Fix mgmt VM nameserver argument; record first vm run

mgmt_dns is a list, passed to qm create as one space-separated argument.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

ansible/group_vars/all.yml

@@ -18,12 +18,12 @@ proxmox_bridge: vmbr0
 proxmox_vlan: 4
 
 # Management VM (VLAN 4). Fill in the empty values before the first run.
-mgmt_vmid: ""
+mgmt_vmid: "201"
 mgmt_name: lab-mgmt
-mgmt_ip: ""
+mgmt_ip: "192.168.4.21"
 mgmt_prefix: 24
-mgmt_gateway: ""
+mgmt_gateway: "192.168.4.8"
-mgmt_dns: ""
+mgmt_dns: ["8.8.8.8", "2.2.2.2"]
 mgmt_cores: 2
 mgmt_memory_mib: 4096
 mgmt_disk_size: 30G

ansible/mgmt.yml

@@ -55,7 +55,7 @@
             --ciuser ubuntu
             --sshkeys /root/{{ mgmt_name }}.pub
             --ipconfig0 ip={{ mgmt_ip }}/{{ mgmt_prefix }},gw={{ mgmt_gateway }}
-            --nameserver {{ mgmt_dns }}
+            --nameserver '{{ mgmt_dns | join(' ') }}'
           changed_when: true
 
         - name: Grow the disk

docs/plans-executions/2026-09-27-0058-mgmt-cluster-ansible.md

@@ -55,3 +55,23 @@ uvx --from 'ansible-core>=2.18,<2.19' ansible pve -m ping -o
 - VM params (`mgmt_vmid`, `mgmt_ip`, `mgmt_gateway`, `mgmt_dns`) are empty in `group_vars/all.yml`;
   Play 1 asserts on them.
 - `clusterctl` is not installed on the laptop either (needed for phase-1 Step 3, not for this playbook).
+
+## Step 2 — Playbook runs (in progress)
+
+### `--tags vm`, first attempt (2026-09-27 09:30 CEST, owner)
+
+Owner authorised the laptop key on `pv1-1`, installed ansible locally and filled in VM params
+(`mgmt_vmid: 201`, `mgmt_ip: 192.168.4.21/24`, gateway `192.168.4.8`).
+
+```bash
+ansible-playbook mgmt.yml --tags vm
+# TASK [Create the VM]
+# "cmd": [..., "--nameserver", "8.8.8.8,", "2.2.2.2"]
+# stderr: 400 too many arguments
+```
+
+`mgmt_dns` was the string `"8.8.8.8, 2.2.2.2"`; the command module splits on whitespace, so
+`qm` got two positional leftovers. Fix: `mgmt_dns` is now a list and the task passes
+`--nameserver '{{ mgmt_dns | join(' ') }}'` as one argument (space-separated is PVE's format for
+the cloud-init nameserver list). Image download and key staging had already succeeded and are
+idempotent on re-run; `qm status 201` confirmed no half-created VM was left behind.