Update production.md docs (#730)

* Update production.md docs

* Fix tofu module instructions

Author: sjpb

docs/production.md

@@ -48,21 +48,28 @@ and referenced from the `site` and `production` environments, e.g.:
 
     ```
     ...
+    variable "environment_root" {
+      type = string
+      description = "Path to environment root, automatically set by activate script"
+    }
+
     module "cluster" {
         source = "../../site/tofu/"
+        environment_root = var.environment_root
 
         cluster_name = "foo"
         ...
     }
     ```
 
     Note that:
-        - Environment-specific variables (`cluster_name`) should be hardcoded
-          into the cluster module block.
-        - Environment-independent variables (e.g. maybe `cluster_net` if the
-          same is used for staging and production) should be set as *defaults*
-          in `environments/site/tofu/variables.tf`, and then don't need to
-          be passed in to the module.
+    
+    - Environment-specific variables (`cluster_name`) should be hardcoded
+      into the cluster module block.
+    - Environment-independent variables (e.g. maybe `cluster_net` if the
+      same is used for staging and production) should be set as *defaults*
+      in `environments/site/tofu/variables.tf`, and then don't need to
+      be passed in to the module.
 
 - Vault-encrypt secrets. Running the `generate-passwords.yml` playbook creates
   a secrets file at `environments/$ENV/inventory/group_vars/all/secrets.yml`.
@@ -120,22 +127,14 @@ and referenced from the `site` and `production` environments, e.g.:
   set the "attach" options and run `tofu apply` again - this should show there
   are no changes planned.
 
-- Enable `etc_hosts` templating:
-
-    ```yaml
-    # environments/site/inventory/groups:
-    [etc_hosts:children]
-    cluster
-    ```
-
 - Configure Open OnDemand - see [specific documentation](openondemand.md).
 
 - Remove the `demo_user` user from `environments/$ENV/inventory/group_vars/all/basic_users.yml`
 
 - Consider whether having (read-only) access to Grafana without login is OK. If not, remove `grafana_auth_anonymous` in `environments/$ENV/inventory/group_vars/all/grafana.yml`
 
-- If floating IPs are required for login nodes, modify the OpenTofu configurations
-  appropriately.
+- If floating IPs are required for login nodes, create these in OpenStack and add the IPs into
+  the OpenTofu `login` definition.
 
 - Consider whether mapping of baremetal nodes to ironic nodes is required. See
   [PR 485](https://github.com/stackhpc/ansible-slurm-appliance/pull/485).