ansible: describe what runs on the servers

The roles had drifted far from production: Forgejo was pinned at 12
while 15.0.11 runs, its config lacked the mailer, packages and the real
database path, and several services existed only on the hosts. Running
a role would have rolled production back. Take the servers as the truth
and make the repository match them.

site.yaml now holds the desired state of both hosts:

 - base: unattended upgrades, fail2ban, Docker daemon config and the
   weekly image prune, as found on the hosts. New: a 500M journal cap,
   and the Docker systemd override is kept absent. That override once
   opened dockerd on tcp/2375 without authentication.
 - traefik: templates as deployed, version in a variable (v3.7.18).
   The Coraza WAF files are removed; no router ever used them.
 - forgejo: 15.0.11, app.ini generated from the live file with the
   secrets taken from the vault.
 - crawler_alert, sillytavern, minecraft, minecraft_fossils: added
   from the hosts.

Forgejo's canonical name becomes git.asxp.io; git.czsk.it stays as an
alias on the same router.

docker_service restarts a stack when its config changes, no longer
forces ownership on existing data directories, and hides template
diffs because they carry secrets. Containers listed in
service_graceful_stop are saved and stopped with a long timeout before
compose recreates them: Docker's 10 s default is too short for a
Minecraft world. Both game servers get stop_grace_period for the same
reason.

Removed: the full-deployment and runner playbooks with their prompts,
the Forgejo backup and restore roles for the old bare-metal host, and
inventory entries for services that were never deployed. SSH hardening
stays a manual playbook, since a mistake there locks everyone out.

New secrets (SMTP, RCON, CurseForge key) went into the vault.

Assisted-by: Claude:fable-5-2

ansible/roles/forgejo/templates/app.ini.j2

@@ -1,5 +1,6 @@
-APP_NAME = Gitea: Git with a cup of tea together with asxpi
+APP_NAME = Git with a cup of tea
 RUN_MODE = prod
+WORK_PATH = /data/gitea
 
 [server]
 PROTOCOL = http
@@ -13,10 +14,12 @@ SSH_LISTEN_PORT = 22
 START_SSH_SERVER = false
 LFS_START_SERVER = true
 OFFLINE_MODE = false
+LFS_JWT_SECRET = {{ forgejo_server_lfs_jwt_secret }}
+LANDING_PAGE = explore
 
 [database]
 DB_TYPE = sqlite3
-PATH = /data/gitea.db
+PATH = /data/gitea/gitea.db
 LOG_SQL = false
 
 [repository]
@@ -26,7 +29,7 @@ DEFAULT_BRANCH = main
 DEFAULT_PRIVATE = private
 ENABLE_PUSH_CREATE_USER = true
 ENABLE_PUSH_CREATE_ORG = false
-DISABLED_REPO_UNITS =
+DISABLED_REPO_UNITS = 
 DEFAULT_REPO_UNITS = repo.code,repo.releases,repo.issues,repo.pulls,repo.wiki,repo.projects,repo.packages,repo.actions
 
 [ui]
@@ -35,15 +38,15 @@ DEFAULT_THEME = forgejo-auto
 
 [security]
 INSTALL_LOCK = true
-SECRET_KEY = {{ forgejo_secret_key | default('CHANGE-ME-PLEASE-GENERATE-NEW-SECRET') }}
-INTERNAL_TOKEN = {{ forgejo_internal_token | default('CHANGE-ME-PLEASE-GENERATE-NEW-TOKEN') }}
+SECRET_KEY = {{ forgejo_secret_key }}
+INTERNAL_TOKEN = {{ forgejo_internal_token }}
 PASSWORD_HASH_ALGO = pbkdf2
 
 [service]
 DISABLE_REGISTRATION = true
 REQUIRE_SIGNIN_VIEW = false
 REGISTER_EMAIL_CONFIRM = false
-ENABLE_NOTIFY_MAIL = false
+ENABLE_NOTIFY_MAIL = true
 DEFAULT_KEEP_EMAIL_PRIVATE = true
 DEFAULT_ALLOW_CREATE_ORGANIZATION = true
 DEFAULT_ENABLE_TIMETRACKING = true
@@ -51,10 +54,16 @@ NO_REPLY_ADDRESS = noreply.{{ forgejo_domain }}
 
 [oauth2]
 ENABLED = true
-JWT_SECRET = {{ forgejo_jwt_secret | default('CHANGE-ME-PLEASE-GENERATE-NEW-JWT-SECRET') }}
+JWT_SECRET = {{ forgejo_jwt_secret }}
 
 [mailer]
-ENABLED = false
+ENABLED = true
+FROM = Czechoslovakia Git <noreply@asxp.io>
+PROTOCOL = smtp+starttls
+SMTP_ADDR = smtp.fastmail.com
+SMTP_PORT = 587
+USER = {{ forgejo_smtp_user }}
+PASSWD = {{ forgejo_smtp_password }}
 
 [session]
 PROVIDER = file
@@ -80,4 +89,13 @@ DEFAULT_TRUST_MODEL = collaborator
 
 [lfs]
 PATH = /data/git/lfs
-LFS_JWT_SECRET = {{ forgejo_lfs_jwt_secret | default('CHANGE-ME-PLEASE-GENERATE-NEW-LFS-JWT-SECRET') }}
+LFS_JWT_SECRET = {{ forgejo_lfs_jwt_secret }}
+
+[packages]
+ENABLED = true
+
+[other]
+SHOW_FOOTER_VERSION = false
+SHOW_FOOTER_TEMPLATE_LOAD_TIME = false
+SHOW_FOOTER_POWERED_BY = false
+

ansible/roles/forgejo/templates/docker-compose.yml.j2

@@ -19,7 +19,7 @@ services:
       - {{ traefik_network }}
     labels:
       - "traefik.enable=true"
-      - "traefik.http.routers.forgejo.rule=Host(`{{ forgejo_domain }}`)"
+      - "traefik.http.routers.forgejo.rule={{ ([forgejo_domain] + forgejo_alias_domains) | map('regex_replace', '^(.*)$', 'Host(`\\1`)') | join(' || ') }}"
       - "traefik.http.routers.forgejo.entrypoints=websecure"
       - "traefik.http.routers.forgejo.tls=true"
       - "traefik.http.routers.forgejo.tls.certresolver=letsencrypt"