ansible: describe what runs on the servers

The roles had drifted far from production: Forgejo was pinned at 12
while 15.0.11 runs, its config lacked the mailer, packages and the real
database path, and several services existed only on the hosts. Running
a role would have rolled production back. Take the servers as the truth
and make the repository match them.

site.yaml now holds the desired state of both hosts:

 - base: unattended upgrades, fail2ban, Docker daemon config and the
   weekly image prune, as found on the hosts. New: a 500M journal cap,
   and the Docker systemd override is kept absent. That override once
   opened dockerd on tcp/2375 without authentication.
 - traefik: templates as deployed, version in a variable (v3.7.18).
   The Coraza WAF files are removed; no router ever used them.
 - forgejo: 15.0.11, app.ini generated from the live file with the
   secrets taken from the vault.
 - crawler_alert, sillytavern, minecraft, minecraft_fossils: added
   from the hosts.

Forgejo's canonical name becomes git.asxp.io; git.czsk.it stays as an
alias on the same router.

docker_service restarts a stack when its config changes, no longer
forces ownership on existing data directories, and hides template
diffs because they carry secrets. Containers listed in
service_graceful_stop are saved and stopped with a long timeout before
compose recreates them: Docker's 10 s default is too short for a
Minecraft world. Both game servers get stop_grace_period for the same
reason.

Removed: the full-deployment and runner playbooks with their prompts,
the Forgejo backup and restore roles for the old bare-metal host, and
inventory entries for services that were never deployed. SSH hardening
stays a manual playbook, since a mistake there locks everyone out.

New secrets (SMTP, RCON, CurseForge key) went into the vault.

Assisted-by: Claude:fable-5-2

ansible/roles/forgejo/tasks/main.yaml

@@ -5,19 +5,22 @@
 - name: Configure SSH passthrough
   ansible.builtin.import_tasks: ssh-passthrough.yaml
 
-- name: Deploy Forgejo using shared docker_service role
+- name: Deploy Forgejo
   ansible.builtin.include_role:
     name: docker_service
   vars:
     service_name: "forgejo"
     service_base_path: "{{ forgejo_base_path }}"
     service_directories:
-      - { path: "data", mode: "0755" }
-      - { path: "config", mode: "0755" }
+      - { path: "data" }
+      - { path: "config" }
     service_templates:
-      - { src: "app.ini.j2", dest: "config/app.ini", mode: "0644" }
-      - { src: "docker-compose.yml.j2", dest: "docker-compose.yml", mode: "0644" }
-    health_check_enabled: true
-    health_check_url: "http://localhost:{{ forgejo_http_port }}/"
+      - src: "app.ini.j2"
+        dest: "config/app.ini"
+        owner: "{{ forgejo_uid }}"
+        group: "{{ forgejo_gid }}"
+        mode: "0600"
+      - { src: "docker-compose.yml.j2", dest: "docker-compose.yml" }
+    health_check_url: "http://localhost:{{ forgejo_http_port }}/api/v1/version"
     health_check_delay: 5
-    health_check_retries: 15
+    health_check_retries: 30

ansible/roles/forgejo/tasks/ssh-passthrough.yaml

@@ -1,45 +1,32 @@
 ---
+# git@<host> lands on the host's sshd, which hands the session to the
+# Forgejo container. Keys are looked up through the container too
+# (AuthorizedKeysCommand), so the host keeps no authorized_keys for git.
+
 - name: Create git user on host
-  user:
+  ansible.builtin.user:
     name: git
     comment: "Forgejo Git User"
-    home: /var/lib/git
+    home: "{{ forgejo_base_path }}/data/git"
+    create_home: false
     shell: /usr/local/bin/forgejo-shell
-    system: yes
-    create_home: yes
+    system: true
+    groups: docker
+    append: true
 
 - name: Deploy forgejo-shell wrapper script
-  template:
+  ansible.builtin.template:
     src: forgejo-shell.j2
     dest: /usr/local/bin/forgejo-shell
     owner: root
     group: root
-    mode: '0755'
-
-- name: Create .ssh directory for git user
-  file:
-    path: /var/lib/git/.ssh
-    state: directory
-    owner: git
-    group: git
-    mode: '0700'
+    mode: "0755"
 
 - name: Deploy SSH daemon configuration for Forgejo passthrough
-  template:
+  ansible.builtin.template:
     src: sshd-forgejo.conf.j2
     dest: /etc/ssh/sshd_config.d/forgejo.conf
     owner: root
     group: root
-    mode: '0644'
+    mode: "0644"
   notify: Reload SSH daemon
-
-- name: Ensure docker group exists
-  group:
-    name: docker
-    state: present
-
-- name: Add git user to docker group
-  user:
-    name: git
-    groups: docker
-    append: yes

ansible/roles/forgejo/templates/app.ini.j2

@@ -1,5 +1,6 @@
-APP_NAME = Gitea: Git with a cup of tea together with asxpi
+APP_NAME = Git with a cup of tea
 RUN_MODE = prod
+WORK_PATH = /data/gitea
 
