Apply Composer changes: comprehensive API updates, migrations, middleware, and infrastructure improvements

- Add comprehensive database migrations (001-024) for schema evolution
- Enhance API schema with expanded type definitions and resolvers
- Add new middleware: audit logging, rate limiting, MFA enforcement, security, tenant auth
- Implement new services: AI optimization, billing, blockchain, compliance, marketplace
- Add adapter layer for cloud integrations (Cloudflare, Kubernetes, Proxmox, storage)
- Update Crossplane provider with enhanced VM management capabilities
- Add comprehensive test suite for API endpoints and services
- Update frontend components with improved GraphQL subscriptions and real-time updates
- Enhance security configurations and headers (CSP, CORS, etc.)
- Update documentation and configuration files
- Add new CI/CD workflows and validation scripts
- Implement design system improvements and UI enhancements

examples/production/phoenix/as4-gateway.yaml

@@ -0,0 +1,288 @@
+apiVersion: proxmox.sankofa.nexus/v1alpha1
+kind: ProxmoxVM
+metadata:
+  name: phoenix-as4-gateway
+  namespace: default
+  labels:
+    tenant.sankofa.nexus/id: "infrastructure"
+    environment: "production"
+    app: "phoenix"
+    component: "as4-gateway"
+    service: "b2b"
+spec:
+  forProvider:
+    node: "ml110-01"
+    name: "phoenix-as4-gateway"
+    cpu: 8
+    memory: "16Gi"
+    disk: "500Gi"
+    storage: "local-lvm"
+    network: "vmbr0"
+    image: "local:iso/ubuntu-22.04-cloud.img"
+    site: "site-1"
+    userData: |
+      #cloud-config
+      # Package management
+      package_update: true
+      package_upgrade: true
+
+      # Time synchronization (NTP)
+      ntp:
+        enabled: true
+        ntp_client: chrony
+        servers:
+          - 0.pool.ntp.org
+          - 1.pool.ntp.org
+          - 2.pool.ntp.org
+          - 3.pool.ntp.org
+      
+      
+      # Required packages
+      packages:
+        - qemu-guest-agent
+        - curl
+        - wget
+        - net-tools
+        - apt-transport-https
+        - ca-certificates
+        - gnupg
+        - lsb-release
+        - chrony
+        - unattended-upgrades
+        - apt-listchanges
+        # AS4 gateway packages
+        - docker.io
+        - docker-compose
+        - openjdk-11-jdk
+        - openssl
+        - xmlsec1
+        - libxml2-utils
+        - postgresql
+        - postgresql-contrib
+        - nginx
+        - certbot
+        - python3-certbot-nginx
+        - ufw
+      
+      # User configuration
+      users:
+        - name: admin
+          groups: sudo, docker
+          shell: /bin/bash
+          sudo: ALL=(ALL) NOPASSWD:ALL
+          lock_passwd: false
+          ssh_authorized_keys:
+            - ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDbGtLMmN6px4J2QUYk0BjnNT2wytgiTLSDzL+AwhE6qQWbL+h8AeFET2CHeEf09m5KYLAbHkYTq5aUleuXsluPer9A5moPD1UfdSVLpyyIv8OvKU4mnabk4z31yenPD7Wn1hKd3WoZs2ZflFIvzXaVGBoQXFlWztWLO1fh6CXmppf731FMcTMr4x7uxd8dkG4B400a1xWFx7H4e/u33KDUApqimTrwPTfooRLuyyKV7FWpopSvbSl0ANkZsuyrjbQRR3uD66iQaI60sZArTjhjwnJz+VCOnmJhlGmfMMwov4SOemt+Ut3x0Z6CwagjvxbpGf4hoI9coYD89IFzYwXVUyB9CyvlxEyPTX3v8QwIEZtWWPDStAHTkwZ80z+LU/pvP12Su32D4Wu+ziDkONVpxh1Qh6tV+jvuA9oSKno9jLa4FO0ZTs4bPkww8AbglH3h+dV7zd7qtwwW1oeSw5GHaOq/NetfpvPVuYkOe0IxVvlODZ/d6vAjCBZ0fRgtsEuZvmCVrxwGzZEHWLeAF9G/XD+wpaA5OonceeuhF6K4H12TC3AH6ycUPIBdYOeD2askutLprLmukj8xAC5mRW4ehCnXmwjABrhLSJb7A326q6t8EO2+3u12vvMQt7xKi+aY0+wGZXSvHfiabp93OMuf3WL80A8+5NaRtby44fY6bw== defi@defi-oracle.io
+      
+      # Boot commands - executed in order
+      runcmd:
+        # Verify packages are installed
+        - |
+          echo "=========================================="
+          echo "Verifying required packages are installed..."
+          echo "=========================================="
+          for pkg in qemu-guest-agent curl wget net-tools chrony unattended-upgrades; do
+            if ! dpkg -l | grep -q "^ii.*$pkg"; then
+              echo "ERROR: Package $pkg is not installed"
+              exit 1
+            fi
+            echo "✅ Package $pkg is installed"
+          done
+          echo "All required packages verified"
+        
+        # Verify qemu-guest-agent package details
+        - |
+          echo "=========================================="
+          echo "Checking qemu-guest-agent package details..."
+          echo "=========================================="
+          if dpkg -l | grep -q "^ii.*qemu-guest-agent"; then
+            echo "✅ qemu-guest-agent package IS installed"
+            dpkg -l | grep qemu-guest-agent
+          else
+            echo "❌ qemu-guest-agent package is NOT installed"
+            echo "Attempting to install..."
+            apt-get update
+            apt-get install -y qemu-guest-agent
+          fi
+        
+        # Enable and start QEMU Guest Agent
+        - |
+          echo "=========================================="
+          echo "Enabling and starting QEMU Guest Agent..."
+          echo "=========================================="
+          systemctl enable qemu-guest-agent
+          systemctl start qemu-guest-agent
+          echo "QEMU Guest Agent enabled and started"
+        
+        # Verify guest agent service is running
+        - |
+          echo "=========================================="
+          echo "Verifying QEMU Guest Agent service status..."
+          echo "=========================================="
+          for i in {1..30}; do
+            if systemctl is-active --quiet qemu-guest-agent; then
+              echo "✅ QEMU Guest Agent service IS running"
+              systemctl status qemu-guest-agent --no-pager -l
+              exit 0
+            fi
+            echo "Waiting for QEMU Guest Agent to start... ($i/30)"
+            sleep 1
+          done
+          echo "⚠️  WARNING: QEMU Guest Agent may not have started properly"
+          systemctl status qemu-guest-agent --no-pager -l || true
+          echo "Attempting to restart..."
+          systemctl restart qemu-guest-agent
+          sleep 3
+          if systemctl is-active --quiet qemu-guest-agent; then
+            echo "✅ QEMU Guest Agent started after restart"
+          else
+            echo "❌ QEMU Guest Agent failed to start"
+          fi
+        
+        # Configure Docker
+        - systemctl enable docker
+        - systemctl start docker
+        
+        # Configure PostgreSQL
+        - systemctl enable postgresql
+        - systemctl start postgresql
+        
+        # Create AS4 gateway directories
+        - |
+          mkdir -p /opt/as4-gateway/{config,data,certificates,logs,archives}
+          mkdir -p /opt/as4-gateway/trading-partners
+          chown -R admin:admin /opt/as4-gateway
+        
+        # Create PostgreSQL database for AS4 gateway
+        - |
+          sudo -u postgres psql <<EOF
+          CREATE DATABASE as4_gateway;
+          CREATE USER as4_user WITH PASSWORD 'CHANGE_ME_ON_FIRST_LOGIN';
+          GRANT ALL PRIVILEGES ON DATABASE as4_gateway TO as4_user;
+          EOF
+        
+        # Configure Nginx reverse proxy
+        - |
+          cat > /etc/nginx/sites-available/as4-gateway <<EOF
+          server {
+              listen 80;
+              server_name as4.sankofa.nexus;
+              
+              location / {
+                  proxy_pass http://127.0.0.1:8080;
+                  proxy_http_version 1.1;
+                  proxy_set_header Upgrade \$http_upgrade;
+                  proxy_set_header Connection "upgrade";
+                  proxy_set_header Host \$host;
+                  proxy_set_header X-Real-IP \$remote_addr;
+                  proxy_set_header X-Forwarded-For \$proxy_add_x_forwarded_for;
+                  proxy_set_header X-Forwarded-Proto \$scheme;
+              }
+          }
+          EOF
+          ln -sf /etc/nginx/sites-available/as4-gateway /etc/nginx/sites-enabled/
+          rm -f /etc/nginx/sites-enabled/default
+        
+        # Configure UFW firewall
+        - ufw allow 22/tcp    # SSH
+        - ufw allow 80/tcp    # HTTP
+        - ufw allow 443/tcp   # HTTPS
+        - ufw allow 8080/tcp  # AS4 Gateway (direct access)
+        - ufw --force enable
+        
+        # Enable and start services
+        - systemctl enable nginx
+        - systemctl restart nginx
+        
+        # Create AS4 gateway configuration template
+        - |
+          cat > /opt/as4-gateway/config/as4-config-template.xml <<EOF
+          <?xml version="1.0" encoding="UTF-8"?>
+          <as4-config>
+              <server>
+                  <port>8080</port>
+                  <keystore>/opt/as4-gateway/certificates/keystore.jks</keystore>
+                  <truststore>/opt/as4-gateway/certificates/truststore.jks</truststore>
+              </server>
+              <database>
+                  <url>jdbc:postgresql://localhost:5432/as4_gateway</url>
+                  <username>as4_user</username>
+                  <password>CHANGE_ME_ON_FIRST_LOGIN</password>
+              </database>
+              <messaging>
+                  <reliability>true</reliability>
+                  <security>true</security>
+                  <signing>true</signing>
+                  <encryption>true</encryption>
+              </messaging>
+          </as4-config>
+          EOF
+          chown admin:admin /opt/as4-gateway/config/as4-config-template.xml
+      
+      # Configure automatic security updates
+        - |
+          echo "Configuring automatic security updates..."
+          cat > /etc/apt/apt.conf.d/50unattended-upgrades <<'EOF'
+          Unattended-Upgrade::Allowed-Origins {
+              "${distro_id}:${distro_codename}-security";
+              "${distro_id}ESMApps:${distro_codename}-apps-security";
+              "${distro_id}ESM:${distro_codename}-infra-security";
+          };
+          Unattended-Upgrade::AutoFixInterruptedDpkg "true";
+          Unattended-Upgrade::MinimalSteps "true";
+          Unattended-Upgrade::Remove-Unused-Kernel-Packages "true";
+          Unattended-Upgrade::Remove-Unused-Dependencies "true";
+          Unattended-Upgrade::Automatic-Reboot "false";
+          Unattended-Upgrade::Automatic-Reboot-Time "02:00";
+          EOF
+          systemctl enable unattended-upgrades
+          systemctl start unattended-upgrades
+          echo "Automatic security updates configured"
+        
+        # Configure NTP (Chrony)
+        - |
+          echo "Configuring NTP (Chrony)..."
+          systemctl enable chrony
+          systemctl restart chrony
+          sleep 3
+          if systemctl is-active --quiet chrony; then
+            echo "NTP (Chrony) is running"
+            chronyc tracking | head -1 || true
+          else
+            echo "WARNING: NTP (Chrony) may not be running"
+          fi
+        
+        # SSH hardening
+        - |
+          echo "Hardening SSH configuration..."
+          if ! grep -q "^PermitRootLogin no" /etc/ssh/sshd_config; then
+            sed -i 's/^#PermitRootLogin.*/PermitRootLogin no/' /etc/ssh/sshd_config
+            sed -i 's/^PermitRootLogin yes/PermitRootLogin no/' /etc/ssh/sshd_config
+          fi
+          if ! grep -q "^PasswordAuthentication no" /etc/ssh/sshd_config; then
+            sed -i 's/^#PasswordAuthentication.*/PasswordAuthentication no/' /etc/ssh/sshd_config
+            sed -i 's/^PasswordAuthentication yes/PasswordAuthentication no/' /etc/ssh/sshd_config
+          fi
+          if ! grep -q "^PubkeyAuthentication yes" /etc/ssh/sshd_config; then
+            sed -i 's/^#PubkeyAuthentication.*/PubkeyAuthentication yes/' /etc/ssh/sshd_config
+          fi
+          systemctl restart sshd
+          echo "SSH hardening completed
+      
+# Write files for security configuration
+      write_files:
+        - path: /etc/apt/apt.conf.d/20auto-upgrades
+          content: |
+            APT::Periodic::Update-Package-Lists "1";
+            APT::Periodic::Download-Upgradeable-Packages "1";
+            APT::Periodic::AutocleanInterval "7";
+            APT::Periodic::Unattended-Upgrade "1";
+          permissions: '0644'
+          owner: root:root
+      
+# Final message
+      final_message: |
+        ==========================================
+  providerConfigRef:
+    name: proxmox-provider-config
+

