Add per-environment config files and split env secrets

- Create envs/beelink/env and envs/hetzner/env (gitignored, from root env)
- Create beelink awx.yaml, haproxy.yaml, observability.yaml (extracted
  from deploy script hardcoded defaults)
- Create hetzner observability.yaml
- Rewrite envs/README.md for new structure
- Update usage comments in all YAML files for new paths

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

envs/README.md

@@ -1,76 +1,72 @@
-# Target Configurations
+# Environment Configurations
 
-Target-specific Proxmox connection configs and lab definitions. Each
+Per-environment connection configs, secrets, and deployment settings. Each
-subdirectory represents a physical host (or host type) with its own
+subdirectory represents a physical host (or host type) with its own network
-network topology, storage backend, and resource sizing.
+topology, storage backend, and resource sizing.
-
-## How it works
-
-`incusos-proxmox` already supports `--proxmox FILE` to point at any
-connection config. Targets are just an organizational convention --
-no script changes required.
 
 ## Directory layout
 
 ```
-targets/
+envs/
 ├── beelink/
-│   ├── proxmox.yaml.example     # Connection template (LAN, vmbr0, local-lvm)
+│   ├── env                    # Secrets: PROXMOX_TOKEN_SECRET, etc. (gitignored)
-│   └── lab-cluster.yaml          # 3-node cluster sized for beelink (4C/4G/50G)
+│   ├── proxmox.yaml           # Proxmox connection (gitignored)
+│   ├── proxmox.yaml.example   # Connection template (LAN, vmbr0, local-lvm)
+│   ├── lab-cluster.yaml       # 3-node cluster (4C/4G/50G)
+│   ├── awx.yaml               # AWX deployment settings
+│   ├── haproxy.yaml           # HAProxy deployment settings
+│   └── observability.yaml     # Monitoring stack settings
 └── hetzner/
-    ├── proxmox.yaml.example     # Connection template (WireGuard, vmbr1, local-zfs)
+    ├── env                    # Secrets (gitignored)
-    ├── lab-cluster.yaml          # 3-node cluster sized for hetzner (8C/16G/100G)
+    ├── proxmox.yaml           # Proxmox connection (gitignored)
-    └── lab-production.yaml       # OC + 3-node cluster for hetzner
+    ├── proxmox.yaml.example   # Connection template (WireGuard, vmbr1, local-zfs)
+    ├── lab-cluster.yaml       # 3-node cluster (8C/16G/100G)
+    ├── lab-production.yaml    # OC + 3-node cluster
+    ├── awx.yaml               # AWX deployment settings
+    ├── haproxy.yaml           # HAProxy deployment settings
+    ├── observability.yaml     # Monitoring stack settings
+    └── setup/                 # Host provisioning (Proxmox install guide + script)
+        ├── README.md
+        ├── hetzner-setup.md
+        ├── hetzner-lab-guide.md
+        └── proxmox-setup
 ```
 
-## Usage
+## How to use
 
-### 1. Copy the example and fill in credentials
+### 1. Source the environment
+
+Each environment has its own `env` file with the same variable names.
+Source the one for the host you're targeting:
 
 ```bash
-cp incusos/targets/hetzner/proxmox.yaml.example incusos/targets/hetzner/proxmox.yaml
+source envs/beelink/env    # or: source envs/hetzner/env
-# Edit with your API token, host IP, etc.
 ```
 
-### 2. Deploy with explicit --proxmox
+### 2. Deploy VMs
 
 ```bash
-incusos-proxmox --proxmox incusos/targets/hetzner/proxmox.yaml \
+bin/incusos-proxmox --proxmox envs/hetzner/proxmox.yaml \
-                incusos/targets/hetzner/lab-cluster.yaml
+                    envs/hetzner/lab-production.yaml
 ```
 
-### 3. Or symlink for convenience
+### 3. Deploy services with --config
 
 ```bash
-# Point the auto-discovered proxmox.yaml at your active target
+bin/deploy-awx --config envs/hetzner/awx.yaml --deploy
-ln -sf targets/hetzner/proxmox.yaml incusos/proxmox.yaml
+bin/deploy-haproxy --config envs/hetzner/haproxy.yaml --deploy
-
+bin/deploy-observability --config envs/hetzner/observability.yaml --deploy
-# Now deploy without --proxmox
-incusos-proxmox incusos/targets/hetzner/lab-cluster.yaml
 ```
 
