ansible: describe what runs on the servers

The roles had drifted far from production: Forgejo was pinned at 12
while 15.0.11 runs, its config lacked the mailer, packages and the real
database path, and several services existed only on the hosts. Running
a role would have rolled production back. Take the servers as the truth
and make the repository match them.

site.yaml now holds the desired state of both hosts:

 - base: unattended upgrades, fail2ban, Docker daemon config and the
   weekly image prune, as found on the hosts. New: a 500M journal cap,
   and the Docker systemd override is kept absent. That override once
   opened dockerd on tcp/2375 without authentication.
 - traefik: templates as deployed, version in a variable (v3.7.18).
   The Coraza WAF files are removed; no router ever used them.
 - forgejo: 15.0.11, app.ini generated from the live file with the
   secrets taken from the vault.
 - crawler_alert, sillytavern, minecraft, minecraft_fossils: added
   from the hosts.

Forgejo's canonical name becomes git.asxp.io; git.czsk.it stays as an
alias on the same router.

docker_service restarts a stack when its config changes, no longer
forces ownership on existing data directories, and hides template
diffs because they carry secrets. Containers listed in
service_graceful_stop are saved and stopped with a long timeout before
compose recreates them: Docker's 10 s default is too short for a
Minecraft world. Both game servers get stop_grace_period for the same
reason.

Removed: the full-deployment and runner playbooks with their prompts,
the Forgejo backup and restore roles for the old bare-metal host, and
inventory entries for services that were never deployed. SSH hardening
stays a manual playbook, since a mistake there locks everyone out.

New secrets (SMTP, RCON, CurseForge key) went into the vault.