examples/production/phoenix/business-integration-gateway.yaml

@@ -0,0 +1,318 @@
+apiVersion: proxmox.sankofa.nexus/v1alpha1
+kind: ProxmoxVM
+metadata:
+  name: phoenix-business-integration-gateway
+  namespace: default
+  labels:
+    tenant.sankofa.nexus/id: "infrastructure"
+    environment: "production"
+    app: "phoenix"
+    component: "integration"
+    service: "workflow"
+spec:
+  forProvider:
+    node: "ml110-01"
+    name: "phoenix-business-integration-gateway"
+    cpu: 8
+    memory: "16Gi"
+    disk: "200Gi"
+    storage: "local-lvm"
+    network: "vmbr0"
+    image: "local:iso/ubuntu-22.04-cloud.img"
+    site: "site-1"
+    userData: |
+      #cloud-config
+      # Package management
+      package_update: true
+      package_upgrade: true
+
+      # Time synchronization (NTP)
+      ntp:
+        enabled: true
+        ntp_client: chrony
+        servers:
+          - 0.pool.ntp.org
+          - 1.pool.ntp.org
+          - 2.pool.ntp.org
+          - 3.pool.ntp.org
+      
+      
+      # Required packages
+      packages:
+        - qemu-guest-agent
+        - curl
+        - wget
+        - net-tools
+        - apt-transport-https
+        - ca-certificates
+        - gnupg
+        - lsb-release
+        - chrony
+        - unattended-upgrades
+        - apt-listchanges
+        # Integration gateway packages
+        - docker.io
+        - docker-compose
+        - nodejs
+        - npm
+        - python3
+        - python3-pip
+        - postgresql
+        - postgresql-contrib
+        - redis-server
+        - nginx
+        - certbot
+        - python3-certbot-nginx
+        - ufw
+        - jq
+      
+      # User configuration
+      users:
+        - name: admin
+          groups: sudo, docker
+          shell: /bin/bash
+          sudo: ALL=(ALL) NOPASSWD:ALL
+          lock_passwd: false
+          ssh_authorized_keys:
+            - ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDbGtLMmN6px4J2QUYk0BjnNT2wytgiTLSDzL+AwhE6qQWbL+h8AeFET2CHeEf09m5KYLAbHkYTq5aUleuXsluPer9A5moPD1UfdSVLpyyIv8OvKU4mnabk4z31yenPD7Wn1hKd3WoZs2ZflFIvzXaVGBoQXFlWztWLO1fh6CXmppf731FMcTMr4x7uxd8dkG4B400a1xWFx7H4e/u33KDUApqimTrwPTfooRLuyyKV7FWpopSvbSl0ANkZsuyrjbQRR3uD66iQaI60sZArTjhjwnJz+VCOnmJhlGmfMMwov4SOemt+Ut3x0Z6CwagjvxbpGf4hoI9coYD89IFzYwXVUyB9CyvlxEyPTX3v8QwIEZtWWPDStAHTkwZ80z+LU/pvP12Su32D4Wu+ziDkONVpxh1Qh6tV+jvuA9oSKno9jLa4FO0ZTs4bPkww8AbglH3h+dV7zd7qtwwW1oeSw5GHaOq/NetfpvPVuYkOe0IxVvlODZ/d6vAjCBZ0fRgtsEuZvmCVrxwGzZEHWLeAF9G/XD+wpaA5OonceeuhF6K4H12TC3AH6ycUPIBdYOeD2askutLprLmukj8xAC5mRW4ehCnXmwjABrhLSJb7A326q6t8EO2+3u12vvMQt7xKi+aY0+wGZXSvHfiabp93OMuf3WL80A8+5NaRtby44fY6bw== defi@defi-oracle.io
+      
+      # Boot commands - executed in order
+      runcmd:
+        # Verify packages are installed
+        - |
+          echo "=========================================="
+          echo "Verifying required packages are installed..."
+          echo "=========================================="
+          for pkg in qemu-guest-agent curl wget net-tools chrony unattended-upgrades; do
+            if ! dpkg -l | grep -q "^ii.*$pkg"; then
+              echo "ERROR: Package $pkg is not installed"
+              exit 1
+            fi
+            echo "✅ Package $pkg is installed"
+          done
+          echo "All required packages verified"
+        
+        # Verify qemu-guest-agent package details
+        - |
+          echo "=========================================="
+          echo "Checking qemu-guest-agent package details..."
+          echo "=========================================="
+          if dpkg -l | grep -q "^ii.*qemu-guest-agent"; then
+            echo "✅ qemu-guest-agent package IS installed"
+            dpkg -l | grep qemu-guest-agent
+          else
+            echo "❌ qemu-guest-agent package is NOT installed"
+            echo "Attempting to install..."
+            apt-get update
+            apt-get install -y qemu-guest-agent
+          fi
+        
+        # Enable and start QEMU Guest Agent
+        - |
+          echo "=========================================="
+          echo "Enabling and starting QEMU Guest Agent..."
+          echo "=========================================="
+          systemctl enable qemu-guest-agent
+          systemctl start qemu-guest-agent
+          echo "QEMU Guest Agent enabled and started"
+        
+        # Verify guest agent service is running
+        - |
+          echo "=========================================="
+          echo "Verifying QEMU Guest Agent service status..."
+          echo "=========================================="
+          for i in {1..30}; do
+            if systemctl is-active --quiet qemu-guest-agent; then
+              echo "✅ QEMU Guest Agent service IS running"
+              systemctl status qemu-guest-agent --no-pager -l
+              exit 0
+            fi
+            echo "Waiting for QEMU Guest Agent to start... ($i/30)"
+            sleep 1
+          done
+          echo "⚠️  WARNING: QEMU Guest Agent may not have started properly"
+          systemctl status qemu-guest-agent --no-pager -l || true
+          echo "Attempting to restart..."
+          systemctl restart qemu-guest-agent
+          sleep 3
+          if systemctl is-active --quiet qemu-guest-agent; then
+            echo "✅ QEMU Guest Agent started after restart"
+          else
+            echo "❌ QEMU Guest Agent failed to start"
+          fi
+        
+        # Configure Docker
+        - systemctl enable docker
+        - systemctl start docker
+        
+        # Configure PostgreSQL
+        - systemctl enable postgresql
+        - systemctl start postgresql
+        
+        # Configure Redis
+        - systemctl enable redis-server
+        - systemctl start redis-server
+        
+        # Create integration gateway directories
+        - |
+          mkdir -p /opt/phoenix-integration/{workflows,connectors,logs,data}
+          mkdir -p /opt/phoenix-integration/workflows/templates
+          chown -R admin:admin /opt/phoenix-integration
+        
+        # Create PostgreSQL database for integration gateway
+        - |
+          sudo -u postgres psql <<EOF
+          CREATE DATABASE phoenix_integration;
+          CREATE USER integration_user WITH PASSWORD 'CHANGE_ME_ON_FIRST_LOGIN';
+          GRANT ALL PRIVILEGES ON DATABASE phoenix_integration TO integration_user;
+          EOF
+        
+        # Configure Nginx reverse proxy
+        - |
+          cat > /etc/nginx/sites-available/phoenix-integration <<EOF
+          server {
+              listen 80;
+              server_name integration.sankofa.nexus;
+              
+              location / {
+                  proxy_pass http://127.0.0.1:5678;
+                  proxy_http_version 1.1;
+                  proxy_set_header Upgrade \$http_upgrade;
+                  proxy_set_header Connection "upgrade";
+                  proxy_set_header Host \$host;
+                  proxy_set_header X-Real-IP \$remote_addr;
+                  proxy_set_header X-Forwarded-For \$proxy_add_x_forwarded_for;
+                  proxy_set_header X-Forwarded-Proto \$scheme;
+              }
+          }
+          EOF
+          ln -sf /etc/nginx/sites-available/phoenix-integration /etc/nginx/sites-enabled/
+          rm -f /etc/nginx/sites-enabled/default
+        
+        # Configure UFW firewall
+        - ufw allow 22/tcp    # SSH
+        - ufw allow 80/tcp    # HTTP
+        - ufw allow 443/tcp   # HTTPS
+        - ufw allow 5678/tcp  # n8n (if using)
+        - ufw allow 8080/tcp  # Airflow (if using)
+        - ufw --force enable
+        
+        # Enable and start services
+        - systemctl enable nginx
+        - systemctl restart nginx
+        
+        # Create docker-compose template for n8n
+        - |
+          cat > /opt/phoenix-integration/docker-compose-n8n.yml <<EOF
+          version: '3.8'
+          services:
+            n8n:
+              image: n8nio/n8n:latest
+              ports:
+                - "5678:5678"
+              environment:
+                - DB_TYPE=postgresdb
+                - DB_POSTGRESDB_HOST=localhost
+                - DB_POSTGRESDB_DATABASE=phoenix_integration
+                - DB_POSTGRESDB_USER=integration_user
+                - DB_POSTGRESDB_PASSWORD=CHANGE_ME_ON_FIRST_LOGIN
+                - N8N_BASIC_AUTH_ACTIVE=true
+                - N8N_BASIC_AUTH_USER=admin
+                - N8N_BASIC_AUTH_PASSWORD=CHANGE_ME_ON_FIRST_LOGIN
+              volumes:
+                - /opt/phoenix-integration/data:/home/node/.n8n
+              restart: unless-stopped
+          EOF
+          chown admin:admin /opt/phoenix-integration/docker-compose-n8n.yml
+        
+        # Create workflow template example
+        - |
+          cat > /opt/phoenix-integration/workflows/templates/example-workflow.json <<EOF
+          {
+            "name": "Example Phoenix Workflow",
+            "nodes": [
+              {
+                "name": "Start",
+                "type": "n8n-nodes-base.webhook",
+                "parameters": {}
+              },
+              {
+                "name": "Process Data",
+                "type": "n8n-nodes-base.function",
+                "parameters": {
+                  "functionCode": "// Phoenix workflow processing"
+                }
+              }
+            ],
+            "connections": {}
+          }
+          EOF
+          chown admin:admin /opt/phoenix-integration/workflows/templates/example-workflow.json
+      
+      # Configure automatic security updates
+        - |
+          echo "Configuring automatic security updates..."
+          cat > /etc/apt/apt.conf.d/50unattended-upgrades <<'EOF'
+          Unattended-Upgrade::Allowed-Origins {
+              "${distro_id}:${distro_codename}-security";
+              "${distro_id}ESMApps:${distro_codename}-apps-security";
+              "${distro_id}ESM:${distro_codename}-infra-security";
+          };
+          Unattended-Upgrade::AutoFixInterruptedDpkg "true";
+          Unattended-Upgrade::MinimalSteps "true";
+          Unattended-Upgrade::Remove-Unused-Kernel-Packages "true";
+          Unattended-Upgrade::Remove-Unused-Dependencies "true";
+          Unattended-Upgrade::Automatic-Reboot "false";
+          Unattended-Upgrade::Automatic-Reboot-Time "02:00";
+          EOF
+          systemctl enable unattended-upgrades
+          systemctl start unattended-upgrades
+          echo "Automatic security updates configured"
+        
+        # Configure NTP (Chrony)
+        - |
+          echo "Configuring NTP (Chrony)..."
+          systemctl enable chrony
+          systemctl restart chrony
+          sleep 3
+          if systemctl is-active --quiet chrony; then
+            echo "NTP (Chrony) is running"
+            chronyc tracking | head -1 || true
+          else
+            echo "WARNING: NTP (Chrony) may not be running"
+          fi
+        
+        # SSH hardening
+        - |
+          echo "Hardening SSH configuration..."
+          if ! grep -q "^PermitRootLogin no" /etc/ssh/sshd_config; then
+            sed -i 's/^#PermitRootLogin.*/PermitRootLogin no/' /etc/ssh/sshd_config
+            sed -i 's/^PermitRootLogin yes/PermitRootLogin no/' /etc/ssh/sshd_config
+          fi
+          if ! grep -q "^PasswordAuthentication no" /etc/ssh/sshd_config; then
+            sed -i 's/^#PasswordAuthentication.*/PasswordAuthentication no/' /etc/ssh/sshd_config
+            sed -i 's/^PasswordAuthentication yes/PasswordAuthentication no/' /etc/ssh/sshd_config
+          fi
+          if ! grep -q "^PubkeyAuthentication yes" /etc/ssh/sshd_config; then
+            sed -i 's/^#PubkeyAuthentication.*/PubkeyAuthentication yes/' /etc/ssh/sshd_config
+          fi
+          systemctl restart sshd
+          echo "SSH hardening completed
+      
+# Write files for security configuration
+      write_files:
+        - path: /etc/apt/apt.conf.d/20auto-upgrades
+          content: |
+            APT::Periodic::Update-Package-Lists "1";
+            APT::Periodic::Download-Upgradeable-Packages "1";
+            APT::Periodic::AutocleanInterval "7";
+            APT::Periodic::Unattended-Upgrade "1";
+          permissions: '0644'
+          owner: root:root
+      
+# Final message
+      final_message: |
+        ==========================================
+  providerConfigRef:
+    name: proxmox-provider-config
+

