feat(iapetus): remove OVN networking and add cross-environment DNS forwarding

iapetus is a single host that doesn't need overlay networking. Remove all
OVN infrastructure (ovn-central, OVN networks, OVN LB) and use physical/bridge
networking with direct LAN IPs instead.

Add bidirectional DNS forwarding between iapetus and cluster01:
- iapetus forwards cluster01.accuser.dev and cluster01.incus to cluster01 CoreDNS
- cluster01 forwards accuser.dev and iapetus.incus to iapetus CoreDNS

Also fix Ansible role bugs:
- prometheus: validate prometheus_config_base64 (not prometheus_config)
- step_ca: move creates param inside command module dict

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Author: accuser

ansible/roles/prometheus/tasks/main.yml

@@ -7,8 +7,8 @@
 - name: Validate required variables
   ansible.builtin.assert:
     that:
-      - prometheus_config is defined and prometheus_config | length > 0
-    fail_msg: "prometheus_config must be set (typically via Terraform output)"
+      - prometheus_config_base64 is defined and prometheus_config_base64 | length > 0
+    fail_msg: "prometheus_config_base64 must be set (typically via Terraform output)"
     success_msg: "Required variables validated"
   tags:
     - always

ansible/roles/step_ca/tasks/initialize.yml

@@ -59,11 +59,11 @@
           --provisioner-password-file="{{ step_secrets_dir }}/password"
           --acme
           --deployment-type=standalone
+        creates: "{{ step_config_dir }}/ca.json"
       become: true
       become_user: "{{ step_user }}"
       environment:
         STEPPATH: "{{ step_home }}"
-      creates: "{{ step_config_dir }}/ca.json"
 
     - name: Display generated password warning
       ansible.builtin.debug:

environments/cluster01/main.tf

@@ -472,11 +472,19 @@ module "coredns01" {
     }
   ] : []
 
-  # Forward iapetus.accuser.dev queries to iapetus CoreDNS for cross-environment DNS
-  forward_zones = var.iapetus_coredns_address != "" ? [{
-    zone    = var.iapetus_dns_zone_name
-    servers = [var.iapetus_coredns_address]
-  }] : []
+  # Forward iapetus zones to iapetus CoreDNS for cross-environment DNS
+  # - accuser.dev: service resolution (e.g., grafana.accuser.dev)
+  # - iapetus.incus: container name resolution (e.g., loki01.iapetus.incus)
+  forward_zones = var.iapetus_coredns_address != "" ? [
+    {
+      zone    = var.iapetus_service_zone_name
+      servers = [var.iapetus_coredns_address]
+    },
+    {
+      zone    = var.iapetus_dns_zone_name
+      servers = [var.iapetus_coredns_address]
+    },
+  ] : []
 
   # External access via proxy devices (bridge mode only)
   # With OVN, we use OVN load balancers instead

environments/cluster01/outputs.tf

@@ -202,6 +202,20 @@ output "alertmanager_ansible_vars" {
   value       = module.alertmanager01.ansible_vars
 }
 
+# CoreDNS
+output "coredns_instances" {
+  description = "CoreDNS instances for Ansible inventory"
+  value = {
+    "coredns01" = module.coredns01.instance_info
+  }
+}
+
+output "coredns_ansible_vars" {
+  description = "Variables passed to Ansible for CoreDNS configuration"
+  sensitive   = true
+  value       = module.coredns01.ansible_vars
+}
+
 # Mosquitto
 output "mosquitto_instances" {
   description = "Mosquitto instances for Ansible inventory"

environments/cluster01/terraform.tfvars.example

@@ -57,7 +57,7 @@ loki_push_url = "http://<iapetus-loki-ip>:3100/loki/api/v1/push"
 # DNS Configuration
 # =============================================================================
 
-dns_domain           = "cluster.local"
+dns_domain           = "cluster01.accuser.dev"
 dns_upstream_servers = ["1.1.1.1", "8.8.8.8"]
 
 # For physical mode, set the external IP for the NS record

environments/cluster01/variables.tf

@@ -143,9 +143,9 @@ variable "step_ca_fingerprint" {
 # =============================================================================
 
 variable "dns_domain" {
-  description = "Internal DNS domain for services"
+  description = "DNS domain for cluster01 services (e.g., 'cluster01.accuser.dev'). CoreDNS will be authoritative for this zone."
   type        = string
-  default     = "cluster.local"
+  default     = "cluster01.accuser.dev"
 }
 
 variable "dns_upstream_servers" {
@@ -172,17 +172,23 @@ variable "dns_additional_records" {
 }
 
 variable "iapetus_coredns_address" {
-  description = "IP address of iapetus CoreDNS for cross-environment DNS resolution (e.g., iapetus.incus zone). Use the OVN LB VIP or direct container IP."
+  description = "IP address of iapetus CoreDNS for cross-environment DNS resolution. Use the OVN LB VIP or direct container IP."
   type        = string
   default     = ""
 }
 
 variable "iapetus_dns_zone_name" {
-  description = "Incus DNS zone name for iapetus (e.g., 'iapetus.incus'). Used for cross-environment forwarding."
+  description = "Incus DNS zone name for iapetus containers (e.g., 'iapetus.incus'). Used for cross-environment container name resolution."
   type        = string
   default     = "iapetus.incus"
 }
 