Assisted-by: Claude:fable-5-2

ansible/inventory/group_vars/all/vault.yaml

@@ -1,87 +1,106 @@
 $ANSIBLE_VAULT;1.1;AES256
-62313564376664646635373735353930353765633834323532646230633033393738376335313666
-3537393466636230353539313938656537333665636136640a653338306635333331383932663965
-39643137366165623666636135646638623830633563313133326231623030643665633062616336
-3035386162363566660a373666353366393034306135373830356166373861633035346637333339
-32346466363162353663663966323635346338333265303565386166373837626437356632383162
-64666536316438346464666165616437376230343763343738363738373130363833393730303138
-62393736326562313230333331633232363362613839393330353133316536343235383464303634
-34396163626530383564396637336365633033373461623233633630626237336231333466346631
-37323439636239663861653065663532343730313130663663626361353835356662613232663062
-62386130313533613430303035653430313866623335303134383738316430346262633639346334
-63326333653761613239663932306135366236376335643733366535666430633938613966386164
-61633137383866396533323831666462346438633830376561623431333666313531623133656230
-30343862383534623062343537326463623731323435363837383038316539376131363534366164
-30323666663338613466626534376562613539383563633765626238633763396235356639393831
-35636138356435376132336365666363633965623965343165303261323831363366666164373061
-31656239356664623038376231363765386664336135373637383165653966373035353836363264
-39366161646334376430623261353230653930623966616535303565383962633339323563363666
-30343834323430333562666230313334366339313838643662376437323236633761386333373336
-36653132393564653431396662613936636639653231646365353836633830616430323430363561
-33313130313633356539303363613731383930623937643461613665626437623365303766353862
-34386566396530343638313334306530633962653235623561326234363639313233666332616130
-62663235663863666230653363663863663031323563383235356465626463303834623464383835
-61626463343638626530376564343333633738313937326662643133633364353232643135666462
-66363965663436303638363535363332363033313766313335393235363230666234643764653732
-62653261656332326461363961353863346563323638326161656331323538643934383665393536
-37323265396662646163363066643237656235616462373337633338623661363037316131323762
-62653562626237316139363833633039636365643438656230656134363634393139386334376431
-36373534326439323130336431303531366565653263323364323139383632643436613839326434
-35643136363664626630346436656562626363633864356132393035343037633632366436393866
-65616363343062656336303463313431363333336365613632393163356531323838333062613664
-65393430313732346364323736333361363363396433313666636433626139353766346165363637
-34616634313833393162393738376466613338616433393235663930663630356561643237663063
-35363832363365653137313830356666323631653535363063366134303164303364643366613466
-66613030383131633735313065383736316635613437393439393437613363386234356535353534
-32613436346439643835636665656537336534643665323961666632613462633839616637393033
-62383966616666613565653732616164623136323861313365333532393931353338666565336430
-30626638363234623662333638633962313633306536323964343731653362313935363932626331
-38613935643861353830373839393465356334356361656335303732336363306263356463396665
-62633432613838363431653338356639383138343431303632666361313863663938643134626361
-66363666633431343831396637353463366366306135646163633563376437663663353033333865
-38323638333664623037386531323063376533623962366530636137363065616361646464663431
-32326363343163303535643865356539396664393233633639633639346137663635366133636437
-34373839623932626130336265623565313233646562653063343739333539306631353863393337
-61353531303339343963306463613339386530366432646336333039336639326165386562333835
-38373665396138616264646434316333363838333765353436393433656330373738333662373033
-37633234343265373133336331393538303965326366663134353936613439656561356438306231
-62313338383439653835316566663039303330306564626634346165386366393135646137393835
-63316431396439653738656239643565366632616133653039313736333034353032313533363662
-36383661663331633961353839386464656134623337353561613135303865363463346638346263
-32333634343162393266353235326635336332623566353838353566323030663732643531663234
-65616234643931346533333365643263323135366236316363636566613032643636623130306230
-33666266373432303132303438656533653331333636396235623164353730343961376361383838
-35386330616439363662396165643631616638656466313933396339303632323232363638326263
-62326337373534616463633062613261636631656464336663313239636432373230383434363937
-39353764623636343534613639353032643632373334623536373665383538623135316238393937
-33633666636531306666306432666462306137653036643866653365373265646437663362313835
-65613431643030313833333839666663366435613065323033666234653530663837363462383138
-37363739386231646234386265343531303163613563303833623534353832396131336235633362
-32666631653933376130616632333031306331323931336566663764373262376637313465383535
-35356332663931313862376365346361613632306166643433386436666435333233623361323934
-35373031663863343239636435646165323763313137626161623238383365323662623934383162
-34356236386339316533373139663562393531333831666136626162616366633461333863613063
-34376534663135343939373439303966633133353632616530626433303463656634306539653139
-63376561363331306266343033336162663334663638323231323532373239393562383238383831
-32323635356534636637303534393832326566306562633762313363363563643764663063656131
-38323061363438366330613239643937616430313865356366343435343736346633393736333131
-66656635336234663938373433646465383061366139313230663539303365616261336338363565
-36316130303836363366303437373762353061363733343861613530666663363738363032323631
-37613634656532626436343639383431353532316435376232663962636238383862353830313634
-39376262353332663438313062316430383366393265323064613038363763333465373561663430
-62306638623165386636316531396535313134396232343332336663333834636532393530376334
-34333037323830646330303562353439383031356165376564303338323630383337616131636133
-64663665306466633538323330333731386233306130366634646637663839323130633065313462
-66633337346264313561663135323034633636646131303234363132633335313966646534646461
-62353131346666323862323461623437363930333064373439333166656430646237393832373462
-63393430646531323835386462326635313861646335323564643630376131626137616231303335
-39623533383939353966356636656337343336336130643333323236303739393263633562633534
-38666632316432663332626437626337376533393139353731383835376131643035313866386265
-33323333613766333932333637353563366462303763613562333963373537343837653535653631
-33383331396363396439646534323832613165393062623332393537393731373234396634363237
-36343839363163356232333936663230336266376432373433393964313436616637633865636435
-33633835353337613233616438396537393166346464313563643536623835613636373436633562
-33366633326130646138373539656336363034346438326361333539626563613734636138376533
-62313863613237316237346330326330623462346539356330333265383163353733613464326238
-36363131613461643235373937326130383063353534393133636339373439656238333232653263
-6137343166303139343338663639306434656262343139653437
+37373533663231633738353864666365663334666134346462306537373463616438663334613764
+6264643666356130396536323235333837316431373536370a623833383939373038366263393161
+62623563386130666637353164363331373061643563313861643239313363323234303738343738
+3864363533393962650a633633613138313066336238336363306161306430626165343039356664
+64643333633938306138636334656631316232626539336466313033373430623263376635626238
+33343839656639366363313535663561666535376461616366376232303034343064626334626432
+36663362386561616537343835373839363632363730386666653066343731643330623266353434
+39306664363561316138363862356663366365643738336536353137396463623630343430346137
+63336164393939666266306536363435663661663939333238373639346431636635323834356437