examples/production/phoenix/codespaces-ide.yaml

@@ -0,0 +1,336 @@
+apiVersion: proxmox.sankofa.nexus/v1alpha1
+kind: ProxmoxVM
+metadata:
+  name: phoenix-codespaces-ide
+  namespace: default
+  labels:
+    tenant.sankofa.nexus/id: "infrastructure"
+    environment: "production"
+    app: "phoenix"
+    component: "codespaces"
+    service: "ide"
+spec:
+  forProvider:
+    node: "ml110-01"
+    name: "phoenix-codespaces-ide"
+    cpu: 8
+    memory: "32Gi"
+    disk: "200Gi"
+    storage: "local-lvm"
+    network: "vmbr0"
+    image: "local:iso/ubuntu-22.04-cloud.img"
+    site: "site-1"
+    userData: |
+      #cloud-config
+      # Package management
+      package_update: true
+      package_upgrade: true
+
+      # Time synchronization (NTP)
+      ntp:
+        enabled: true
+        ntp_client: chrony
+        servers:
+          - 0.pool.ntp.org
+          - 1.pool.ntp.org
+          - 2.pool.ntp.org
+          - 3.pool.ntp.org
+      
+      
+      # Required packages
+      packages:
+        - qemu-guest-agent
+        - curl
+        - wget
+        - net-tools
+        - apt-transport-https
+        - ca-certificates
+        - gnupg
+        - lsb-release
+        - chrony
+        - unattended-upgrades
+        - apt-listchanges
+        # IDE and development tools
+        - git
+        - docker.io
+        - docker-compose
+        - nginx
+        - certbot
+        - python3-certbot-nginx
+        - build-essential
+        - nodejs
+        - npm
+        - python3
+        - python3-pip
+        - python3-venv
+        - golang-go
+        - jq
+        - ufw
+        # AI/ML tools
+        - python3-dev
+        - python3-wheel
+      
+      # User configuration
+      users:
+        - name: admin
+          groups: sudo, docker
+          shell: /bin/bash
+          sudo: ALL=(ALL) NOPASSWD:ALL
+          lock_passwd: false
+          ssh_authorized_keys:
+            - ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDbGtLMmN6px4J2QUYk0BjnNT2wytgiTLSDzL+AwhE6qQWbL+h8AeFET2CHeEf09m5KYLAbHkYTq5aUleuXsluPer9A5moPD1UfdSVLpyyIv8OvKU4mnabk4z31yenPD7Wn1hKd3WoZs2ZflFIvzXaVGBoQXFlWztWLO1fh6CXmppf731FMcTMr4x7uxd8dkG4B400a1xWFx7H4e/u33KDUApqimTrwPTfooRLuyyKV7FWpopSvbSl0ANkZsuyrjbQRR3uD66iQaI60sZArTjhjwnJz+VCOnmJhlGmfMMwov4SOemt+Ut3x0Z6CwagjvxbpGf4hoI9coYD89IFzYwXVUyB9CyvlxEyPTX3v8QwIEZtWWPDStAHTkwZ80z+LU/pvP12Su32D4Wu+ziDkONVpxh1Qh6tV+jvuA9oSKno9jLa4FO0ZTs4bPkww8AbglH3h+dV7zd7qtwwW1oeSw5GHaOq/NetfpvPVuYkOe0IxVvlODZ/d6vAjCBZ0fRgtsEuZvmCVrxwGzZEHWLeAF9G/XD+wpaA5OonceeuhF6K4H12TC3AH6ycUPIBdYOeD2askutLprLmukj8xAC5mRW4ehCnXmwjABrhLSJb7A326q6t8EO2+3u12vvMQt7xKi+aY0+wGZXSvHfiabp93OMuf3WL80A8+5NaRtby44fY6bw== defi@defi-oracle.io
+      
+      # Boot commands - executed in order
+      runcmd:
+        # Verify packages are installed
+        - |
+          echo "=========================================="
+          echo "Verifying required packages are installed..."
+          echo "=========================================="
+          for pkg in qemu-guest-agent curl wget net-tools chrony unattended-upgrades; do
+            if ! dpkg -l | grep -q "^ii.*$pkg"; then
+              echo "ERROR: Package $pkg is not installed"
+              exit 1
+            fi
+            echo "✅ Package $pkg is installed"
+          done
+          echo "All required packages verified"
+        
+        # Verify qemu-guest-agent package details
+        - |
+          echo "=========================================="
+          echo "Checking qemu-guest-agent package details..."
+          echo "=========================================="
+          if dpkg -l | grep -q "^ii.*qemu-guest-agent"; then
+            echo "✅ qemu-guest-agent package IS installed"
+            dpkg -l | grep qemu-guest-agent
+          else
+            echo "❌ qemu-guest-agent package is NOT installed"
+            echo "Attempting to install..."
+            apt-get update
+            apt-get install -y qemu-guest-agent
+          fi
+        
+        # Enable and start QEMU Guest Agent
+        - |
+          echo "=========================================="
+          echo "Enabling and starting QEMU Guest Agent..."
+          echo "=========================================="
+          systemctl enable qemu-guest-agent
+          systemctl start qemu-guest-agent
+          echo "QEMU Guest Agent enabled and started"
+        
+        # Verify guest agent service is running
+        - |
+          echo "=========================================="
+          echo "Verifying QEMU Guest Agent service status..."
+          echo "=========================================="
+          for i in {1..30}; do
+            if systemctl is-active --quiet qemu-guest-agent; then
+              echo "✅ QEMU Guest Agent service IS running"
+              systemctl status qemu-guest-agent --no-pager -l
+              exit 0
+            fi
+            echo "Waiting for QEMU Guest Agent to start... ($i/30)"
+            sleep 1
+          done
+          echo "⚠️  WARNING: QEMU Guest Agent may not have started properly"
+          systemctl status qemu-guest-agent --no-pager -l || true
+          echo "Attempting to restart..."
+          systemctl restart qemu-guest-agent
+          sleep 3
+          if systemctl is-active --quiet qemu-guest-agent; then
+            echo "✅ QEMU Guest Agent started after restart"
+          else
+            echo "❌ QEMU Guest Agent failed to start"
+          fi
+        
+        # Configure Docker
+        - systemctl enable docker
+        - systemctl start docker
+        
+        # Install code-server (VS Code in browser)
+        - |
+          echo "Installing code-server..."
+          curl -fsSL https://code-server.dev/install.sh | sh
+          systemctl enable --now code-server@admin || echo "Code-server will be configured post-deployment"
+        
+        # Install Python AI/ML packages
+        - |
+          echo "Installing Python AI/ML packages..."
+          python3 -m pip install --upgrade pip
+          python3 -m pip install --user langchain openai anthropic transformers torch torchvision || echo "AI packages will be installed post-deployment"
+        
+        # Create directories for code-server
+        - |
+          mkdir -p /home/admin/.config/code-server
+          mkdir -p /home/admin/workspaces
+          mkdir -p /opt/phoenix-ide
+          chown -R admin:admin /home/admin/.config
+          chown -R admin:admin /home/admin/workspaces
+          chown -R admin:admin /opt/phoenix-ide
+        
+        # Create Phoenix-branded code-server config
+        - |
+          cat > /home/admin/.config/code-server/config.yaml <<EOF
+          bind-addr: 127.0.0.1:8080
+          auth: password
+          password: CHANGE_ME_ON_FIRST_LOGIN
+          cert: false
+          user-data-dir: /home/admin/.local/share/code-server
+          # Phoenix branding
+          welcome-text: "Welcome to Phoenix Codespaces IDE"
+          disable-telemetry: true
+          disable-update-check: true
+          EOF
+          chown admin:admin /home/admin/.config/code-server/config.yaml
+          chmod 600 /home/admin/.config/code-server/config.yaml
+        
+        # Configure Nginx reverse proxy
+        - |
+          cat > /etc/nginx/sites-available/phoenix-codespaces <<EOF
+          server {
+              listen 80;
+              server_name codespaces.sankofa.nexus;
+              
+              location / {
+                  proxy_pass http://127.0.0.1:8080;
+                  proxy_http_version 1.1;
+                  proxy_set_header Upgrade \$http_upgrade;
+                  proxy_set_header Connection "upgrade";
+                  proxy_set_header Host \$host;
+                  proxy_set_header X-Real-IP \$remote_addr;
+                  proxy_set_header X-Forwarded-For \$proxy_add_x_forwarded_for;
+                  proxy_set_header X-Forwarded-Proto \$scheme;
+                  
+                  # WebSocket support
+                  proxy_read_timeout 86400;
+              }
+          }
+          EOF
+          ln -sf /etc/nginx/sites-available/phoenix-codespaces /etc/nginx/sites-enabled/
+          rm -f /etc/nginx/sites-enabled/default
+        
+        # Configure UFW firewall
+        - ufw allow 22/tcp    # SSH
+        - ufw allow 80/tcp    # HTTP
+        - ufw allow 443/tcp   # HTTPS
+        - ufw allow 8080/tcp  # Code-server (direct access, if needed)
+        - ufw --force enable
+        
+        # Enable and start services
+        - systemctl enable nginx
+        - systemctl restart nginx
+        
+        # Create AI agent service directory
+        - |
+          mkdir -p /opt/phoenix-ide/agents
+          mkdir -p /opt/phoenix-ide/workspaces
+          mkdir -p /opt/phoenix-ide/extensions
+          chown -R admin:admin /opt/phoenix-ide
+        
+        # Install common VS Code extensions (via code-server CLI)
+        - |
+          echo "VS Code extensions will be installed post-deployment via code-server CLI"
+          echo "Recommended extensions:"
+          echo "  - GitHub Copilot (or alternative)"
+          echo "  - Python"
+          echo "  - TypeScript"
+          echo "  - Docker"
+          echo "  - GitLens"
+          echo "  - Remote Development"
+        
+        # Create Phoenix AI agent helper script
+        - |
+          cat > /opt/phoenix-ide/phoenix-ai-agent.py <<'PYEOF'
+          #!/usr/bin/env python3
+          """
+          Phoenix AI Agent - Copilot-like AI assistant for Phoenix Codespaces IDE
+          This script provides AI-powered code completion and assistance
+          """
+          import sys
+          import json
+          
+          def main():
+              print("Phoenix AI Agent - Initialized")
+              print("This agent will be configured post-deployment")
+              print("Features:")
+              print("  - Code completion")
+              print("  - Code generation")
+              print("  - Code review")
+              print("  - Automated testing")
+              print("  - Documentation generation")
+          
+          if __name__ == "__main__":
+              main()
+          PYEOF
+          chmod +x /opt/phoenix-ide/phoenix-ai-agent.py
+          chown admin:admin /opt/phoenix-ide/phoenix-ai-agent.py
+      
+      # Configure automatic security updates
+        - |
+          echo "Configuring automatic security updates..."
+          cat > /etc/apt/apt.conf.d/50unattended-upgrades <<'EOF'
+          Unattended-Upgrade::Allowed-Origins {
+              "${distro_id}:${distro_codename}-security";
+              "${distro_id}ESMApps:${distro_codename}-apps-security";
+              "${distro_id}ESM:${distro_codename}-infra-security";
+          };
+          Unattended-Upgrade::AutoFixInterruptedDpkg "true";
+          Unattended-Upgrade::MinimalSteps "true";
+          Unattended-Upgrade::Remove-Unused-Kernel-Packages "true";
+          Unattended-Upgrade::Remove-Unused-Dependencies "true";
+          Unattended-Upgrade::Automatic-Reboot "false";
+          Unattended-Upgrade::Automatic-Reboot-Time "02:00";
+          EOF
+          systemctl enable unattended-upgrades
+          systemctl start unattended-upgrades
+          echo "Automatic security updates configured"
+        
+        # Configure NTP (Chrony)
+        - |
+          echo "Configuring NTP (Chrony)..."
+          systemctl enable chrony
+          systemctl restart chrony
+          sleep 3
+          if systemctl is-active --quiet chrony; then
+            echo "NTP (Chrony) is running"
+            chronyc tracking | head -1 || true
+          else
+            echo "WARNING: NTP (Chrony) may not be running"
+          fi
+        
+        # SSH hardening
+        - |
+          echo "Hardening SSH configuration..."
+          if ! grep -q "^PermitRootLogin no" /etc/ssh/sshd_config; then
+            sed -i 's/^#PermitRootLogin.*/PermitRootLogin no/' /etc/ssh/sshd_config
+            sed -i 's/^PermitRootLogin yes/PermitRootLogin no/' /etc/ssh/sshd_config
+          fi
+          if ! grep -q "^PasswordAuthentication no" /etc/ssh/sshd_config; then
+            sed -i 's/^#PasswordAuthentication.*/PasswordAuthentication no/' /etc/ssh/sshd_config
+            sed -i 's/^PasswordAuthentication yes/PasswordAuthentication no/' /etc/ssh/sshd_config
+          fi
+          if ! grep -q "^PubkeyAuthentication yes" /etc/ssh/sshd_config; then
+            sed -i 's/^#PubkeyAuthentication.*/PubkeyAuthentication yes/' /etc/ssh/sshd_config
+          fi
+          systemctl restart sshd
+          echo "SSH hardening completed
+      
+# Write files for security configuration
+      write_files:
+        - path: /etc/apt/apt.conf.d/20auto-upgrades
+          content: |
+            APT::Periodic::Update-Package-Lists "1";
+            APT::Periodic::Download-Upgradeable-Packages "1";
+            APT::Periodic::AutocleanInterval "7";
+            APT::Periodic::Unattended-Upgrade "1";
+          permissions: '0644'
+          owner: root:root
+      
+# Final message
+      final_message: |
+        ==========================================
+  providerConfigRef:
+    name: proxmox-provider-config
+

