Host glue for srviac, the homelab's IaC orchestrator VM. See AnsibleSpecs/phases/iac-agent.md for the design.

The Jenkins pipelines that drive srviac now live in the Ansible repo as Jenkinsfile.* (they were moved out of this repo); the controller jobs check them out from there and run on the iac-controller-labelled agent, holding the IaC mutex via iac -c. They lean on this repo's helpers — check-protected-vms.sh, check-ansible-drift.sh, send_message.py — which iac bind-mounts into the container. Current jobs:

• Jenkinsfile.iac-on-push — push to main on pvginkel/Ansible: terraform plan/destroy-check + apply, then Ansible convergence across the site*.yml playbooks.
• Jenkinsfile.iac-scheduled-update — weekly cron: OS-update / patch posture (drain → upgrade → reboot).
• Jenkinsfile.iac-scheduled-drift — daily cron: terraform + Ansible --check drift across the same playbooks, plus the homelab CA root.
• Jenkinsfile.iac-dqlite-watchdog, Jenkinsfile.iac-image, Jenkinsfile.architecture — the k8s-dqlite watch-cache watchdog, the iac container-image build, and the architecture-model job.

The Ansible repo holds the authoritative per-stage breakdown for each.

iac                              # interactive bash inside the container
iac -c '<shell script>'          # run the script inside the container
iac -v -c '<shell script>'       # same, with iac-impl's setup-progress prints

Both hold /var/lock/iac.lock via flock -w 60. One call = one lock — compose multi-step work into a single iac -c '…' rather than chaining calls.

Inside the container ansible-playbook and friends are on $PATH directly — iac-impl runs poetry install and resolves the venv via poetry env info --path, so callers don't need poetry run.

Inside the container, iac-impl (bind-mounted in from this repo's bin/iac-impl):

1. Parses /etc/iac/secrets.yaml — exports env: entries; writes files: entries at their declared mode.
2. Clones pvginkel/Ansible into /work/.
3. Starts the terraform-backend-git daemon on 127.0.0.1:6061; terraform reaches state via the backend.tf http block in terraform/{prd,scratch}/. The daemon does the git pull/push against pvginkel/TerraformState itself and encrypts state at rest with sops + age.
4. Runs poetry install --no-root in /work/Ansible/ansible/ so ansible-playbook is on $PATH.
5. Exec's bash (interactive) or sh -c "$SCRIPT" (the -c form).

The same install.sh runs on wrkdev if you want iac parity there — useful for SSH-less local testing. The workstation isn't required to be a parity host; routine usage runs on srviac and break-glass uses terraform / ansible-playbook directly on wrkdev.