-## Environment variables
+## Adding a new environment
 
-`incusos-proxmox` reads `PROXMOX_TOKEN_SECRET` from the environment (or
+1. Create a new subdirectory: `envs/myhost/`
-the `env` file at the repo root). When working with multiple targets,
+2. Copy `proxmox.yaml.example` from an existing env and edit
-use different variable names per host:
+3. Create an `env` file with your secrets (same variable names)
+4. Create lab YAML files sized for your hardware
+5. Create `awx.yaml`, `haproxy.yaml`, `observability.yaml` with your IPs
 
-```bash
+## Key differences between environments
-# In env file
-PROXMOX_TOKEN_SECRET=beelink-token-here
-HETZNER_PROXMOX_TOKEN_SECRET=hetzner-token-here
-```
-
-Before deploying to a specific target, export the right secret:
-
-```bash
-# Deploy to Hetzner
-export PROXMOX_TOKEN_SECRET="$HETZNER_PROXMOX_TOKEN_SECRET"
-incusos-proxmox --proxmox incusos/targets/hetzner/proxmox.yaml \
-                incusos/targets/hetzner/lab-cluster.yaml
-```
-
-## Key differences between targets
 
 | Setting | Beelink | Hetzner |
 |---------|---------|---------|

envs/beelink/awx.yaml

@@ -0,0 +1,26 @@
+# awx.yaml - AWX deployment config for Beelink lab
+#
+# Deploys a Debian 12 VM with K3s + AWX Operator on oc-node-02.
+# VM uses the flat VLAN 69 network for direct access.
+#
+# Architecture:
+#   awx  (192.168.102.161)  - K3s + AWX Operator + AWX instance
+#   AWX exposed on NodePort 30080 (HTTP)
+#
+# Usage:
+#   source envs/beelink/env
+#   bin/deploy-awx --config envs/beelink/awx.yaml --deploy
+
+awx:
+  vm_name: awx
+  target_remote: oc-node-02
+  ip: 192.168.102.161/22
+  gateway: 192.168.100.1
+  dns: 192.168.100.1
+  cpu: 4
+  memory: 8GiB
+  disk: 40GiB
+  git_repo: ssh://git@192.168.1.200:2222/maarten/incus-contrib.git
+  git_branch: master
+  aether_url: https://192.168.102.160:8443
+  aether_cluster_id: 52

envs/beelink/haproxy.yaml

@@ -0,0 +1,26 @@
+# haproxy.yaml - HAProxy load balancing config for Beelink lab
+#
+# Deploys 2 HAProxy containers on the OVN overlay (net-prod, 10.10.10.0/24)
+# with a VIP on the UPLINK external range (192.168.103.200).
+#
+# Architecture:
+#   ffsdn-haproxy-52-01  (10.10.10.50)  - HAProxy instance 1 on net-prod
+#   ffsdn-haproxy-52-02  (10.10.10.51)  - HAProxy instance 2 on net-prod
+#   nginx-lb-01/02/03    (10.10.10.60-62) - nginx test backends on net-prod
+#   VIP:                  192.168.103.200:80  - OVN LB for external access
+#
+# Usage:
+#   source envs/beelink/env
+#   bin/deploy-haproxy --config envs/beelink/haproxy.yaml --deploy
+
+haproxy:
+  cluster_remote: oc-node-01
+  cluster_id: 52
+  ovn_network: net-prod
+  vip: 192.168.103.200
+  haproxy_01_ip: 10.10.10.50
+  haproxy_02_ip: 10.10.10.51
+  backend_ips: 10.10.10.60,10.10.10.61,10.10.10.62
+  service_name: web-test
+  image_version: "1.0.0"
+  aether_url: https://192.168.102.160:8443

envs/beelink/lab-cluster.yaml

@@ -4,8 +4,8 @@
 # Deploys 3 standalone Incus nodes that can be clustered after deployment.
 #
 # Usage:
-#   incusos-proxmox --proxmox incusos/targets/beelink/proxmox.yaml \
+#   bin/incusos-proxmox --proxmox envs/beelink/proxmox.yaml \
-#                   incusos/targets/beelink/lab-cluster.yaml
+#                       envs/beelink/lab-cluster.yaml
 #
 # Connection settings from proxmox.yaml in this directory.
 