examples/production/phoenix/devops-runner.yaml

@@ -0,0 +1,245 @@
+apiVersion: proxmox.sankofa.nexus/v1alpha1
+kind: ProxmoxVM
+metadata:
+  name: phoenix-devops-runner
+  namespace: default
+  labels:
+    tenant.sankofa.nexus/id: "infrastructure"
+    environment: "production"
+    app: "phoenix"
+    component: "devops"
+    role: "runner"
+spec:
+  forProvider:
+    node: "ml110-01"
+    name: "phoenix-devops-runner"
+    cpu: 8
+    memory: "16Gi"
+    disk: "200Gi"
+    storage: "local-lvm"
+    network: "vmbr0"
+    image: "local:iso/ubuntu-22.04-cloud.img"
+    site: "site-1"
+    userData: |
+      #cloud-config
+      # Package management
+      package_update: true
+      package_upgrade: true
+
+      # Time synchronization (NTP)
+      ntp:
+        enabled: true
+        ntp_client: chrony
+        servers:
+          - 0.pool.ntp.org
+          - 1.pool.ntp.org
+          - 2.pool.ntp.org
+          - 3.pool.ntp.org
+      
+      
+      # Required packages
+      packages:
+        - qemu-guest-agent
+        - curl
+        - wget
+        - net-tools
+        - apt-transport-https
+        - ca-certificates
+        - gnupg
+        - lsb-release
+        - chrony
+        - unattended-upgrades
+        - apt-listchanges
+        # DevOps tools
+        - git
+        - docker.io
+        - docker-compose
+        - build-essential
+        - nodejs
+        - npm
+        - python3
+        - python3-pip
+        - golang-go
+        - jq
+        - ufw
+      
+      # User configuration
+      users:
+        - name: admin
+          groups: sudo, docker
+          shell: /bin/bash
+          sudo: ALL=(ALL) NOPASSWD:ALL
+          lock_passwd: false
+          ssh_authorized_keys:
+            - ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDbGtLMmN6px4J2QUYk0BjnNT2wytgiTLSDzL+AwhE6qQWbL+h8AeFET2CHeEf09m5KYLAbHkYTq5aUleuXsluPer9A5moPD1UfdSVLpyyIv8OvKU4mnabk4z31yenPD7Wn1hKd3WoZs2ZflFIvzXaVGBoQXFlWztWLO1fh6CXmppf731FMcTMr4x7uxd8dkG4B400a1xWFx7H4e/u33KDUApqimTrwPTfooRLuyyKV7FWpopSvbSl0ANkZsuyrjbQRR3uD66iQaI60sZArTjhjwnJz+VCOnmJhlGmfMMwov4SOemt+Ut3x0Z6CwagjvxbpGf4hoI9coYD89IFzYwXVUyB9CyvlxEyPTX3v8QwIEZtWWPDStAHTkwZ80z+LU/pvP12Su32D4Wu+ziDkONVpxh1Qh6tV+jvuA9oSKno9jLa4FO0ZTs4bPkww8AbglH3h+dV7zd7qtwwW1oeSw5GHaOq/NetfpvPVuYkOe0IxVvlODZ/d6vAjCBZ0fRgtsEuZvmCVrxwGzZEHWLeAF9G/XD+wpaA5OonceeuhF6K4H12TC3AH6ycUPIBdYOeD2askutLprLmukj8xAC5mRW4ehCnXmwjABrhLSJb7A326q6t8EO2+3u12vvMQt7xKi+aY0+wGZXSvHfiabp93OMuf3WL80A8+5NaRtby44fY6bw== defi@defi-oracle.io
+      
+      # Boot commands - executed in order
+      runcmd:
+        # Verify packages are installed
+        - |
+          echo "=========================================="
+          echo "Verifying required packages are installed..."
+          echo "=========================================="
+          for pkg in qemu-guest-agent curl wget net-tools chrony unattended-upgrades; do
+            if ! dpkg -l | grep -q "^ii.*$pkg"; then
+              echo "ERROR: Package $pkg is not installed"
+              exit 1
+            fi
+            echo "✅ Package $pkg is installed"
+          done
+          echo "All required packages verified"
+        
+        # Verify qemu-guest-agent package details
+        - |
+          echo "=========================================="
+          echo "Checking qemu-guest-agent package details..."
+          echo "=========================================="
+          if dpkg -l | grep -q "^ii.*qemu-guest-agent"; then
+            echo "✅ qemu-guest-agent package IS installed"
+            dpkg -l | grep qemu-guest-agent
+          else
+            echo "❌ qemu-guest-agent package is NOT installed"
+            echo "Attempting to install..."
+            apt-get update
+            apt-get install -y qemu-guest-agent
+          fi
+        
+        # Enable and start QEMU Guest Agent
+        - |
+          echo "=========================================="
+          echo "Enabling and starting QEMU Guest Agent..."
+          echo "=========================================="
+          systemctl enable qemu-guest-agent
+          systemctl start qemu-guest-agent
+          echo "QEMU Guest Agent enabled and started"
+        
+        # Verify guest agent service is running
+        - |
+          echo "=========================================="
+          echo "Verifying QEMU Guest Agent service status..."
+          echo "=========================================="
+          for i in {1..30}; do
+            if systemctl is-active --quiet qemu-guest-agent; then
+              echo "✅ QEMU Guest Agent service IS running"
+              systemctl status qemu-guest-agent --no-pager -l
+              exit 0
+            fi
+            echo "Waiting for QEMU Guest Agent to start... ($i/30)"
+            sleep 1
+          done
+          echo "⚠️  WARNING: QEMU Guest Agent may not have started properly"
+          systemctl status qemu-guest-agent --no-pager -l || true
+          echo "Attempting to restart..."
+          systemctl restart qemu-guest-agent
+          sleep 3
+          if systemctl is-active --quiet qemu-guest-agent; then
+            echo "✅ QEMU Guest Agent started after restart"
+          else
+            echo "❌ QEMU Guest Agent failed to start"
+          fi
+        
+        # Configure Docker
+        - systemctl enable docker
+        - systemctl start docker
+        
+        # Install kubectl
+        - |
+          curl -LO "https://dl.k8s.io/release/$(curl -L -s https://dl.k8s.io/release/stable.txt)/bin/linux/amd64/kubectl"
+          install -o root -g root -m 0755 kubectl /usr/local/bin/kubectl
+          rm kubectl
+        
+        # Install Helm
+        - |
+          curl https://raw.githubusercontent.com/helm/helm/main/scripts/get-helm-3 | bash
+        
+        # Create CI/CD directories
+        - mkdir -p /opt/ci-cd/workspace
+        - mkdir -p /opt/ci-cd/artifacts
+        - mkdir -p /opt/ci-cd/cache
+        - chown -R admin:admin /opt/ci-cd
+        
+        # Configure UFW firewall
+        - ufw allow 22/tcp    # SSH
+        - ufw allow 8080/tcp  # Jenkins (if using)
+        - ufw allow 8090/tcp  # GitLab Runner (if using)
+        - ufw --force enable
+        
+        # Verify tools
+        - |
+          echo "Verifying installed tools..."
+          echo "Docker: $(docker --version)"
+          echo "Git: $(git --version)"
+          echo "Node.js: $(node --version)"
+          echo "Python: $(python3 --version)"
+          echo "Go: $(go version)"
+          echo "kubectl: $(kubectl version --client --short)"
+          echo "Helm: $(helm version --short)"
+          echo "jq: $(jq --version)"
+      
+      # Configure automatic security updates
+        - |
+          echo "Configuring automatic security updates..."
+          cat > /etc/apt/apt.conf.d/50unattended-upgrades <<'EOF'
+          Unattended-Upgrade::Allowed-Origins {
+              "${distro_id}:${distro_codename}-security";
+              "${distro_id}ESMApps:${distro_codename}-apps-security";
+              "${distro_id}ESM:${distro_codename}-infra-security";
+          };
+          Unattended-Upgrade::AutoFixInterruptedDpkg "true";
+          Unattended-Upgrade::MinimalSteps "true";
+          Unattended-Upgrade::Remove-Unused-Kernel-Packages "true";
+          Unattended-Upgrade::Remove-Unused-Dependencies "true";
+          Unattended-Upgrade::Automatic-Reboot "false";
+          Unattended-Upgrade::Automatic-Reboot-Time "02:00";
+          EOF
+          systemctl enable unattended-upgrades
+          systemctl start unattended-upgrades
+          echo "Automatic security updates configured"
+        
+        # Configure NTP (Chrony)
+        - |
+          echo "Configuring NTP (Chrony)..."
+          systemctl enable chrony
+          systemctl restart chrony
+          sleep 3
+          if systemctl is-active --quiet chrony; then
+            echo "NTP (Chrony) is running"
+            chronyc tracking | head -1 || true
+          else
+            echo "WARNING: NTP (Chrony) may not be running"
+          fi
+        
+        # SSH hardening
+        - |
+          echo "Hardening SSH configuration..."
+          if ! grep -q "^PermitRootLogin no" /etc/ssh/sshd_config; then
+            sed -i 's/^#PermitRootLogin.*/PermitRootLogin no/' /etc/ssh/sshd_config
+            sed -i 's/^PermitRootLogin yes/PermitRootLogin no/' /etc/ssh/sshd_config
+          fi
+          if ! grep -q "^PasswordAuthentication no" /etc/ssh/sshd_config; then
+            sed -i 's/^#PasswordAuthentication.*/PasswordAuthentication no/' /etc/ssh/sshd_config
+            sed -i 's/^PasswordAuthentication yes/PasswordAuthentication no/' /etc/ssh/sshd_config
+          fi
+          if ! grep -q "^PubkeyAuthentication yes" /etc/ssh/sshd_config; then
+            sed -i 's/^#PubkeyAuthentication.*/PubkeyAuthentication yes/' /etc/ssh/sshd_config
+          fi
+          systemctl restart sshd
+          echo "SSH hardening completed
+      
+# Write files for security configuration
+      write_files:
+        - path: /etc/apt/apt.conf.d/20auto-upgrades
+          content: |
+            APT::Periodic::Update-Package-Lists "1";
+            APT::Periodic::Download-Upgradeable-Packages "1";
+            APT::Periodic::AutocleanInterval "7";
+            APT::Periodic::Unattended-Upgrade "1";
+          permissions: '0644'
+          owner: root:root
+      
+# Final message
+      final_message: |
+        ==========================================
+  providerConfigRef:
+    name: proxmox-provider-config
+