 [server]
 PROTOCOL = http
@@ -13,10 +14,12 @@ SSH_LISTEN_PORT = 22
 START_SSH_SERVER = false
 LFS_START_SERVER = true
 OFFLINE_MODE = false
+LFS_JWT_SECRET = {{ forgejo_server_lfs_jwt_secret }}
+LANDING_PAGE = explore
 
 [database]
 DB_TYPE = sqlite3
-PATH = /data/gitea.db
+PATH = /data/gitea/gitea.db
 LOG_SQL = false
 
 [repository]
@@ -26,7 +29,7 @@ DEFAULT_BRANCH = main
 DEFAULT_PRIVATE = private
 ENABLE_PUSH_CREATE_USER = true
 ENABLE_PUSH_CREATE_ORG = false
-DISABLED_REPO_UNITS =
+DISABLED_REPO_UNITS = 
 DEFAULT_REPO_UNITS = repo.code,repo.releases,repo.issues,repo.pulls,repo.wiki,repo.projects,repo.packages,repo.actions
 
 [ui]
@@ -35,15 +38,15 @@ DEFAULT_THEME = forgejo-auto
 
 [security]
 INSTALL_LOCK = true
-SECRET_KEY = {{ forgejo_secret_key | default('CHANGE-ME-PLEASE-GENERATE-NEW-SECRET') }}
-INTERNAL_TOKEN = {{ forgejo_internal_token | default('CHANGE-ME-PLEASE-GENERATE-NEW-TOKEN') }}
+SECRET_KEY = {{ forgejo_secret_key }}
+INTERNAL_TOKEN = {{ forgejo_internal_token }}
 PASSWORD_HASH_ALGO = pbkdf2
 
 [service]
 DISABLE_REGISTRATION = true
 REQUIRE_SIGNIN_VIEW = false
 REGISTER_EMAIL_CONFIRM = false
-ENABLE_NOTIFY_MAIL = false
+ENABLE_NOTIFY_MAIL = true
 DEFAULT_KEEP_EMAIL_PRIVATE = true
 DEFAULT_ALLOW_CREATE_ORGANIZATION = true
 DEFAULT_ENABLE_TIMETRACKING = true
@@ -51,10 +54,16 @@ NO_REPLY_ADDRESS = noreply.{{ forgejo_domain }}
 
 [oauth2]
 ENABLED = true
-JWT_SECRET = {{ forgejo_jwt_secret | default('CHANGE-ME-PLEASE-GENERATE-NEW-JWT-SECRET') }}
+JWT_SECRET = {{ forgejo_jwt_secret }}
 
 [mailer]
-ENABLED = false
+ENABLED = true
+FROM = Czechoslovakia Git <noreply@asxp.io>
+PROTOCOL = smtp+starttls
+SMTP_ADDR = smtp.fastmail.com
+SMTP_PORT = 587
+USER = {{ forgejo_smtp_user }}
+PASSWD = {{ forgejo_smtp_password }}
 
 [session]
 PROVIDER = file
@@ -80,4 +89,13 @@ DEFAULT_TRUST_MODEL = collaborator
 
 [lfs]
 PATH = /data/git/lfs
-LFS_JWT_SECRET = {{ forgejo_lfs_jwt_secret | default('CHANGE-ME-PLEASE-GENERATE-NEW-LFS-JWT-SECRET') }}
+LFS_JWT_SECRET = {{ forgejo_lfs_jwt_secret }}
+
+[packages]
+ENABLED = true
+
+[other]
+SHOW_FOOTER_VERSION = false
+SHOW_FOOTER_TEMPLATE_LOAD_TIME = false
+SHOW_FOOTER_POWERED_BY = false
+

ansible/roles/forgejo/templates/docker-compose.yml.j2

@@ -19,7 +19,7 @@ services:
       - {{ traefik_network }}
     labels:
       - "traefik.enable=true"
-      - "traefik.http.routers.forgejo.rule=Host(`{{ forgejo_domain }}`)"
+      - "traefik.http.routers.forgejo.rule={{ ([forgejo_domain] + forgejo_alias_domains) | map('regex_replace', '^(.*)$', 'Host(`\\1`)') | join(' || ') }}"
       - "traefik.http.routers.forgejo.entrypoints=websecure"
       - "traefik.http.routers.forgejo.tls=true"
       - "traefik.http.routers.forgejo.tls.certresolver=letsencrypt"