envs/beelink/observability.yaml

@@ -0,0 +1,25 @@
+# observability.yaml - Monitoring stack config for Beelink lab
+#
+# Deploys Prometheus, Grafana, Loki, and Promtail in a monitoring container,
+# plus node-exporter containers on each cluster node.
+#
+# Architecture:
+#   monitoring      (10.10.10.70)     - Prometheus + Grafana + Loki
+#   node-exp-01/02/03                 - node-exporter on each cluster node
+#   Forward VIP:    192.168.103.201   - OVN LB for external access
+#
+# Usage:
+#   source envs/beelink/env
+#   bin/deploy-observability --config envs/beelink/observability.yaml --deploy
+
+observability:
+  cluster_remote: oc-node-01
+  ovn_network: net-prod
+  monitoring_ip: 10.10.10.70
+  monitoring_target: oc-node-02
+  forward_vip: 192.168.103.201
+  incus_nodes: 192.168.102.140,192.168.102.141,192.168.102.142
+  node_exp_targets: oc-node-01,oc-node-02,oc-node-03
+  node_exp_ips: 10.10.10.71,10.10.10.72,10.10.10.73
+  haproxy_ips: 10.10.10.50,10.10.10.51
+  haproxy_cluster_id: 52

envs/hetzner/awx.yaml

@@ -8,10 +8,8 @@
 #   AWX exposed on NodePort 30080 (HTTP)
 #
 # Usage:
-#   source env
+#   source envs/hetzner/env
-#   ./incusos/deploy-awx \
+#   bin/deploy-awx --config envs/hetzner/awx.yaml --deploy
-#     --config incusos/targets/hetzner/awx.yaml \
-#     --deploy
 
 awx:
   vm_name: awx

envs/hetzner/haproxy.yaml

@@ -10,10 +10,8 @@
 #   VIP:                  10.10.0.200:80  - OVN external IP for external access
 #
 # Usage:
-#   source env
+#   source envs/hetzner/env
-#   ./incusos/deploy-haproxy \
+#   bin/deploy-haproxy --config envs/hetzner/haproxy.yaml --deploy
-#     --config incusos/targets/hetzner/haproxy.yaml \
-#     --deploy
 
 haproxy:
   cluster_remote: hz-cluster

envs/hetzner/lab-cluster.yaml

@@ -7,8 +7,8 @@
 # VMs get static IPs in the 10.10.0.101-103 range.
 #
 # Usage:
-#   incusos-proxmox --proxmox incusos/targets/hetzner/proxmox.yaml \
+#   bin/incusos-proxmox --proxmox envs/hetzner/proxmox.yaml \
-#                   incusos/targets/hetzner/lab-cluster.yaml
+#                       envs/hetzner/lab-cluster.yaml
 #
 # Connection settings from proxmox.yaml in this directory.
 

envs/hetzner/lab-production.yaml

@@ -15,8 +15,8 @@
 # RAM budget: ~248 GiB of 256 GiB (8 GiB OC + 3×80 GiB nodes; ~8 GiB reserved for Proxmox host)
 #
 # Usage:
-#   incusos-proxmox --proxmox incusos/targets/hetzner/proxmox.yaml \
+#   bin/incusos-proxmox --proxmox envs/hetzner/proxmox.yaml \
-#                   incusos/targets/hetzner/lab-production.yaml
+#                       envs/hetzner/lab-production.yaml
 #
 # After deployment, follow notes/production-lab-guide.md for:
 #   - Cluster formation (section 4)

envs/hetzner/observability.yaml

@@ -0,0 +1,25 @@
+# observability.yaml - Monitoring stack config for Hetzner lab
+#
+# Deploys Prometheus, Grafana, Loki, and Promtail in a monitoring container,
+# plus node-exporter containers on each cluster node.
+#
+# Architecture:
+#   monitoring      (10.10.10.70)     - Prometheus + Grafana + Loki
+#   node-exp-01/02/03                 - node-exporter on each cluster node
+#   Forward VIP:    10.10.0.201       - OVN LB for external access
+#
+# Usage:
+#   source envs/hetzner/env
+#   bin/deploy-observability --config envs/hetzner/observability.yaml --deploy
+
+observability:
+  cluster_remote: hz-cluster
+  ovn_network: net-prod
+  monitoring_ip: 10.10.10.70
+  monitoring_target: hz-node-02
+  forward_vip: 10.10.0.201
+  incus_nodes: 10.10.0.111,10.10.0.112,10.10.0.113
+  node_exp_targets: hz-node-01,hz-node-02,hz-node-03
+  node_exp_ips: 10.10.10.71,10.10.10.72,10.10.10.73
+  haproxy_ips: 10.10.10.50,10.10.10.51
+  haproxy_cluster_id: 52