examples/production/phoenix/dns-primary.yaml

@@ -0,0 +1,320 @@
+apiVersion: proxmox.sankofa.nexus/v1alpha1
+kind: ProxmoxVM
+metadata:
+  name: phoenix-dns-primary
+  namespace: default
+  labels:
+    tenant.sankofa.nexus/id: "infrastructure"
+    environment: "production"
+    app: "phoenix"
+    component: "dns"
+    role: "primary"
+spec:
+  forProvider:
+    node: "ml110-01"
+    name: "phoenix-dns-primary"
+    cpu: 4
+    memory: "8Gi"
+    disk: "50Gi"
+    storage: "local-lvm"
+    network: "vmbr0"
+    image: "local:iso/ubuntu-22.04-cloud.img"
+    site: "site-1"
+    userData: |
+      #cloud-config
+      # Package management
+      package_update: true
+      package_upgrade: true
+
+      # Time synchronization (NTP)
+      ntp:
+        enabled: true
+        ntp_client: chrony
+        servers:
+          - 0.pool.ntp.org
+          - 1.pool.ntp.org
+          - 2.pool.ntp.org
+          - 3.pool.ntp.org
+      
+      
+      # Required packages
+      packages:
+        - qemu-guest-agent
+        - curl
+        - wget
+        - net-tools
+        - apt-transport-https
+        - ca-certificates
+        - gnupg
+        - lsb-release
+        - chrony
+        - unattended-upgrades
+        - apt-listchanges
+        # DNS server packages
+        - bind9
+        - bind9utils
+        - bind9-doc
+        - dnsutils
+        - ufw
+      
+      # User configuration
+      users:
+        - name: admin
+          groups: sudo
+          shell: /bin/bash
+          sudo: ALL=(ALL) NOPASSWD:ALL
+          lock_passwd: false
+          ssh_authorized_keys:
+            - ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDbGtLMmN6px4J2QUYk0BjnNT2wytgiTLSDzL+AwhE6qQWbL+h8AeFET2CHeEf09m5KYLAbHkYTq5aUleuXsluPer9A5moPD1UfdSVLpyyIv8OvKU4mnabk4z31yenPD7Wn1hKd3WoZs2ZflFIvzXaVGBoQXFlWztWLO1fh6CXmppf731FMcTMr4x7uxd8dkG4B400a1xWFx7H4e/u33KDUApqimTrwPTfooRLuyyKV7FWpopSvbSl0ANkZsuyrjbQRR3uD66iQaI60sZArTjhjwnJz+VCOnmJhlGmfMMwov4SOemt+Ut3x0Z6CwagjvxbpGf4hoI9coYD89IFzYwXVUyB9CyvlxEyPTX3v8QwIEZtWWPDStAHTkwZ80z+LU/pvP12Su32D4Wu+ziDkONVpxh1Qh6tV+jvuA9oSKno9jLa4FO0ZTs4bPkww8AbglH3h+dV7zd7qtwwW1oeSw5GHaOq/NetfpvPVuYkOe0IxVvlODZ/d6vAjCBZ0fRgtsEuZvmCVrxwGzZEHWLeAF9G/XD+wpaA5OonceeuhF6K4H12TC3AH6ycUPIBdYOeD2askutLprLmukj8xAC5mRW4ehCnXmwjABrhLSJb7A326q6t8EO2+3u12vvMQt7xKi+aY0+wGZXSvHfiabp93OMuf3WL80A8+5NaRtby44fY6bw== defi@defi-oracle.io
+      
+      # Boot commands - executed in order
+      runcmd:
+        # Verify packages are installed
+        - |
+          echo "=========================================="
+          echo "Verifying required packages are installed..."
+          echo "=========================================="
+          for pkg in qemu-guest-agent curl wget net-tools chrony unattended-upgrades; do
+            if ! dpkg -l | grep -q "^ii.*$pkg"; then
+              echo "ERROR: Package $pkg is not installed"
+              exit 1
+            fi
+            echo "✅ Package $pkg is installed"
+          done
+          echo "All required packages verified"
+        
+        # Verify qemu-guest-agent package details
+        - |
+          echo "=========================================="
+          echo "Checking qemu-guest-agent package details..."
+          echo "=========================================="
+          if dpkg -l | grep -q "^ii.*qemu-guest-agent"; then
+            echo "✅ qemu-guest-agent package IS installed"
+            dpkg -l | grep qemu-guest-agent
+          else
+            echo "❌ qemu-guest-agent package is NOT installed"
+            echo "Attempting to install..."
+            apt-get update
+            apt-get install -y qemu-guest-agent
+          fi
+        
+        # Enable and start QEMU Guest Agent
+        - |
+          echo "=========================================="
+          echo "Enabling and starting QEMU Guest Agent..."
+          echo "=========================================="
+          systemctl enable qemu-guest-agent
+          systemctl start qemu-guest-agent
+          echo "QEMU Guest Agent enabled and started"
+        
+        # Verify guest agent service is running
+        - |
+          echo "=========================================="
+          echo "Verifying QEMU Guest Agent service status..."
+          echo "=========================================="
+          for i in {1..30}; do
+            if systemctl is-active --quiet qemu-guest-agent; then
+              echo "✅ QEMU Guest Agent service IS running"
+              systemctl status qemu-guest-agent --no-pager -l
+              exit 0
+            fi
+            echo "Waiting for QEMU Guest Agent to start... ($i/30)"
+            sleep 1
+          done
+          echo "⚠️  WARNING: QEMU Guest Agent may not have started properly"
+          systemctl status qemu-guest-agent --no-pager -l || true
+          echo "Attempting to restart..."
+          systemctl restart qemu-guest-agent
+          sleep 3
+          if systemctl is-active --quiet qemu-guest-agent; then
+            echo "✅ QEMU Guest Agent started after restart"
+          else
+            echo "❌ QEMU Guest Agent failed to start"
+          fi
+        
+        # Configure BIND9
+        - |
+          echo "Configuring BIND9 DNS server..."
+          # Enable BIND9 to listen on all interfaces
+          sed -i 's/OPTIONS=.*/OPTIONS="-u bind -4"/' /etc/default/bind9
+          
+          # Create basic named.conf.local (will be configured post-deployment)
+          cat > /etc/bind/named.conf.local <<EOF
+          // Local DNS zones for sankofa.nexus
+          // This file will be configured post-deployment with actual zone files
+          
+          // Example zone configuration:
+          // zone "sankofa.nexus" {
+          //     type master;
+          //     file "/etc/bind/db.sankofa.nexus";
+          // };
+          EOF
+          
+          # Start and enable BIND9
+          systemctl enable named
+          systemctl start named
+        
+        # Configure UFW firewall
+        - ufw allow 53/tcp
+        - ufw allow 53/udp
+        - ufw allow 22/tcp
+        - ufw --force enable
+        
+        # Verify BIND9 is running
+        - |
+          if systemctl is-active --quiet named; then
+            echo "BIND9 DNS server is running"
+            systemctl status named --no-pager
+          else
+            echo "WARNING: BIND9 may not have started properly"
+            systemctl status named --no-pager || true
+          fi
+        
+        # Configure automatic security updates
+        - |
+          echo "Configuring automatic security updates..."
+          cat > /etc/apt/apt.conf.d/50unattended-upgrades <<'EOF'
+          Unattended-Upgrade::Allowed-Origins {
+              "${distro_id}:${distro_codename}-security";
+              "${distro_id}ESMApps:${distro_codename}-apps-security";
+              "${distro_id}ESM:${distro_codename}-infra-security";
+          };
+          Unattended-Upgrade::AutoFixInterruptedDpkg "true";
+          Unattended-Upgrade::MinimalSteps "true";
+          Unattended-Upgrade::Remove-Unused-Kernel-Packages "true";
+          Unattended-Upgrade::Remove-Unused-Dependencies "true";
+          Unattended-Upgrade::Automatic-Reboot "false";
+          Unattended-Upgrade::Automatic-Reboot-Time "02:00";
+          EOF
+          systemctl enable unattended-upgrades
+          systemctl start unattended-upgrades
+          echo "Automatic security updates configured"
+        
+        # Configure NTP (Chrony)
+        - |
+          echo "Configuring NTP (Chrony)..."
+          systemctl enable chrony
+          systemctl restart chrony
+          sleep 3
+          if systemctl is-active --quiet chrony; then
+            echo "NTP (Chrony) is running"
+            chronyc tracking | head -1 || true
+          else
+            echo "WARNING: NTP (Chrony) may not be running"
+          fi
+        
+        # SSH hardening
+        - |
+          echo "Hardening SSH configuration..."
+          if ! grep -q "^PermitRootLogin no" /etc/ssh/sshd_config; then
+            sed -i 's/^#PermitRootLogin.*/PermitRootLogin no/' /etc/ssh/sshd_config
+            sed -i 's/^PermitRootLogin yes/PermitRootLogin no/' /etc/ssh/sshd_config
+          fi
+          if ! grep -q "^PasswordAuthentication no" /etc/ssh/sshd_config; then
+            sed -i 's/^#PasswordAuthentication.*/PasswordAuthentication no/' /etc/ssh/sshd_config
+            sed -i 's/^PasswordAuthentication yes/PasswordAuthentication no/' /etc/ssh/sshd_config
+          fi
+          if ! grep -q "^PubkeyAuthentication yes" /etc/ssh/sshd_config; then
+            sed -i 's/^#PubkeyAuthentication.*/PubkeyAuthentication yes/' /etc/ssh/sshd_config
+          fi
+          systemctl restart sshd
+          echo "SSH hardening completed"
+        
+        # Configure automatic security updates
+        - |
+          echo "Configuring automatic security updates..."
+          cat > /etc/apt/apt.conf.d/50unattended-upgrades <<'EOF'
+          Unattended-Upgrade::Allowed-Origins {
+              "${distro_id}:${distro_codename}-security";
+              "${distro_id}ESMApps:${distro_codename}-apps-security";
+              "${distro_id}ESM:${distro_codename}-infra-security";
+          };
+          Unattended-Upgrade::AutoFixInterruptedDpkg "true";
+          Unattended-Upgrade::MinimalSteps "true";
+          Unattended-Upgrade::Remove-Unused-Kernel-Packages "true";
+          Unattended-Upgrade::Remove-Unused-Dependencies "true";
+          Unattended-Upgrade::Automatic-Reboot "false";
+          Unattended-Upgrade::Automatic-Reboot-Time "02:00";
+          EOF
+          systemctl enable unattended-upgrades
+          systemctl start unattended-upgrades
+          echo "Automatic security updates configured"
+        
+        # Configure NTP (Chrony)
+        - |
+          echo "Configuring NTP (Chrony)..."
+          systemctl enable chrony
+          systemctl restart chrony
+          sleep 3
+          if systemctl is-active --quiet chrony; then
+            echo "NTP (Chrony) is running"
+            chronyc tracking | head -1 || true
+          else
+            echo "WARNING: NTP (Chrony) may not be running"
+          fi
+        
+        # SSH hardening
+        - |
+          echo "Hardening SSH configuration..."
+          if ! grep -q "^PermitRootLogin no" /etc/ssh/sshd_config; then
+            sed -i 's/^#PermitRootLogin.*/PermitRootLogin no/' /etc/ssh/sshd_config
+            sed -i 's/^PermitRootLogin yes/PermitRootLogin no/' /etc/ssh/sshd_config
+          fi
+          if ! grep -q "^PasswordAuthentication no" /etc/ssh/sshd_config; then
+            sed -i 's/^#PasswordAuthentication.*/PasswordAuthentication no/' /etc/ssh/sshd_config
+            sed -i 's/^PasswordAuthentication yes/PasswordAuthentication no/' /etc/ssh/sshd_config
+          fi
+          if ! grep -q "^PubkeyAuthentication yes" /etc/ssh/sshd_config; then
+            sed -i 's/^#PubkeyAuthentication.*/PubkeyAuthentication yes/' /etc/ssh/sshd_config
+          fi
+          systemctl restart sshd
+          echo "SSH hardening completed"
+      
+      # Write files for security configuration
+      write_files:
+        - path: /etc/apt/apt.conf.d/20auto-upgrades
+          content: |
+            APT::Periodic::Update-Package-Lists "1";
+            APT::Periodic::Download-Upgradeable-Packages "1";
+            APT::Periodic::AutocleanInterval "7";
+            APT::Periodic::Unattended-Upgrade "1";
+          permissions: '0644'
+          owner: root:root
+      
+      # Final message
+      final_message: |
+        ==========================================
+        System Boot Completed Successfully!
+        ==========================================
+        
+        Services Status:
+        - QEMU Guest Agent: $(systemctl is-active qemu-guest-agent)
+        - NTP (Chrony): $(systemctl is-active chrony)
+        - Automatic Security Updates: $(systemctl is-active unattended-upgrades)
+        - BIND9 DNS Server: $(systemctl is-active named)
+        
+        System Information:
+        - Hostname: $(hostname)
+        - IP Address: $(hostname -I | awk '{print $1}')
+        - Time: $(date)
+        
+        Packages Installed:
+        - qemu-guest-agent, curl, wget, net-tools
+        - chrony (NTP), unattended-upgrades (Security)
+        - bind9, bind9utils, dnsutils
+        
+        Security Configuration:
+        - SSH: Root login disabled, Password auth disabled
+        - Automatic security updates: Enabled
+        - NTP synchronization: Enabled
+        - UFW firewall: Enabled
+        
+        Next Steps:
+        1. Verify all services are running
+        2. Check cloud-init logs: /var/log/cloud-init-output.log
+        3. Configure DNS zones in /etc/bind/named.conf.local
+        4. Test SSH access
+        ==========================================
+  providerConfigRef:
+    name: proxmox-provider-config
+

