assets/cloud_init.yaml is the canonical configuration moved from PVE. PVE
and Yandex Cloud consume it directly. It owns the Ansible sudo user, SSH keys,
local TLS root CA, and common bootstrap policy. The Ansible SSH CA is selected by its certificate-authority principal options;
user and key ordering do not affect the Xen configuration. Missing or duplicate
Ansible users or CA keys fail template rendering.
assets/cloud_init_min.yaml is the existing minimal PVE configuration with
QEMU guest tools. Both original PVE files retain their contents.
The xen_linux target uses the repository’s rules_template Go template rule
to derive xen_linux.json from that same PVE configuration. Its small template
selects the shared Ansible CA key, uses Fedora’s users,wheel groups, and adds
Xen guest tools. It omits PVE’s explicit package-reboot and public metadata-key
flags to preserve the existing Xen bootstrap behavior. All other base fields,
including the TLS CA, come from the PVE configuration. There is no separate
copy of the Xen user or CA configuration and no Terraform template file.
Forgejo merges its hostname into the generated object and uses Terraform’s
yamlencode to serialize it. Its static network structure stays in Terraform,
where interface, address, MAC, gateway, and DNS are runtime values. The rendered
Forgejo user-data and network configuration remain byte-identical to the
previous configuration.
PVE Ansible packages the moved snippets under the existing
files/cloud_init.yaml and files/cloud_init_min.yaml names. Those packaging
aliases preserve local:snippets/cloud_init.yaml references on PVE hosts.
Subsequent persistent VM configuration belongs in Ansible. Targets are
repository-internal runtime inputs, not published artifacts.