ansible: describe what runs on the servers

The roles had drifted far from production: Forgejo was pinned at 12
while 15.0.11 runs, its config lacked the mailer, packages and the real
database path, and several services existed only on the hosts. Running
a role would have rolled production back. Take the servers as the truth
and make the repository match them.

site.yaml now holds the desired state of both hosts:

 - base: unattended upgrades, fail2ban, Docker daemon config and the
   weekly image prune, as found on the hosts. New: a 500M journal cap,
   and the Docker systemd override is kept absent. That override once
   opened dockerd on tcp/2375 without authentication.
 - traefik: templates as deployed, version in a variable (v3.7.18).
   The Coraza WAF files are removed; no router ever used them.
 - forgejo: 15.0.11, app.ini generated from the live file with the
   secrets taken from the vault.
 - crawler_alert, sillytavern, minecraft, minecraft_fossils: added
   from the hosts.

Forgejo's canonical name becomes git.asxp.io; git.czsk.it stays as an
alias on the same router.

docker_service restarts a stack when its config changes, no longer
forces ownership on existing data directories, and hides template
diffs because they carry secrets. Containers listed in
service_graceful_stop are saved and stopped with a long timeout before
compose recreates them: Docker's 10 s default is too short for a
Minecraft world. Both game servers get stop_grace_period for the same
reason.

Removed: the full-deployment and runner playbooks with their prompts,
the Forgejo backup and restore roles for the old bare-metal host, and
inventory entries for services that were never deployed. SSH hardening
stays a manual playbook, since a mistake there locks everyone out.

New secrets (SMTP, RCON, CurseForge key) went into the vault.

Assisted-by: Claude:fable-5-2

ansible/roles/base/defaults/main.yaml

@@ -0,0 +1,4 @@
+---
+journald_max_use: 500M
+# Weekly cleanup of images no container uses; every deploy leaves one behind
+docker_prune_schedule: "0 3 * * 1"

ansible/roles/base/files/20auto-upgrades

@@ -0,0 +1,2 @@
+APT::Periodic::Update-Package-Lists "1";
+APT::Periodic::Unattended-Upgrade "1";

ansible/roles/base/files/daemon.json

@@ -0,0 +1,7 @@
+{
+  "live-restore": true,
+  "storage-driver": "overlay2",
+  "log-opts": {
+    "max-size": "20m"
+  }
+}

ansible/roles/base/handlers/main.yaml

@@ -0,0 +1,12 @@
+---
+- name: Restart journald
+  ansible.builtin.systemd:
+    name: systemd-journald
+    state: restarted
+
+# live-restore is on, so containers keep running across this restart
+- name: Restart docker
+  ansible.builtin.systemd:
+    name: docker
+    state: restarted
+    daemon_reload: true

ansible/roles/base/tasks/main.yaml

@@ -0,0 +1,76 @@
+---
+# Host baseline shared by both servers. Users, Docker itself and the
+# first-boot packages come from terraform/cloud-init; SSH and WireGuard
+# have their own bootstrap playbooks.
+
+- name: Install baseline packages
+  ansible.builtin.apt:
+    name:
+      - unattended-upgrades
+      - fail2ban
+    state: present
+
+- name: Enable unattended security upgrades
+  ansible.builtin.copy:
+    src: 20auto-upgrades
+    dest: /etc/apt/apt.conf.d/20auto-upgrades
+    mode: "0644"
+
+- name: Keep fail2ban running (sshd jail from the Debian defaults)
+  ansible.builtin.systemd:
+    name: fail2ban
+    enabled: true
+    state: started
+
+- name: Create journald drop-in directory
+  ansible.builtin.file:
+    path: /etc/systemd/journald.conf.d
+    state: directory
+    mode: "0755"
+
+- name: Cap the journal size
+  ansible.builtin.copy:
+    dest: /etc/systemd/journald.conf.d/size.conf
+    content: |
+      [Journal]
+      SystemMaxUse={{ journald_max_use }}
+    mode: "0644"
+  notify: Restart journald
+
+- name: Configure the Docker daemon
+  ansible.builtin.copy:
+    src: daemon.json
+    dest: /etc/docker/daemon.json
+    mode: "0644"
+  notify: Restart docker
+
+# dockerd must only listen on its unix socket. A drop-in once added
+# -H tcp://<vpc ip>:2375, which gave every container on the private
+# network unauthenticated root on this host.
+- name: Remove any Docker systemd override
+  ansible.builtin.file:
+    path: /etc/systemd/system/docker.service.d/override.conf
+    state: absent
+  notify: Restart docker
+
+- name: Prune unused Docker images weekly
+  ansible.builtin.copy:
+    dest: /etc/cron.d/docker-image-prune
+    content: |
+      {{ docker_prune_schedule }} root docker image prune -af > /var/log/docker-prune.log 2>&1
+    mode: "0644"
+
+- name: Check for the old prune entry in root's crontab
+  ansible.builtin.command: crontab -l
+  register: root_crontab
+  changed_when: false
+  failed_when: false
+  check_mode: false
+
+- name: Drop the old prune entry from root's crontab
+  ansible.builtin.shell: |
+    set -o pipefail
+    crontab -l | grep -v 'docker image prune' | crontab -
+  args:
+    executable: /bin/bash
+  when: "'docker image prune' in root_crontab.stdout"