examples/production/phoenix/email-server.yaml

@@ -0,0 +1,244 @@
+apiVersion: proxmox.sankofa.nexus/v1alpha1
+kind: ProxmoxVM
+metadata:
+  name: phoenix-email-server
+  namespace: default
+  labels:
+    tenant.sankofa.nexus/id: "infrastructure"
+    environment: "production"
+    app: "phoenix"
+    component: "email"
+spec:
+  forProvider:
+    node: "ml110-01"
+    name: "phoenix-email-server"
+    cpu: 8
+    memory: "16Gi"
+    disk: "200Gi"
+    storage: "local-lvm"
+    network: "vmbr0"
+    image: "local:iso/ubuntu-22.04-cloud.img"
+    site: "site-1"
+    userData: |
+      #cloud-config
+      # Package management
+      package_update: true
+      package_upgrade: true
+
+      # Time synchronization (NTP)
+      ntp:
+        enabled: true
+        ntp_client: chrony
+        servers:
+          - 0.pool.ntp.org
+          - 1.pool.ntp.org
+          - 2.pool.ntp.org
+          - 3.pool.ntp.org
+      
+      
+      # Required packages
+      packages:
+        - qemu-guest-agent
+        - curl
+        - wget
+        - net-tools
+        - apt-transport-https
+        - ca-certificates
+        - gnupg
+        - lsb-release
+        - chrony
+        - unattended-upgrades
+        - apt-listchanges
+        # Email server packages
+        - postfix
+        - dovecot-core
+        - dovecot-imapd
+        - dovecot-pop3d
+        - dovecot-lmtpd
+        - opendkim
+        - opendmarc
+        - spamassassin
+        - spamc
+        - clamav
+        - clamav-daemon
+        - ufw
+        - nginx
+        - certbot
+        - python3-certbot-nginx
+      
+      # User configuration
+      users:
+        - name: admin
+          groups: sudo
+          shell: /bin/bash
+          sudo: ALL=(ALL) NOPASSWD:ALL
+          lock_passwd: false
+          ssh_authorized_keys:
+            - ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDbGtLMmN6px4J2QUYk0BjnNT2wytgiTLSDzL+AwhE6qQWbL+h8AeFET2CHeEf09m5KYLAbHkYTq5aUleuXsluPer9A5moPD1UfdSVLpyyIv8OvKU4mnabk4z31yenPD7Wn1hKd3WoZs2ZflFIvzXaVGBoQXFlWztWLO1fh6CXmppf731FMcTMr4x7uxd8dkG4B400a1xWFx7H4e/u33KDUApqimTrwPTfooRLuyyKV7FWpopSvbSl0ANkZsuyrjbQRR3uD66iQaI60sZArTjhjwnJz+VCOnmJhlGmfMMwov4SOemt+Ut3x0Z6CwagjvxbpGf4hoI9coYD89IFzYwXVUyB9CyvlxEyPTX3v8QwIEZtWWPDStAHTkwZ80z+LU/pvP12Su32D4Wu+ziDkONVpxh1Qh6tV+jvuA9oSKno9jLa4FO0ZTs4bPkww8AbglH3h+dV7zd7qtwwW1oeSw5GHaOq/NetfpvPVuYkOe0IxVvlODZ/d6vAjCBZ0fRgtsEuZvmCVrxwGzZEHWLeAF9G/XD+wpaA5OonceeuhF6K4H12TC3AH6ycUPIBdYOeD2askutLprLmukj8xAC5mRW4ehCnXmwjABrhLSJb7A326q6t8EO2+3u12vvMQt7xKi+aY0+wGZXSvHfiabp93OMuf3WL80A8+5NaRtby44fY6bw== defi@defi-oracle.io
+      
+      # Boot commands - executed in order
+      runcmd:
+        # Verify packages are installed
+        - |
+          echo "=========================================="
+          echo "Verifying required packages are installed..."
+          echo "=========================================="
+          for pkg in qemu-guest-agent curl wget net-tools chrony unattended-upgrades; do
+            if ! dpkg -l | grep -q "^ii.*$pkg"; then
+              echo "ERROR: Package $pkg is not installed"
+              exit 1
+            fi
+            echo "✅ Package $pkg is installed"
+          done
+          echo "All required packages verified"
+        
+        # Verify qemu-guest-agent package details
+        - |
+          echo "=========================================="
+          echo "Checking qemu-guest-agent package details..."
+          echo "=========================================="
+          if dpkg -l | grep -q "^ii.*qemu-guest-agent"; then
+            echo "✅ qemu-guest-agent package IS installed"
+            dpkg -l | grep qemu-guest-agent
+          else
+            echo "❌ qemu-guest-agent package is NOT installed"
+            echo "Attempting to install..."
+            apt-get update
+            apt-get install -y qemu-guest-agent
+          fi
+        
+        # Enable and start QEMU Guest Agent
+        - |
+          echo "=========================================="
+          echo "Enabling and starting QEMU Guest Agent..."
+          echo "=========================================="
+          systemctl enable qemu-guest-agent
+          systemctl start qemu-guest-agent
+          echo "QEMU Guest Agent enabled and started"
+        
+        # Verify guest agent service is running
+        - |
+          echo "=========================================="
+          echo "Verifying QEMU Guest Agent service status..."
+          echo "=========================================="
+          for i in {1..30}; do
+            if systemctl is-active --quiet qemu-guest-agent; then
+              echo "✅ QEMU Guest Agent service IS running"
+              systemctl status qemu-guest-agent --no-pager -l
+              exit 0
+            fi
+            echo "Waiting for QEMU Guest Agent to start... ($i/30)"
+            sleep 1
+          done
+          echo "⚠️  WARNING: QEMU Guest Agent may not have started properly"
+          systemctl status qemu-guest-agent --no-pager -l || true
+          echo "Attempting to restart..."
+          systemctl restart qemu-guest-agent
+          sleep 3
+          if systemctl is-active --quiet qemu-guest-agent; then
+            echo "✅ QEMU Guest Agent started after restart"
+          else
+            echo "❌ QEMU Guest Agent failed to start"
+          fi
+        
+        # Update ClamAV database
+        - freshclam || echo "ClamAV database update will run in background"
+        
+        # Configure UFW firewall
+        - ufw allow 25/tcp    # SMTP
+        - ufw allow 587/tcp   # SMTP submission
+        - ufw allow 465/tcp   # SMTPS
+        - ufw allow 143/tcp   # IMAP
+        - ufw allow 993/tcp   # IMAPS
+        - ufw allow 110/tcp   # POP3
+        - ufw allow 995/tcp   # POP3S
+        - ufw allow 80/tcp    # HTTP (for webmail)
+        - ufw allow 443/tcp   # HTTPS (for webmail)
+        - ufw allow 22/tcp    # SSH
+        - ufw --force enable
+        
+        # Enable services (configuration will be done post-deployment)
+        - systemctl enable postfix
+        - systemctl enable dovecot
+        - systemctl enable opendkim
+        - systemctl enable opendmarc
+        - systemctl enable spamassassin
+        - systemctl enable clamav-daemon
+        - systemctl enable nginx
+        
+        # Start services
+        - systemctl start postfix || echo "Postfix will be configured post-deployment"
+        - systemctl start dovecot || echo "Dovecot will be configured post-deployment"
+        - systemctl start opendkim || echo "OpenDKIM will be configured post-deployment"
+        - systemctl start opendmarc || echo "OpenDMARC will be configured post-deployment"
+        - systemctl start spamassassin || echo "SpamAssassin will be configured post-deployment"
+        - systemctl start clamav-daemon || echo "ClamAV will be configured post-deployment"
+        - systemctl start nginx || echo "Nginx will be configured post-deployment"
+      
+      # Configure automatic security updates
+        - |
+          echo "Configuring automatic security updates..."
+          cat > /etc/apt/apt.conf.d/50unattended-upgrades <<'EOF'
+          Unattended-Upgrade::Allowed-Origins {
+              "${distro_id}:${distro_codename}-security";
+              "${distro_id}ESMApps:${distro_codename}-apps-security";
+              "${distro_id}ESM:${distro_codename}-infra-security";
+          };
+          Unattended-Upgrade::AutoFixInterruptedDpkg "true";
+          Unattended-Upgrade::MinimalSteps "true";
+          Unattended-Upgrade::Remove-Unused-Kernel-Packages "true";
+          Unattended-Upgrade::Remove-Unused-Dependencies "true";
+          Unattended-Upgrade::Automatic-Reboot "false";
+          Unattended-Upgrade::Automatic-Reboot-Time "02:00";
+          EOF
+          systemctl enable unattended-upgrades
+          systemctl start unattended-upgrades
+          echo "Automatic security updates configured"
+        
+        # Configure NTP (Chrony)
+        - |
+          echo "Configuring NTP (Chrony)..."
+          systemctl enable chrony
+          systemctl restart chrony
+          sleep 3
+          if systemctl is-active --quiet chrony; then
+            echo "NTP (Chrony) is running"
+            chronyc tracking | head -1 || true
+          else
+            echo "WARNING: NTP (Chrony) may not be running"
+          fi
+        
+        # SSH hardening
+        - |
+          echo "Hardening SSH configuration..."
+          if ! grep -q "^PermitRootLogin no" /etc/ssh/sshd_config; then
+            sed -i 's/^#PermitRootLogin.*/PermitRootLogin no/' /etc/ssh/sshd_config
+            sed -i 's/^PermitRootLogin yes/PermitRootLogin no/' /etc/ssh/sshd_config
+          fi
+          if ! grep -q "^PasswordAuthentication no" /etc/ssh/sshd_config; then
+            sed -i 's/^#PasswordAuthentication.*/PasswordAuthentication no/' /etc/ssh/sshd_config
+            sed -i 's/^PasswordAuthentication yes/PasswordAuthentication no/' /etc/ssh/sshd_config
+          fi
+          if ! grep -q "^PubkeyAuthentication yes" /etc/ssh/sshd_config; then
+            sed -i 's/^#PubkeyAuthentication.*/PubkeyAuthentication yes/' /etc/ssh/sshd_config
+          fi
+          systemctl restart sshd
+          echo "SSH hardening completed
+      
+# Write files for security configuration
+      write_files:
+        - path: /etc/apt/apt.conf.d/20auto-upgrades
+          content: |
+            APT::Periodic::Update-Package-Lists "1";
+            APT::Periodic::Download-Upgradeable-Packages "1";
+            APT::Periodic::AutocleanInterval "7";
+            APT::Periodic::Unattended-Upgrade "1";
+          permissions: '0644'
+          owner: root:root
+      
+# Final message
+      final_message: |
+        ==========================================
+  providerConfigRef:
+    name: proxmox-provider-config
+

