feat: add build job

- add build job that runs `make plan`
- enable provider caching
- enable creating client.crt/client.key

Makefile

@@ -12,7 +12,12 @@ define vault_env
 	export PUPPET_CERT_PRIV=$$(vault kv get -field=private_key kv/service/puppet/certificates/terraform) && \
 	export TG_QUEUE_EXCLUDE_DIR="templates/base" && \
 	export TG_PROVIDER_CACHE=1 && \
-	export $$(vault read -format=json kv/data/service/terraform/incus | jq -r '.data.data | to_entries[] | "\(.key)=\(.value)"')
+	eval "$$(vault read -format=json kv/data/service/terraform/incus \
+	  | jq -r '.data.data | to_entries[] | "export \(.key)=\(.value|@sh)"')" && \
+	export INCUS_CONFIG_DIR=$$(mktemp -d) && \
+	mkdir -p $$INCUS_CONFIG_DIR && \
+	printf '%s\n' "$$INCUS_CLIENT_CRT" > $$INCUS_CONFIG_DIR/client.crt && \
+	printf '%s\n' "$$INCUS_CLIENT_KEY" > $$INCUS_CONFIG_DIR/client.key
 endef
 
 clean:

config/nodes/ausyd1nxvm2062_images/terragrunt.hcl

@@ -34,8 +34,9 @@ generate "provider" {
   if_exists = "overwrite_terragrunt"
   contents  = <<-EOF
     provider "incus" {
-      generate_client_certificates = true
+      generate_client_certificates = false
       accept_remote_certificate    = true
+      config_dir = "${get_env("INCUS_CONFIG_DIR")}"
 
       remote {
         name    = "${basename(get_terragrunt_dir())}"

config/nodes/prodnxsr0009/terragrunt.hcl

@@ -26,8 +26,9 @@ generate "provider" {
   if_exists = "overwrite_terragrunt"
   contents  = <<-EOF
     provider "incus" {
-      generate_client_certificates = true
+      generate_client_certificates = false
       accept_remote_certificate    = true
+      config_dir = "${get_env("INCUS_CONFIG_DIR")}"
 
       remote {
         name    = "${basename(get_terragrunt_dir())}"

config/nodes/prodnxsr0010/terragrunt.hcl

@@ -26,8 +26,9 @@ generate "provider" {
   if_exists = "overwrite_terragrunt"
   contents  = <<-EOF
     provider "incus" {
-      generate_client_certificates = true
+      generate_client_certificates = false
       accept_remote_certificate    = true
+      config_dir = "${get_env("INCUS_CONFIG_DIR")}"
 
       remote {
         name    = "${basename(get_terragrunt_dir())}"

config/nodes/prodnxsr0011/terragrunt.hcl

@@ -26,8 +26,9 @@ generate "provider" {
   if_exists = "overwrite_terragrunt"
   contents  = <<-EOF
     provider "incus" {
-      generate_client_certificates = true
+      generate_client_certificates = false
       accept_remote_certificate    = true
+      config_dir = "${get_env("INCUS_CONFIG_DIR")}"
 
       remote {
         name    = "${basename(get_terragrunt_dir())}"

config/nodes/prodnxsr0012/terragrunt.hcl

@@ -26,8 +26,9 @@ generate "provider" {
   if_exists = "overwrite_terragrunt"
   contents  = <<-EOF
     provider "incus" {
-      generate_client_certificates = true
+      generate_client_certificates = false
       accept_remote_certificate    = true
+      config_dir = "${get_env("INCUS_CONFIG_DIR")}"
 
       remote {
         name    = "${basename(get_terragrunt_dir())}"

config/nodes/prodnxsr0013/terragrunt.hcl

@@ -26,8 +26,9 @@ generate "provider" {
   if_exists = "overwrite_terragrunt"
   contents  = <<-EOF
     provider "incus" {
-      generate_client_certificates = true
+      generate_client_certificates = false
       accept_remote_certificate    = true
+      config_dir = "${get_env("INCUS_CONFIG_DIR")}"
 
       remote {
         name    = "${basename(get_terragrunt_dir())}"