feat(terraform): add per-node Cloudflare Tunnel cert SANs to controlplane certSANs — remote talosctl/kubectl over tunnel pass TLS verification

Adds optional cloudflare_talos_sans (machine.certSANs, talos API :50000) and
cloudflare_apiserver_sans (cluster.apiServer.certSANs, kube-apiserver :6443) per
control-plane node. cp-1 gets cp1.homelab + cp1-talos.homelab; cp-2/cp-3 get
their cpN-talos.homelab. Values set in gitignored tfvars.

terraform/main.tf

@@ -51,6 +51,10 @@ resource "local_file" "controlplane_configs" {
     zone                = each.value.zone
     allow_scheduling    = each.value.allow_scheduling
 
+    # Cloudflare Tunnel cert SANs (talos :50000 and kube-apiserver :6443)
+    cloudflare_talos_sans     = each.value.cloudflare_talos_sans
+    cloudflare_apiserver_sans = each.value.cloudflare_apiserver_sans
+
     # Cluster config
     cluster_id      = var.cluster_id
     cluster_secret  = var.cluster_secret

terraform/templates/controlplane.tftpl

@@ -13,6 +13,9 @@ machine:
 %{ if wg0_ip != null ~}
     - ${wg0_ip}
 %{ endif ~}
+%{ for san in cloudflare_talos_sans ~}
+    - ${san}
+%{ endfor ~}
   network:
     hostname: ${hostname}
     interfaces:
@@ -145,6 +148,9 @@ cluster:
       - ${wg0_ip}
 %{ endif ~}
       - ${lan_ip}
+%{ for san in cloudflare_apiserver_sans ~}
+      - ${san}
+%{ endfor ~}
     image: ${kube_apiserver_img}
     admissionControl:
       - name: PodSecurity

terraform/variables.tf

@@ -130,6 +130,10 @@ variable "controlplane_configs" {
     }))
     zone             = string
     allow_scheduling = bool
+    # Extra cert SANs for this node — e.g. Cloudflare Tunnel public hostnames so
+    # remote talosctl/kubectl over the tunnel pass TLS verification.
+    cloudflare_talos_sans     = optional(list(string), [])
+    cloudflare_apiserver_sans = optional(list(string), [])
   }))
   description = "Control plane machine configurations, keyed by node"
 }