# =============================================================================
# lxd-preseed.yaml
# Ubuntu 26.04 + LXD 5.21 LTS (snap) — preseed for a Kubernetes-from-scratch lab
#
# Apply with:
#   cat lxd-preseed.yaml | sudo lxd init --preseed
#
# This is the FIXED version of the draft you posted. Problems in the original:
#   1. `config:` appeared twice at the top level — YAML keeps only the last one,
#      silently dropping core.https_address/core.trust_password.
#   2. `core.trust_password: true` — this key takes an actual password STRING,
#      not a boolean. Left as-is, `lxd init` will reject the preseed.
#   3. `ipv4.dhcp: "true"` with no `ipv4.dhcp.ranges` hands out addresses across
#      the WHOLE /24, which will collide with the static IPs you want to pin
#      to k8master/k8worker1. We narrow the DHCP pool instead.
#   4. `storage_pools.source: /dev/sdc1` assumes a second raw disk exists. In a
#      single-disk VirtualBox VM this device won't exist and `lxd init` will
#      fail outright. Default here is a loop-backed zfs pool (safe anywhere);
#      the raw-disk form is included below, commented out, for when you do
#      attach a second vdisk.
#   5. The `profiles.default` block mixed a multi-line kernel module list with
#      a stray `lxc.apparmor.profile=unconfined` line glued onto the YAML
#      scalar — that's invalid YAML and also the wrong key. AppArmor/cgroup
#      overrides belong under `raw.lxc`, not `linux.kernel_modules`.
#   6. Kubernetes needs privileged, nested containers — those settings do not
#      belong on the profile named "default" (every non-k8s container you
#      ever launch would inherit them). We keep "default" plain and put all
#      Kubernetes requirements in a dedicated `k8s-base` profile instead, per
#      your own spec.
# =============================================================================

config:
  core.https_address: ""          # keep the LXD API off the network; set to
                                   # "192.168.50.40:8443" only if you actually
                                   # need remote `lxc remote add` access, and
                                   # then set core.trust_password to a real
                                   # secret string, e.g. "S0meLongRandomPass"

networks:
  - name: k8sbr0
    type: bridge
    description: Kubernetes lab bridge
    config:
      ipv4.address: 192.168.100.1/24
      ipv4.nat: "true"
      ipv4.dhcp: "true"
      ipv4.dhcp.ranges: 192.168.100.100-192.168.100.199   # leaves .2-.99 free for static reservations
      ipv6.address: none

storage_pools:
  - name: default
    driver: zfs
    config:
      size: 30GiB
      # --- loop-backed pool (default, works on any single-disk VM) ---
      # LXD creates /var/snap/lxd/common/lxd/disks/default.img and a zpool on it.
      #
      # --- OR, if you attached a second raw/unformatted disk to the VM: ---
      # source: /dev/sdc1
      # (comment out "size" above and uncomment "source" if you use this path;
      #  /dev/sdc1 must be a whole, unpartitioned/unformatted block device —
      #  zfs will take ownership of it.)

profiles:
  - name: default
    description: Standard LXD default profile (unprivileged, no k8s bits)
    config: {}
    devices:
      root:
        type: disk
        pool: default
        path: /
      eth0:
        type: nic
        network: k8sbr0
        name: eth0

  - name: k8s-base
    description: Reusable profile for kubeadm-ready Kubernetes nodes
    config:
      security.privileged: "true"
      security.nesting: "true"
      limits.memory.swap: "false"
      boot.autostart: "true"
      linux.kernel_modules: ip_tables,ip6_tables,ip_vs,ip_vs_rr,ip_vs_wrr,ip_vs_sh,nf_nat,overlay,br_netfilter,netlink_diag,xt_conntrack
      raw.lxc: |
        lxc.apparmor.profile=unconfined
        lxc.cap.drop=
        lxc.cgroup.devices.allow=a
        lxc.mount.auto=proc:rw sys:rw
    devices:
      root:
        type: disk
        pool: default
        path: /
      eth0:
        type: nic
        network: k8sbr0
        name: eth0

projects: []
cluster: null
