GitHub Actions → OpenTofu → Ansible → Proxmox. When it breaks, a local LLM reads the logs and opens the fix PR. Provider-agnostic: same pipeline targets AWS.
dev / prod, approval gates, drift detection on schedule.
Proxmox today, AWS tomorrow — the pipeline doesn't care.
Failure triage by a model running on-prem. No tokens billed, no logs leaked.