+31316632333731343362303331353338333830356635643431316165633963356264376134623665
+37626263336339386234376534366463646537623631303462366466633034343932346132363532
+65313237303966333864373664303931653833323036316434666338353430303333386338356262
+62633533613061653262323630366230303561623661303233316131373066343666303635323637
+63313739623230336461613530623732636262393239306663643835396365636166616536316336
+39376163633937353564343766326462663362396239383835363030393539393936383535353561
+64643231346465393261626266666532636265356531356463393839636265613431383335663263
+32353864333335333632653461366338386664373939623234306466323933316161633364353437
+31626164386430656432363861316464313336613466383562663838393738633337303139386264
+61363933653237653237353836313733666266666534333331376633643938323264623664663733
+38616565343830616638623032646533653433663935363563336665623638313637643337646439
+63666661366463313131363433643461626361303130653761333538303739653265646263626263
+37373137373038643365326566383237393236613831393833326630386237316133333935336234
+32353732633334393830306435313435363538626566386135326338363630666561623633323865
+62313732363562643766386462646531383238363962313437373735313262633162643666303136
+30393332663865313064653233653761333364306134646163373365376532393838666262366535
+38633135363932636533333139386136363964316538316435343633666637306139313033666531
+39396138346461333238623362343162663366333738616663353963653061663531343230326265
+62353466393564666462633462303939346532323931306533323132643862653265346137353738
+63366238323130656430313831326330623961383237346436633165366634356466636162646261
+30303962386532353739643464653139386336393737316266653764373738373530323863326233
+36383135366336333831383438323261636665666331663338613266666338623630363533366338
+62626231306135643830336235353338396336646238396633363561326163623132653638306131
+39356634313130373862356263393364623337363136626361396536616631326233343730643864
+63633633343662343833333064356432373235653864303863656163643830333339656265646639
+65623636333630643236316434326264356435393837626330383962336161633262356638393266
+66323337346434333563323032393563663831653437336634613665306331366662623530393263
+34313033303966633235323339356461356630636238313031633834383434343035353438383035
+32386462323232623861626530373663333564333932616563613432383134393661303264303130
+30353431353062373533303237653966373762346264613734643730663932643633353631666565
+33633337633561343733623434653862383364646434663333366334323739653933313537363366
+65396532346439653334653739376562343136346266333739396630373166613763313563396133
+30303530326465653339343035623333646238393034323862623765633139396364346339326233
+36656664303536623834326662666537343537643336366138383935343065313538613363373966
+35393961356531623262363163343034656130383235373937643639613331356333323964633966
+65343632303237653939393438636137316332313931353934313034326366623832353363636564
+66363437616663356431613063613535666336383730333337623439653130653439663830633534
+39356266346231323535646265646439326137346361656632323564313435626165643231653735
+62636530383961343662393232666664363034656534663762393262356163336337373862316331
+62346535636464633363663330323335386230633465613965613630613135366131313138653061
+36613930653430643236323162643864353863323264323731333037306433376236306138303032
+65333963333364326665616333353031323761653764316362336337386230633736363766333662
+64316662343265623064643031326534346639353566376661343462613537373862303233316538
+64323364366430326264366232666263396235363736366437346438656265386464323264653733
+63363263636233353761356331613330353535346336366437613837343061663362663031333964
+34396366313363383863303035633934376432393334663364313866396166623563646530663632
+64613336653635636564373632646337386438333431326264373766306564326430326237363964
+65386631393135313566656435353039363638393535613063393730316634313837623630323161
+36356331323165613537386164343831386633663936313537306639633262633239353830313530
+31363066316332373035656134333937373263633561616431323334336335656131383436626464
+64356634626636356331383962643735303335363863343561373736363134646536393431346432
+62373434323665343533636237363461303335663632326332633535303139393433623032613465
+66383137613531376333323431356566653462616330656532633361623338343637613239303433
+62626537373165666562646561373731383436353436323434653562396334313639616661643935
+30616431313936626637353966366531316463616366306335656664613366303665346263633830
+31303939623631636463366132613866343032633365326433356463643832353230653339646161
+34636637373464386162623961373933363863346637313535643134613265383166393634656131
+64343930643162613362386465306465333235663461303566366266303664316565396563333433
+61356130333833653330666633346663373634396634383030346138313938636134303666623962
+62356636633062646639323963653565386464373736626161633565303335336262383230363732
+39393539333262326234333537356461663033303933383237346235373734656536303862333236
+65643563343932333632386635346438323339343463323338383865343362333430346338633932
+32386139343866633139313533663832356633633663616261386364373065373365386334383932
+63663334616532316133353565643936643035346464643936643862333466363166333066326338
+30326462333463393834303836653437353033313736643365313739313334383030636535656434
+32373231366462643233363837373133366139366130393537363361346133653839396432343936
+34303030373638303934343463326365663466633963323033323066383734336331353864313564
+64393638353735646233326638346464336637373465663562336661363834343138376635323363
+65356537356137336563383866356665383132366136633035646363393933643165656236313863
+30386363393466636435643666663533623332656232393537656161613837663064353838653835
+66666164386566663536653833613062333432363966303066323563363664333464633038353561
+32626634643264373132323638643766386362613639303262633462663737663337393631303436
+62326438396235666338313033383835306566366365396331653633323335333865366565343036
+62313835333964366537323565653662323563383663323033623939346533656665303235313264
+32623163383530376233353738633062346530376161353664333166323538666465363237616166
+34633561636234623263663535333939306239303334363939616636343334383838643939636664
+63623331306332386634646533396232323063336166613339636533353337306531636135313465
+39636164323537643230353234303666313161633366633831356530633635636561373461643136
+66323734386239656635633365373734643038636566626666646434663061333530633837633166
+38663633393764346565316639323638623039326332646432666232656463626335313737623862
+66386439616635633061356461343736656138633064653733643737636361626366313733356665
+34346565613330663938333563623436323934353934393235356234613766633235316137376632
+32386333373235393837393035653538303433373733386562623037363837396431393531303839
+31633162386637333963633335383662623661336133653866653336376366363665623165633032
+65636261616664326661333930343862663766393035613164313837333561326330333930643166
+38393161316364306139376234643363346564613463613536613534373936653532353861633139
+39663130316130366333303834386162343336346664316439373839333465356564303062633434
+62626337616366303730663661383863653834623537333933616239386264326634656235363166
+63323061343639666135306437356665313466326339356230376234363964653631643561633236
+31386339343033353062383231666135303338356335366335663763383237626138633961393239
+66363539333161313138626332303662366336323266643062663762323561656634636539336265
+34653736306231356135626435653736366133386538643338346463653231653333306633666532
+61323266303764653734643262363564656233653135623234663232353762653766313565613736
+31613432363333366233323165616561646366643634376639343966373635343335343661636462
+32613563613139363932636330663764353164316231333461653965373635363337633662653962
+35346463643363376633356234626464666332646331643132643138346665393937