examples/production/phoenix/financial-messaging-gateway.yaml

@@ -0,0 +1,309 @@
+apiVersion: proxmox.sankofa.nexus/v1alpha1
+kind: ProxmoxVM
+metadata:
+  name: phoenix-financial-messaging-gateway
+  namespace: default
+  labels:
+    tenant.sankofa.nexus/id: "infrastructure"
+    environment: "production"
+    app: "phoenix"
+    component: "financial-messaging"
+    service: "banking"
+spec:
+  forProvider:
+    node: "ml110-01"
+    name: "phoenix-financial-messaging-gateway"
+    cpu: 8
+    memory: "16Gi"
+    disk: "500Gi"
+    storage: "local-lvm"
+    network: "vmbr0"
+    image: "local:iso/ubuntu-22.04-cloud.img"
+    site: "site-1"
+    userData: |
+      #cloud-config
+      # Package management
+      package_update: true
+      package_upgrade: true
+
+      # Time synchronization (NTP)
+      ntp:
+        enabled: true
+        ntp_client: chrony
+        servers:
+          - 0.pool.ntp.org
+          - 1.pool.ntp.org
+          - 2.pool.ntp.org
+          - 3.pool.ntp.org
+      
+      
+      # Required packages
+      packages:
+        - qemu-guest-agent
+        - curl
+        - wget
+        - net-tools
+        - apt-transport-https
+        - ca-certificates
+        - gnupg
+        - lsb-release
+        - chrony
+        - unattended-upgrades
+        - apt-listchanges
+        # Financial messaging packages
+        - docker.io
+        - docker-compose
+        - openjdk-11-jdk
+        - python3
+        - python3-pip
+        - postgresql
+        - postgresql-contrib
+        - redis-server
+        - openssl
+        - xmlsec1
+        - libxml2-utils
+        - nginx
+        - certbot
+        - python3-certbot-nginx
+        - ufw
+        - jq
+      
+      # User configuration
+      users:
+        - name: admin
+          groups: sudo, docker
+          shell: /bin/bash
+          sudo: ALL=(ALL) NOPASSWD:ALL
+          lock_passwd: false
+          ssh_authorized_keys:
+            - ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDbGtLMmN6px4J2QUYk0BjnNT2wytgiTLSDzL+AwhE6qQWbL+h8AeFET2CHeEf09m5KYLAbHkYTq5aUleuXsluPer9A5moPD1UfdSVLpyyIv8OvKU4mnabk4z31yenPD7Wn1hKd3WoZs2ZflFIvzXaVGBoQXFlWztWLO1fh6CXmppf731FMcTMr4x7uxd8dkG4B400a1xWFx7H4e/u33KDUApqimTrwPTfooRLuyyKV7FWpopSvbSl0ANkZsuyrjbQRR3uD66iQaI60sZArTjhjwnJz+VCOnmJhlGmfMMwov4SOemt+Ut3x0Z6CwagjvxbpGf4hoI9coYD89IFzYwXVUyB9CyvlxEyPTX3v8QwIEZtWWPDStAHTkwZ80z+LU/pvP12Su32D4Wu+ziDkONVpxh1Qh6tV+jvuA9oSKno9jLa4FO0ZTs4bPkww8AbglH3h+dV7zd7qtwwW1oeSw5GHaOq/NetfpvPVuYkOe0IxVvlODZ/d6vAjCBZ0fRgtsEuZvmCVrxwGzZEHWLeAF9G/XD+wpaA5OonceeuhF6K4H12TC3AH6ycUPIBdYOeD2askutLprLmukj8xAC5mRW4ehCnXmwjABrhLSJb7A326q6t8EO2+3u12vvMQt7xKi+aY0+wGZXSvHfiabp93OMuf3WL80A8+5NaRtby44fY6bw== defi@defi-oracle.io
+      
+      # Boot commands - executed in order
+      runcmd:
+        # Verify packages are installed
+        - |
+          echo "=========================================="
+          echo "Verifying required packages are installed..."
+          echo "=========================================="
+          for pkg in qemu-guest-agent curl wget net-tools chrony unattended-upgrades; do
+            if ! dpkg -l | grep -q "^ii.*$pkg"; then
+              echo "ERROR: Package $pkg is not installed"
+              exit 1
+            fi
+            echo "✅ Package $pkg is installed"
+          done
+          echo "All required packages verified"
+        
+        # Verify qemu-guest-agent package details
+        - |
+          echo "=========================================="
+          echo "Checking qemu-guest-agent package details..."
+          echo "=========================================="
+          if dpkg -l | grep -q "^ii.*qemu-guest-agent"; then
+            echo "✅ qemu-guest-agent package IS installed"
+            dpkg -l | grep qemu-guest-agent
+          else
+            echo "❌ qemu-guest-agent package is NOT installed"
+            echo "Attempting to install..."
+            apt-get update
+            apt-get install -y qemu-guest-agent
+          fi
+        
+        # Enable and start QEMU Guest Agent
+        - |
+          echo "=========================================="
+          echo "Enabling and starting QEMU Guest Agent..."
+          echo "=========================================="
+          systemctl enable qemu-guest-agent
+          systemctl start qemu-guest-agent
+          echo "QEMU Guest Agent enabled and started"
+        
+        # Verify guest agent service is running
+        - |
+          echo "=========================================="
+          echo "Verifying QEMU Guest Agent service status..."
+          echo "=========================================="
+          for i in {1..30}; do
+            if systemctl is-active --quiet qemu-guest-agent; then
+              echo "✅ QEMU Guest Agent service IS running"
+              systemctl status qemu-guest-agent --no-pager -l
+              exit 0
+            fi
+            echo "Waiting for QEMU Guest Agent to start... ($i/30)"
+            sleep 1
+          done
+          echo "⚠️  WARNING: QEMU Guest Agent may not have started properly"
+          systemctl status qemu-guest-agent --no-pager -l || true
+          echo "Attempting to restart..."
+          systemctl restart qemu-guest-agent
+          sleep 3
+          if systemctl is-active --quiet qemu-guest-agent; then
+            echo "✅ QEMU Guest Agent started after restart"
+          else
+            echo "❌ QEMU Guest Agent failed to start"
+          fi
+        
+        # Configure Docker
+        - systemctl enable docker
+        - systemctl start docker
+        
+        # Configure PostgreSQL
+        - systemctl enable postgresql
+        - systemctl start postgresql
+        
+        # Configure Redis
+        - systemctl enable redis-server
+        - systemctl start redis-server
+        
+        # Create financial messaging gateway directories
+        - |
+          mkdir -p /opt/financial-messaging/{config,data,archives,audit,certificates}
+          mkdir -p /opt/financial-messaging/messages/{incoming,outgoing,processed}
+          mkdir -p /opt/financial-messaging/formats/{iso20022,swift,fix,edi}
+          chown -R admin:admin /opt/financial-messaging
+        
+        # Create PostgreSQL database for financial messaging
+        - |
+          sudo -u postgres psql <<EOF
+          CREATE DATABASE financial_messaging;
+          CREATE USER financial_user WITH PASSWORD 'CHANGE_ME_ON_FIRST_LOGIN';
+          GRANT ALL PRIVILEGES ON DATABASE financial_messaging TO financial_user;
+          EOF
+        
+        # Configure Nginx reverse proxy
+        - |
+          cat > /etc/nginx/sites-available/financial-messaging <<EOF
+          server {
+              listen 80;
+              server_name financial.sankofa.nexus;
+              
+              location / {
+                  proxy_pass http://127.0.0.1:8080;
+                  proxy_http_version 1.1;
+                  proxy_set_header Upgrade \$http_upgrade;
+                  proxy_set_header Connection "upgrade";
+                  proxy_set_header Host \$host;
+                  proxy_set_header X-Real-IP \$remote_addr;
+                  proxy_set_header X-Forwarded-For \$proxy_add_x_forwarded_for;
+                  proxy_set_header X-Forwarded-Proto \$scheme;
+              }
+          }
+          EOF
+          ln -sf /etc/nginx/sites-available/financial-messaging /etc/nginx/sites-enabled/
+          rm -f /etc/nginx/sites-enabled/default
+        
+        # Configure UFW firewall
+        - ufw allow 22/tcp    # SSH
+        - ufw allow 80/tcp    # HTTP
+        - ufw allow 443/tcp   # HTTPS
+        - ufw allow 8080/tcp  # Financial Gateway (direct access)
+        - ufw allow 5000/tcp  # SWIFT (if using)
+        - ufw --force enable
+        
+        # Enable and start services
+        - systemctl enable nginx
+        - systemctl restart nginx
+        
+        # Create financial message format templates
+        - |
+          cat > /opt/financial-messaging/formats/iso20022/README.md <<EOF
+          # ISO 20022 Message Formats
+          
+          Supported message types:
+          - pain.001 (Payment Initiation)
+          - pain.002 (Payment Status Report)
+          - pacs.008 (FIToFICustomerCreditTransfer)
+          - pacs.009 (FIToFICustomerDirectDebit)
+          - camt.053 (BankToCustomerStatement)
+          - camt.054 (BankToCustomerDebitCreditNotification)
+          EOF
+          chown admin:admin /opt/financial-messaging/formats/iso20022/README.md
+        
+        # Create message processing script template
+        - |
+          cat > /opt/financial-messaging/process-message.sh <<'EOF'
+          #!/bin/bash
+          # Financial message processing script
+          # This script will be configured post-deployment
+          
+          MESSAGE_FILE=$1
+          MESSAGE_TYPE=$2
+          
+          echo "Processing financial message: $MESSAGE_FILE"
+          echo "Message type: $MESSAGE_TYPE"
+          
+          # Validation
+          # Transformation
+          # Routing
+          # Archiving
+          EOF
+          chmod +x /opt/financial-messaging/process-message.sh
+          chown admin:admin /opt/financial-messaging/process-message.sh
+      
+      # Configure automatic security updates
+        - |
+          echo "Configuring automatic security updates..."
+          cat > /etc/apt/apt.conf.d/50unattended-upgrades <<'EOF'
+          Unattended-Upgrade::Allowed-Origins {
+              "${distro_id}:${distro_codename}-security";
+              "${distro_id}ESMApps:${distro_codename}-apps-security";
+              "${distro_id}ESM:${distro_codename}-infra-security";
+          };
+          Unattended-Upgrade::AutoFixInterruptedDpkg "true";
+          Unattended-Upgrade::MinimalSteps "true";
+          Unattended-Upgrade::Remove-Unused-Kernel-Packages "true";
+          Unattended-Upgrade::Remove-Unused-Dependencies "true";
+          Unattended-Upgrade::Automatic-Reboot "false";
+          Unattended-Upgrade::Automatic-Reboot-Time "02:00";
+          EOF
+          systemctl enable unattended-upgrades
+          systemctl start unattended-upgrades
+          echo "Automatic security updates configured"
+        
+        # Configure NTP (Chrony)
+        - |
+          echo "Configuring NTP (Chrony)..."
+          systemctl enable chrony
+          systemctl restart chrony
+          sleep 3
+          if systemctl is-active --quiet chrony; then
+            echo "NTP (Chrony) is running"
+            chronyc tracking | head -1 || true
+          else
+            echo "WARNING: NTP (Chrony) may not be running"
+          fi
+        
+        # SSH hardening
+        - |
+          echo "Hardening SSH configuration..."
+          if ! grep -q "^PermitRootLogin no" /etc/ssh/sshd_config; then
+            sed -i 's/^#PermitRootLogin.*/PermitRootLogin no/' /etc/ssh/sshd_config
+            sed -i 's/^PermitRootLogin yes/PermitRootLogin no/' /etc/ssh/sshd_config
+          fi
+          if ! grep -q "^PasswordAuthentication no" /etc/ssh/sshd_config; then
+            sed -i 's/^#PasswordAuthentication.*/PasswordAuthentication no/' /etc/ssh/sshd_config
+            sed -i 's/^PasswordAuthentication yes/PasswordAuthentication no/' /etc/ssh/sshd_config
+          fi
+          if ! grep -q "^PubkeyAuthentication yes" /etc/ssh/sshd_config; then
+            sed -i 's/^#PubkeyAuthentication.*/PubkeyAuthentication yes/' /etc/ssh/sshd_config
+          fi
+          systemctl restart sshd
+          echo "SSH hardening completed
+      
+# Write files for security configuration
+      write_files:
+        - path: /etc/apt/apt.conf.d/20auto-upgrades
+          content: |
+            APT::Periodic::Update-Package-Lists "1";
+            APT::Periodic::Download-Upgradeable-Packages "1";
+            APT::Periodic::AutocleanInterval "7";
+            APT::Periodic::Unattended-Upgrade "1";
+          permissions: '0644'
+          owner: root:root
+      
+# Final message
+      final_message: |
+        ==========================================
+  providerConfigRef:
+    name: proxmox-provider-config
+

