Update Proxmox provider configuration examples for improved clarity and security

- Revised provider-config-template.yaml and provider-config.yaml to reflect updated site names and endpoints for better alignment with VM specifications.
- Enhanced documentation regarding authentication methods, emphasizing the use of token-based authentication for production environments.
- Updated namespace references to ensure consistency across configuration files.

docs/proxmox/PROXMOX_BASE_CONFIGURATION_REVIEW.md

@@ -0,0 +1,313 @@
+# Proxmox Base Configuration Review
+
+**Date**: 2025-01-XX  
+**Status**: ⚠️ **CONFIGURATION MISMATCH DETECTED**
+
+---
+
+## Executive Summary
+
+Review of Proxmox base configurations reveals a **critical mismatch** between site names used in VM specifications and the provider configuration. This must be fixed before deployment.
+
+---
+
+## Configuration Issues Found
+
+### ⚠️ Issue 1: Site Name Mismatch
+
+**Problem**: VM specifications use `site-1` and `site-2`, but provider config uses `us-sfvalley`.
+
+**Current State**:
+- **VM Files**: Use `site: "site-1"` and `site: "site-2"`
+- **Provider Config**: Uses `name: us-sfvalley` (only site-1 configured)
+- **Impact**: VMs referencing `site-2` will fail to deploy
+
+**Files Affected**:
+- `crossplane-provider-proxmox/examples/provider-config.yaml`
+- All VM files in `examples/production/` (30 files)
+
+---
+
+## Current Provider Configuration
+
+### File: `crossplane-provider-proxmox/examples/provider-config.yaml`
+
+**Current Configuration**:
+```yaml
+sites:
+  - name: us-sfvalley
+    endpoint: "https://192.168.11.10:8006"
+    node: "ml110-01"
+    insecureSkipTLSVerify: true
+  # Site 2 is commented out!
+  # - name: us-sfvalley-2
+  #   endpoint: "https://192.168.11.11:8006"
+  #   node: "r630-01"
+  #   insecureSkipTLSVerify: true
+```
+
+**Issues**:
+1. ❌ Site name `us-sfvalley` doesn't match VM specs (`site-1`)
+2. ❌ Site 2 is commented out (22 VMs need this!)
+3. ❌ Site 2 name `us-sfvalley-2` doesn't match VM specs (`site-2`)
+
+---
+
+## Required Configuration
+
+### Corrected Provider Configuration
+
+The provider config must define both sites with names matching the VM specifications:
+
+```yaml
+sites:
+  - name: site-1
+    endpoint: "https://192.168.11.10:8006"
+    node: "ml110-01"
+    insecureSkipTLSVerify: true
+  - name: site-2
+    endpoint: "https://192.168.11.11:8006"
+    node: "r630-01"
+    insecureSkipTLSVerify: true
+```
+
+---
+
+## Site Configuration Details
+
+### Site-1 (ML110-01)
+
+**Configuration**:
+- **Name**: `site-1` (must match VM specs)
+- **Endpoint**: `https://192.168.11.10:8006`
+- **Node**: `ml110-01`
+- **IP Address**: 192.168.11.10
+- **Hardware**: 6 CPU cores, 256 GB RAM
+- **VMs**: 4 production VMs (8 CPU cores total)
+
+**VMs on Site-1**:
+- nginx-proxy-vm
+- phoenix-dns-primary
+- smom-sentry-01
+- smom-sentry-02
+
+### Site-2 (R630-01)
+
+**Configuration**:
+- **Name**: `site-2` (must match VM specs)
+- **Endpoint**: `https://192.168.11.11:8006`
+- **Node**: `r630-01`
+- **IP Address**: 192.168.11.11
+- **Hardware**: 52 CPU cores, 768 GB RAM
+- **VMs**: 22 production VMs (54 CPU cores total)
+
+**VMs on Site-2**:
+- cloudflare-tunnel-vm
+- All Phoenix Infrastructure VMs (7 VMs)
+- All Blockchain Validators (4 VMs)
+- Blockchain Sentries (2 VMs)
+- Blockchain RPC Nodes (4 VMs)
+- Blockchain Services (4 VMs)
+
+---
+
+## Provider Configuration Files
+
+### 1. Main Provider Config
+
+**File**: `crossplane-provider-proxmox/examples/provider-config.yaml`
+
+**Status**: ⚠️ **NEEDS UPDATE**
+
+**Required Changes**:
+1. Change site name from `us-sfvalley` to `site-1`
+2. Uncomment and configure site-2
+3. Change site-2 name from `us-sfvalley-2` to `site-2`
+4. Update namespace to `crossplane-system` (recommended)
+
+### 2. Provider Config Template
+
+**File**: `crossplane-provider-proxmox/examples/provider-config-template.yaml`
+
+**Status**: ⚠️ **NEEDS UPDATE**
+
+**Current State**:
+- Uses `us-sfvalley` and `us-sfvalley-2`
+- Has more detailed structure with nodes/storage/networks
+- Uses different endpoint format (hostnames vs IPs)
+
+**Required Changes**:
