From 7f022d3a67c5db3afbe87483f0ab32d31e54c441 Mon Sep 17 00:00:00 2001
From: Will Anderson <andersonwilliam85@gmail.com>
Date: Mon, 23 Mar 2026 07:49:57 -0500
Subject: [PATCH] Remove null_resources, add bootstrap.sh, fix k3s cert for new
 LAN IP

---
 servers/legion/adguard.tf   | 48 ++++---------------------------------
 servers/legion/bootstrap.sh | 31 ++++++++++++++++++++++++
 servers/legion/main.tf      |  4 ----
 3 files changed, 36 insertions(+), 47 deletions(-)
 create mode 100644 servers/legion/bootstrap.sh

diff --git a/servers/legion/adguard.tf b/servers/legion/adguard.tf
index efaa813..e288219 100644
--- a/servers/legion/adguard.tf
+++ b/servers/legion/adguard.tf
@@ -226,46 +226,8 @@ resource "kubernetes_ingress_v1" "adguard" {
   depends_on = [helm_release.cert_manager]
 }
 
-# Add new LAN IP to k3s TLS SANs so the API cert is valid after network change
-resource "null_resource" "k3s_tls_san" {
-  triggers = {
-    legion_ip = var.legion_ip
-  }
-
-  connection {
-    type        = "ssh"
-    host        = var.legion_ip
-    user        = "will"
-    private_key = file("~/.ssh/id_ed25519")
-  }
-
-  provisioner "remote-exec" {
-    inline = [
-      "sudo mkdir -p /etc/rancher/k3s",
-      "echo 'tls-san:' | sudo tee /etc/rancher/k3s/config.yaml",
-      "echo '  - ${var.legion_ip}' | sudo tee -a /etc/rancher/k3s/config.yaml",
-      "echo '  - 127.0.0.1' | sudo tee -a /etc/rancher/k3s/config.yaml",
-      "sudo k3s certificate rotate",
-      "sudo systemctl restart k3s",
-      "sleep 20",
-    ]
-  }
-}
-
-# systemd-resolved occupies port 53 on the host — must be disabled for AdGuard to bind
-resource "null_resource" "disable_systemd_resolved" {
-  connection {
-    type        = "ssh"
-    host        = var.legion_ip
-    user        = "will"
-    private_key = file("~/.ssh/id_ed25519")
-  }
-
-  provisioner "remote-exec" {
-    inline = [
-      "sudo systemctl disable --now systemd-resolved || true",
-      "sudo rm -f /etc/resolv.conf",
-      "echo 'nameserver 1.1.1.1' | sudo tee /etc/resolv.conf",
-    ]
-  }
-}
+# Host-level bootstrap notes (run bootstrap.sh once on new Legion installs):
+# - systemd-resolved disabled (conflicts with AdGuard on port 53)
+# - k3s config.yaml includes tls-san for LAN IP
+# - /etc/resolv.conf set to 1.1.1.1 fallback
+# See: servers/legion/bootstrap.sh
diff --git a/servers/legion/bootstrap.sh b/servers/legion/bootstrap.sh
new file mode 100644
index 0000000..fe9fbb9
--- /dev/null
+++ b/servers/legion/bootstrap.sh
@@ -0,0 +1,31 @@
+#!/usr/bin/env bash
+# Legion host bootstrap — run once on a fresh install before Terraform
+# Usage: ssh legion "bash -s" < bootstrap.sh
+set -euo pipefail
+
+LEGION_IP="${1:-192.168.68.77}"
+
+echo "==> Disabling systemd-resolved (conflicts with AdGuard on port 53)"
+sudo systemctl disable --now systemd-resolved || true
+sudo rm -f /etc/resolv.conf
+echo "nameserver 1.1.1.1" | sudo tee /etc/resolv.conf
+
+echo "==> Configuring k3s tls-san for LAN IP ${LEGION_IP}"
+sudo mkdir -p /etc/rancher/k3s
+sudo tee /etc/rancher/k3s/config.yaml > /dev/null << EOF
+write-kubeconfig-mode: "644"
+default-runtime: nvidia
+tls-san:
+  - ${LEGION_IP}
+  - 127.0.0.1
+EOF
+
+echo "==> Rotating k3s certificates"
+sudo k3s certificate rotate
+sudo systemctl restart k3s
+
+echo "==> Waiting for k3s to come back up..."
+sleep 20
+sudo k3s kubectl get nodes
+
+echo "==> Bootstrap complete"
diff --git a/servers/legion/main.tf b/servers/legion/main.tf
index 70c6c01..6b399b8 100644
--- a/servers/legion/main.tf
+++ b/servers/legion/main.tf
@@ -10,10 +10,6 @@ terraform {
       source  = "hashicorp/helm"
       version = "~> 2.14"
     }
-    null = {
-      source  = "hashicorp/null"
-      version = "~> 3.0"
-    }
   }
 
   backend "s3" {