Remove null_resources, add bootstrap.sh, fix k3s cert for new LAN IP

servers/legion/adguard.tf

@@ -226,46 +226,8 @@ resource "kubernetes_ingress_v1" "adguard" {
   depends_on = [helm_release.cert_manager]
 }
 
-# Add new LAN IP to k3s TLS SANs so the API cert is valid after network change
-resource "null_resource" "k3s_tls_san" {
-  triggers = {
-    legion_ip = var.legion_ip
-  }
-
-  connection {
-    type        = "ssh"
-    host        = var.legion_ip
-    user        = "will"
-    private_key = file("~/.ssh/id_ed25519")
-  }
-
-  provisioner "remote-exec" {
-    inline = [
-      "sudo mkdir -p /etc/rancher/k3s",
-      "echo 'tls-san:' | sudo tee /etc/rancher/k3s/config.yaml",
-      "echo '  - ${var.legion_ip}' | sudo tee -a /etc/rancher/k3s/config.yaml",
-      "echo '  - 127.0.0.1' | sudo tee -a /etc/rancher/k3s/config.yaml",
-      "sudo k3s certificate rotate",
-      "sudo systemctl restart k3s",
-      "sleep 20",
-    ]
-  }
-}
-
-# systemd-resolved occupies port 53 on the host — must be disabled for AdGuard to bind
-resource "null_resource" "disable_systemd_resolved" {
-  connection {
-    type        = "ssh"
-    host        = var.legion_ip
-    user        = "will"
-    private_key = file("~/.ssh/id_ed25519")
-  }
-
-  provisioner "remote-exec" {
-    inline = [
-      "sudo systemctl disable --now systemd-resolved || true",
-      "sudo rm -f /etc/resolv.conf",
-      "echo 'nameserver 1.1.1.1' | sudo tee /etc/resolv.conf",
-    ]
-  }
-}
+# Host-level bootstrap notes (run bootstrap.sh once on new Legion installs):
+# - systemd-resolved disabled (conflicts with AdGuard on port 53)
+# - k3s config.yaml includes tls-san for LAN IP
+# - /etc/resolv.conf set to 1.1.1.1 fallback
+# See: servers/legion/bootstrap.sh