+1. Update site names to `site-1` and `site-2`
+2. Ensure endpoints match actual Proxmox nodes
+3. Verify node names match (ml110-01, r630-01)
+
+---
+
+## Network Configuration
+
+### Proxmox API Endpoints
+
+**Site-1 (ML110-01)**:
+- **IP**: 192.168.11.10
+- **Port**: 8006 (HTTPS)
+- **Endpoint**: `https://192.168.11.10:8006`
+- **Alternative**: `https://ml110-01.sankofa.nexus:8006` (if DNS configured)
+
+**Site-2 (R630-01)**:
+- **IP**: 192.168.11.11
+- **Port**: 8006 (HTTPS)
+- **Endpoint**: `https://192.168.11.11:8006`
+- **Alternative**: `https://r630-01.sankofa.nexus:8006` (if DNS configured)
+
+### Network Bridge
+
+**Both Sites**:
+- **Bridge**: `vmbr0`
+- **Network**: 192.168.11.0/24
+- **Gateway**: Configured per site
+
+---
+
+## Storage Configuration
+
+### Site-1 (ML110-01)
+
+**Storage Pools**:
+- **local-lvm**: 794.3 GB available
+- **ceph-fs**: 384 GB available
+
+**Usage**:
+- All VMs on ML110-01 use `local-lvm` (small disks)
+
+### Site-2 (R630-01)
+
+**Storage Pools**:
+- **local-lvm**: 171.3 GB available
+- **Ceph OSD**: Configured
+- **ceph-fs**: Available (distributed storage)
+
+**Usage**:
+- Small disks (Cloudflare Tunnel): `local-lvm`
+- Large disks (all other VMs): `ceph-fs`
+
+---
+
+## Credentials Configuration
+
+### Secret Configuration
+
+**File**: `crossplane-provider-proxmox/examples/provider-config.yaml`
+
+**Current**:
+```yaml
+apiVersion: v1
+kind: Secret
+metadata:
+  name: proxmox-credentials
+  namespace: default
+type: Opaque
+stringData:
+  username: "root@pam"
+  password: "YOUR_PROXMOX_PASSWORD_HERE"
+```
+
+**Recommendations**:
+1. ✅ Use `crossplane-system` namespace (more secure)
+2. ✅ Use API tokens instead of passwords (recommended)
+3. ✅ Store credentials securely (not in git)
+4. ⚠️ Update password before deployment
+
+### Token-Based Authentication (Recommended)
+
+```yaml
+stringData:
+  tokenid: "root@pam!api-token-name"
+  token: "your-api-token-secret"
+```
+
+---
+
+## TLS Configuration
+
+### Current Setting
+
+**Both Sites**: `insecureSkipTLSVerify: true`
+
+**Security Considerations**:
+- ⚠️ **Development/Testing**: Acceptable
+- ❌ **Production**: Should be `false` with proper certificates
+- ✅ **Recommendation**: Use proper TLS certificates in production
+
+---
+
+## Provider Deployment Configuration
+
+### File: `crossplane-provider-proxmox/config/provider.yaml`
+
+**Status**: ✅ **CORRECT**
+
+**Configuration**:
+- Namespace: `crossplane-system`
+- ServiceAccount: `crossplane-provider-proxmox`
+- RBAC: Properly configured
+- Resource limits: 500m CPU, 512Mi memory
+- Health probes: Configured
+
+---
+
+## Action Items
+
+### Critical (Must Fix Before Deployment)
+
+1. ⚠️ **Update Provider Config Site Names**
+   - Change `us-sfvalley` → `site-1`
+   - Add `site-2` configuration
+   - Ensure endpoints are correct
+
+2. ⚠️ **Update Provider Config Template**
+   - Align site names with VM specifications
+   - Verify endpoint formats
+
+3. ⚠️ **Update Credentials**
+   - Replace placeholder password
+   - Consider using API tokens
+   - Move to `crossplane-system` namespace
+
+### Recommended (Before Production)
+
+4. ✅ **TLS Configuration**
+   - Set `insecureSkipTLSVerify: false` for production
+   - Configure proper TLS certificates
+
+5. ✅ **Documentation**
+   - Document credential management process
+   - Create deployment checklist
+
+---
+
+## Verification Checklist
+
+### Before Deployment
+
+- [ ] Provider config has `site-1` defined
+- [ ] Provider config has `site-2` defined
+- [ ] Site names match VM specifications exactly
+- [ ] Endpoints are correct (IP addresses or hostnames)
+- [ ] Node names match (`ml110-01`, `r630-01`)
+- [ ] Credentials are configured (not placeholders)
+- [ ] Secret namespace is appropriate
+- [ ] TLS settings are appropriate for environment
+
+---
+
+## Related Documentation
+
+- [VM Deployment Plan](../vm/VM_DEPLOYMENT_PLAN.md) - Deployment strategy
+- [VM Configuration Status](../vm/VM_CONFIGURATION_STATUS.md) - VM configuration status
+- [Provider README](../../crossplane-provider-proxmox/README.md) - Provider documentation
+
+---
+
+**Last Updated**: 2025-01-XX  
+**Status**: ⚠️ **REQUIRES UPDATES BEFORE DEPLOYMENT**
+