+variable "iapetus_service_zone_name" {
+  description = "Service DNS zone for iapetus (e.g., 'accuser.dev'). Used for cross-environment service resolution so cluster01 containers can resolve iapetus services by name."
+  type        = string
+  default     = "accuser.dev"
+}
+
 # =============================================================================
 # Incus Network Zone Configuration
 # =============================================================================

environments/iapetus/locals.tf

@@ -33,131 +33,6 @@ locals {
     module.base.gitops_network_profile.name,
   ] : []
 
-  # ==========================================================================
-  # External Access Logic (Phase 2: Reduce duplication)
-  # ==========================================================================
-  # Common conditions for external access configuration
-
-  bridge_external_access = var.network_backend == "bridge" && !module.base.production_network_is_physical
-  use_ovn_lb             = var.network_backend == "ovn"
-
-  # ==========================================================================
-  # OVN Load Balancer Configuration
-  # ==========================================================================
-  ovn_load_balancers = {
-    grafana = {
-      enabled        = var.grafana_lb_address != ""
-      network        = "management"
-      listen_address = var.grafana_lb_address
-      description    = "Grafana dashboard"
-      backends = [{
-        name           = "grafana01"
-        target_address = module.grafana01.ipv4_address
-        target_port    = 3000
-      }]
-      ports        = [{ description = "HTTP", protocol = "tcp", listen_port = 3000, target_backends = null }]
-      health_check = { enabled = true }
-    }
-    prometheus = {
-      enabled        = var.prometheus_lb_address != ""
-      network        = "management"
-      listen_address = var.prometheus_lb_address
-      description    = "Prometheus metrics server"
-      backends = [{
-        name           = "prometheus01"
-        target_address = module.prometheus01.ipv4_address
-        target_port    = 9090
-      }]
-      ports        = [{ description = "HTTP", protocol = "tcp", listen_port = 9090, target_backends = null }]
-      health_check = { enabled = true }
-    }
-    loki = {
-      enabled        = var.loki_lb_address != ""
-      network        = "management"
-      listen_address = var.loki_lb_address
-      description    = "Loki log aggregator"
-      backends = [{
-        name           = "loki01"
-        target_address = module.loki01.ipv4_address
-        target_port    = 3100
-      }]
-      ports        = [{ description = "HTTP", protocol = "tcp", listen_port = 3100, target_backends = null }]
-      health_check = { enabled = true }
-    }
-    step_ca = {
-      enabled        = var.step_ca_lb_address != ""
-      network        = "management"
-      listen_address = var.step_ca_lb_address
-      description    = "step-ca ACME server"
-      backends = [{
-        name           = "step-ca01"
-        target_address = module.step_ca01.ipv4_address
-        target_port    = 9000
-      }]
-      ports        = [{ description = "HTTPS", protocol = "tcp", listen_port = 9000, target_backends = null }]
-      health_check = { enabled = true }
-    }
-    coredns = {
-      enabled        = var.coredns_lb_address != ""
-      network        = "production"
-      listen_address = var.coredns_lb_address
-      description    = "CoreDNS"
-      backends = [{
-        name           = "coredns01"
-        target_address = module.coredns01.ipv4_address
-        target_port    = 53
-      }]
-      ports = [
-        { description = "DNS over UDP", protocol = "udp", listen_port = 53, target_backends = null },
-        { description = "DNS over TCP", protocol = "tcp", listen_port = 53, target_backends = null },
-      ]
-      health_check = { enabled = true }
-    }
-    atlantis = {
-      enabled        = var.atlantis_lb_address != "" && var.enable_gitops
-      network        = "gitops"
-      listen_address = var.atlantis_lb_address
-      description    = "Atlantis GitOps server"
-      backends = [{
-        name           = "atlantis01"
-        target_address = try(module.atlantis01[0].ipv4_address, "0.0.0.0")
-        target_port    = 4141
-      }]
-      ports        = [{ description = "HTTP", protocol = "tcp", listen_port = 4141, target_backends = null }]
-      health_check = { enabled = true }
-    }
-  }
-
-  # ==========================================================================
-  # OVN DNS Records (auto-generated from LB VIP addresses)
-  # ==========================================================================
-  # When OVN is enabled, generate DNS records pointing to LB VIPs
-  # These override any manual records in dns_additional_records
-  # Note: Generated directly from variables to avoid cycle with module outputs
-  ovn_dns_records = local.use_ovn_lb ? [
-    for name, addr in {
-      grafana    = var.grafana_lb_address
-      prometheus = var.prometheus_lb_address
-      loki       = var.loki_lb_address
-      step-ca    = var.step_ca_lb_address
-      atlantis   = var.enable_gitops ? var.atlantis_lb_address : ""
-      } : {
-      name  = name
-      type  = "A"
-      value = addr
-      ttl   = 300
-    } if addr != ""
-  ] : []
-
-  # Merge OVN DNS records with manual records (OVN takes precedence)
-  # First, filter out manual records that have OVN equivalents
-  ovn_dns_names = toset([for r in local.ovn_dns_records : r.name])
-  filtered_additional_records = [
-    for r in var.dns_additional_records : r
-    if !contains(local.ovn_dns_names, r.name)
-  ]
-  merged_dns_records = concat(local.ovn_dns_records, local.filtered_additional_records)
-
   # ==========================================================================
   # Service Resource Limits
   # ==========================================================================
@@ -214,11 +89,6 @@ locals {
       memory = "256MB"
       port   = 8443
     }
-    ovn_central = {
-      cpu    = "1"
-      memory = "512MB"
-      port   = 6641
-    }
   }
 
   # NOTE: Network dependencies for depends_on cannot be centralized in locals