ci: deploy site.yaml from Forgejo Actions

Service changes were made by hand on the servers, which is how the
repository drifted. Apply site.yaml from a workflow instead: every
push dry-runs it against production, and a push to main applies it.

Jobs run in containers on asxpio-services. asxpio-ops is reached over
the private network; the services host is reached through asxpio-ops,
because a container connecting to its own host arrives from a Docker
bridge address that sshd and the firewall refuse. Host keys are pinned
in known_hosts.

Ansible comes from a pinned nixpkgs revision so every run uses the
same version.

Assisted-by: Claude:fable-5-2

.forgejo/workflows/deploy.yaml

@@ -0,0 +1,61 @@
+name: deploy
+
+# main:           dry run, then apply ansible/site.yaml to both servers
+# other branches: dry run only
+#
+# Secrets: SSH_DEPLOY_KEY (user deploy on both servers) and
+# ANSIBLE_VAULT_PASSWORD (decrypts inventory/group_vars/all/vault.yaml).
+
+on:
+  push:
+    paths:
+      - 'ansible/**'
+      - '.forgejo/workflows/deploy.yaml'
+  workflow_dispatch:
+
+jobs:
+  ansible:
+    runs-on: nix-latest
+    env:
+      NIX_CONFIG: |
+        experimental-features = nix-command flakes
+        build-users-group =
+        sandbox = false
+      # Pinned so CI runs the same Ansible on every run
+      NIXPKGS: github:NixOS/nixpkgs/0bb2eedc20e4739f29e8045034f2828ad7054f8f
+      ANSIBLE_HOST_KEY_CHECKING: "True"
+      ANSIBLE_FORCE_COLOR: "1"
+    steps:
+      - name: Prepare container for actions
+        run: nix-env -iA nixpkgs.nodejs_22
+
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Set up credentials
+        env:
+          SSH_DEPLOY_KEY: ${{ secrets.SSH_DEPLOY_KEY }}
+          ANSIBLE_VAULT_PASSWORD: ${{ secrets.ANSIBLE_VAULT_PASSWORD }}
+        run: |
+          if [ -z "$SSH_DEPLOY_KEY" ] || [ -z "$ANSIBLE_VAULT_PASSWORD" ]; then
+            echo "SSH_DEPLOY_KEY and ANSIBLE_VAULT_PASSWORD must be set as repository secrets" >&2
+            exit 1
+          fi
+          umask 077
+          mkdir -p ~/.ssh
+          printf '%s\n' "$SSH_DEPLOY_KEY" > ~/.ssh/id_ed25519
+          cp ansible/known_hosts ~/.ssh/known_hosts
+          printf '%s\n' "$ANSIBLE_VAULT_PASSWORD" > ansible/.vault_pass
+
+      - name: Dry run
+        working-directory: ansible
+        run: nix shell "$NIXPKGS#ansible" "$NIXPKGS#openssh" -c ansible-playbook -i inventory/ci.yaml site.yaml --check
+
+      - name: Apply
+        if: github.ref == 'refs/heads/main'
+        working-directory: ansible
+        run: nix shell "$NIXPKGS#ansible" "$NIXPKGS#openssh" -c ansible-playbook -i inventory/ci.yaml site.yaml
+
+      - name: Remove credentials
+        if: always()
+        run: rm -f ~/.ssh/id_ed25519 ansible/.vault_pass