ansible/inventory/group_vars/ops_servers/forgejo.yaml

@@ -1,25 +1,25 @@
 ---
-# Forgejo Git server configuration
+forgejo_version: "15.0.11"
 
-# Forgejo version and domain
-forgejo_version: "12"
+# The instance answers on every name below. forgejo_domain is the
+# canonical one (ROOT_URL, clone URLs, mail links); the rest are aliases.
 forgejo_domain: git.asxp.io
+forgejo_alias_domains:
+  - git.czsk.it
 
-# Forgejo installation path
 forgejo_base_path: "{{ services_base_path }}/forgejo"
-
-# Forgejo ports
 forgejo_http_port: 3000
 
-# Forgejo secrets (stored in encrypted vault)
+# app.ini is owned by the container's git user
+forgejo_uid: 1000
+forgejo_gid: 1000
+
+traefik_network: traefik
+
 forgejo_secret_key: "{{ vault_forgejo_secret_key }}"
 forgejo_internal_token: "{{ vault_forgejo_internal_token }}"
 forgejo_jwt_secret: "{{ vault_forgejo_jwt_secret }}"
 forgejo_lfs_jwt_secret: "{{ vault_forgejo_lfs_jwt_secret }}"
-
-# Backup configuration
-backup_dest_dir: /opt/forgejo-backup
-backup_old_server: asxpio-old
-
-# Docker network for Traefik integration
-traefik_network: traefik
+forgejo_server_lfs_jwt_secret: "{{ vault_forgejo_server_lfs_jwt_secret }}"
+forgejo_smtp_user: "{{ vault_forgejo_smtp_user }}"
+forgejo_smtp_password: "{{ vault_forgejo_smtp_password }}"

ansible/inventory/group_vars/ops_servers/traefik.yaml

@@ -1,11 +1,7 @@
 ---
-# Traefik reverse proxy configuration
-
-# Traefik installation path
+traefik_version: "v3.7.18"
 traefik_base_path: "{{ services_base_path }}/traefik"
-
-# Traefik ports
 traefik_dashboard_port: 8080
+traefik_network: traefik
 
-# SSL/TLS configuration
 letsencrypt_email: "{{ vault_letsencrypt_email }}"

ansible/inventory/group_vars/services_servers/forgejo_runner.yaml

@@ -15,3 +15,6 @@ forgejo_runner_token: "{{ vault_forgejo_runner_token }}"
 
 # Runner installation path
 forgejo_runner_base_path: "{{ services_base_path }}/forgejo-runner"
+
+# The runner talks to Forgejo over the VPC, not through Traefik
+forgejo_http_port: 3000

ansible/inventory/group_vars/services_servers/minecraft.yaml

@@ -0,0 +1,4 @@
+---
+minecraft_fossils_owner: asxpi
+minecraft_fossils_rcon_password: "{{ vault_minecraft_fossils_rcon_password }}"
+minecraft_fossils_cf_api_key: "{{ vault_minecraft_fossils_cf_api_key }}"