Remove null_resources, add bootstrap.sh, fix k3s cert for new LAN IP

servers/legion/bootstrap.sh

@@ -0,0 +1,31 @@
+#!/usr/bin/env bash
+# Legion host bootstrap — run once on a fresh install before Terraform
+# Usage: ssh legion "bash -s" < bootstrap.sh
+set -euo pipefail
+
+LEGION_IP="${1:-192.168.68.77}"
+
+echo "==> Disabling systemd-resolved (conflicts with AdGuard on port 53)"
+sudo systemctl disable --now systemd-resolved || true
+sudo rm -f /etc/resolv.conf
+echo "nameserver 1.1.1.1" | sudo tee /etc/resolv.conf
+
+echo "==> Configuring k3s tls-san for LAN IP ${LEGION_IP}"
+sudo mkdir -p /etc/rancher/k3s
+sudo tee /etc/rancher/k3s/config.yaml > /dev/null << EOF
+write-kubeconfig-mode: "644"
+default-runtime: nvidia
+tls-san:
+  - ${LEGION_IP}
+  - 127.0.0.1
+EOF
+
+echo "==> Rotating k3s certificates"
+sudo k3s certificate rotate
+sudo systemctl restart k3s
+
+echo "==> Waiting for k3s to come back up..."
+sleep 20
+sudo k3s kubectl get nodes
+
+echo "==> Bootstrap complete"