examples/production/phoenix/git-server.yaml

@@ -0,0 +1,238 @@
+apiVersion: proxmox.sankofa.nexus/v1alpha1
+kind: ProxmoxVM
+metadata:
+  name: phoenix-git-server
+  namespace: default
+  labels:
+    tenant.sankofa.nexus/id: "infrastructure"
+    environment: "production"
+    app: "phoenix"
+    component: "git"
+spec:
+  forProvider:
+    node: "ml110-01"
+    name: "phoenix-git-server"
+    cpu: 8
+    memory: "16Gi"
+    disk: "500Gi"
+    storage: "local-lvm"
+    network: "vmbr0"
+    image: "local:iso/ubuntu-22.04-cloud.img"
+    site: "site-1"
+    userData: |
+      #cloud-config
+      # Package management
+      package_update: true
+      package_upgrade: true
+
+      # Time synchronization (NTP)
+      ntp:
+        enabled: true
+        ntp_client: chrony
+        servers:
+          - 0.pool.ntp.org
+          - 1.pool.ntp.org
+          - 2.pool.ntp.org
+          - 3.pool.ntp.org
+      
+      
+      # Required packages
+      packages:
+        - qemu-guest-agent
+        - curl
+        - wget
+        - net-tools
+        - apt-transport-https
+        - ca-certificates
+        - gnupg
+        - lsb-release
+        - chrony
+        - unattended-upgrades
+        - apt-listchanges
+        # Git and container packages
+        - git
+        - docker.io
+        - docker-compose
+        - nginx
+        - certbot
+        - python3-certbot-nginx
+        - postgresql
+        - postgresql-contrib
+        - redis-server
+        - ufw
+      
+      # User configuration
+      users:
+        - name: admin
+          groups: sudo, docker
+          shell: /bin/bash
+          sudo: ALL=(ALL) NOPASSWD:ALL
+          lock_passwd: false
+          ssh_authorized_keys:
+            - ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDbGtLMmN6px4J2QUYk0BjnNT2wytgiTLSDzL+AwhE6qQWbL+h8AeFET2CHeEf09m5KYLAbHkYTq5aUleuXsluPer9A5moPD1UfdSVLpyyIv8OvKU4mnabk4z31yenPD7Wn1hKd3WoZs2ZflFIvzXaVGBoQXFlWztWLO1fh6CXmppf731FMcTMr4x7uxd8dkG4B400a1xWFx7H4e/u33KDUApqimTrwPTfooRLuyyKV7FWpopSvbSl0ANkZsuyrjbQRR3uD66iQaI60sZArTjhjwnJz+VCOnmJhlGmfMMwov4SOemt+Ut3x0Z6CwagjvxbpGf4hoI9coYD89IFzYwXVUyB9CyvlxEyPTX3v8QwIEZtWWPDStAHTkwZ80z+LU/pvP12Su32D4Wu+ziDkONVpxh1Qh6tV+jvuA9oSKno9jLa4FO0ZTs4bPkww8AbglH3h+dV7zd7qtwwW1oeSw5GHaOq/NetfpvPVuYkOe0IxVvlODZ/d6vAjCBZ0fRgtsEuZvmCVrxwGzZEHWLeAF9G/XD+wpaA5OonceeuhF6K4H12TC3AH6ycUPIBdYOeD2askutLprLmukj8xAC5mRW4ehCnXmwjABrhLSJb7A326q6t8EO2+3u12vvMQt7xKi+aY0+wGZXSvHfiabp93OMuf3WL80A8+5NaRtby44fY6bw== defi@defi-oracle.io
+      
+      # Boot commands - executed in order
+      runcmd:
+        # Verify packages are installed
+        - |
+          echo "=========================================="
+          echo "Verifying required packages are installed..."
+          echo "=========================================="
+          for pkg in qemu-guest-agent curl wget net-tools chrony unattended-upgrades; do
+            if ! dpkg -l | grep -q "^ii.*$pkg"; then
+              echo "ERROR: Package $pkg is not installed"
+              exit 1
+            fi
+            echo "✅ Package $pkg is installed"
+          done
+          echo "All required packages verified"
+        
+        # Verify qemu-guest-agent package details
+        - |
+          echo "=========================================="
+          echo "Checking qemu-guest-agent package details..."
+          echo "=========================================="
+          if dpkg -l | grep -q "^ii.*qemu-guest-agent"; then
+            echo "✅ qemu-guest-agent package IS installed"
+            dpkg -l | grep qemu-guest-agent
+          else
+            echo "❌ qemu-guest-agent package is NOT installed"
+            echo "Attempting to install..."
+            apt-get update
+            apt-get install -y qemu-guest-agent
+          fi
+        
+        # Enable and start QEMU Guest Agent
+        - |
+          echo "=========================================="
+          echo "Enabling and starting QEMU Guest Agent..."
+          echo "=========================================="
+          systemctl enable qemu-guest-agent
+          systemctl start qemu-guest-agent
+          echo "QEMU Guest Agent enabled and started"
+        
+        # Verify guest agent service is running
+        - |
+          echo "=========================================="
+          echo "Verifying QEMU Guest Agent service status..."
+          echo "=========================================="
+          for i in {1..30}; do
+            if systemctl is-active --quiet qemu-guest-agent; then
+              echo "✅ QEMU Guest Agent service IS running"
+              systemctl status qemu-guest-agent --no-pager -l
+              exit 0
+            fi
+            echo "Waiting for QEMU Guest Agent to start... ($i/30)"
+            sleep 1
+          done
+          echo "⚠️  WARNING: QEMU Guest Agent may not have started properly"
+          systemctl status qemu-guest-agent --no-pager -l || true
+          echo "Attempting to restart..."
+          systemctl restart qemu-guest-agent
+          sleep 3
+          if systemctl is-active --quiet qemu-guest-agent; then
+            echo "✅ QEMU Guest Agent started after restart"
+          else
+            echo "❌ QEMU Guest Agent failed to start"
+          fi
+        
+        # Configure Docker
+        - systemctl enable docker
+        - systemctl start docker
+        
+        # Configure PostgreSQL
+        - systemctl enable postgresql
+        - systemctl start postgresql
+        
+        # Configure Redis
+        - systemctl enable redis-server
+        - systemctl start redis-server
+        
+        # Configure Nginx
+        - systemctl enable nginx
+        - systemctl start nginx
+        
+        # Configure UFW firewall
+        - ufw allow 22/tcp    # SSH
+        - ufw allow 80/tcp    # HTTP
+        - ufw allow 443/tcp   # HTTPS
+        - ufw allow 3000/tcp # Gitea (if using)
+        - ufw allow 8080/tcp  # GitLab (if using)
+        - ufw --force enable
+        
+        # Create directories for Git repositories
+        - mkdir -p /opt/git/repositories
+        - mkdir -p /opt/git/data
+        - chown -R admin:admin /opt/git
+        
+        # Create docker-compose directory structure
+        - mkdir -p /opt/git/docker-compose
+        - chown -R admin:admin /opt/git/docker-compose
+      
+      # Configure automatic security updates
+        - |
+          echo "Configuring automatic security updates..."
+          cat > /etc/apt/apt.conf.d/50unattended-upgrades <<'EOF'
+          Unattended-Upgrade::Allowed-Origins {
+              "${distro_id}:${distro_codename}-security";
+              "${distro_id}ESMApps:${distro_codename}-apps-security";
+              "${distro_id}ESM:${distro_codename}-infra-security";
+          };
+          Unattended-Upgrade::AutoFixInterruptedDpkg "true";
+          Unattended-Upgrade::MinimalSteps "true";
+          Unattended-Upgrade::Remove-Unused-Kernel-Packages "true";
+          Unattended-Upgrade::Remove-Unused-Dependencies "true";
+          Unattended-Upgrade::Automatic-Reboot "false";
+          Unattended-Upgrade::Automatic-Reboot-Time "02:00";
+          EOF
+          systemctl enable unattended-upgrades
+          systemctl start unattended-upgrades
+          echo "Automatic security updates configured"
+        
+        # Configure NTP (Chrony)
+        - |
+          echo "Configuring NTP (Chrony)..."
+          systemctl enable chrony
+          systemctl restart chrony
+          sleep 3
+          if systemctl is-active --quiet chrony; then
+            echo "NTP (Chrony) is running"
+            chronyc tracking | head -1 || true
+          else
+            echo "WARNING: NTP (Chrony) may not be running"
+          fi
+        
+        # SSH hardening
+        - |
+          echo "Hardening SSH configuration..."
+          if ! grep -q "^PermitRootLogin no" /etc/ssh/sshd_config; then
+            sed -i 's/^#PermitRootLogin.*/PermitRootLogin no/' /etc/ssh/sshd_config
+            sed -i 's/^PermitRootLogin yes/PermitRootLogin no/' /etc/ssh/sshd_config
+          fi
+          if ! grep -q "^PasswordAuthentication no" /etc/ssh/sshd_config; then
+            sed -i 's/^#PasswordAuthentication.*/PasswordAuthentication no/' /etc/ssh/sshd_config
+            sed -i 's/^PasswordAuthentication yes/PasswordAuthentication no/' /etc/ssh/sshd_config
+          fi
+          if ! grep -q "^PubkeyAuthentication yes" /etc/ssh/sshd_config; then
+            sed -i 's/^#PubkeyAuthentication.*/PubkeyAuthentication yes/' /etc/ssh/sshd_config
+          fi
+          systemctl restart sshd
+          echo "SSH hardening completed
+      
+# Write files for security configuration
+      write_files:
+        - path: /etc/apt/apt.conf.d/20auto-upgrades
+          content: |
+            APT::Periodic::Update-Package-Lists "1";
+            APT::Periodic::Download-Upgradeable-Packages "1";
+            APT::Periodic::AutocleanInterval "7";
+            APT::Periodic::Unattended-Upgrade "1";
+          permissions: '0644'
+          owner: root:root
+      
+# Final message
+      final_message: |
+        ==========================================
+  providerConfigRef:
+    name: proxmox-provider-config
+