +10,6 @@ terraform {
       source  = "hashicorp/helm"
       version = "~> 2.14"
     }
-    null = {
-      source  = "hashicorp/null"
-      version = "~> 3.0"
-    }
   }
 
   backend "s3" {