ansible: asxpio-services is managed by NixOS

With asxpio-services described in nixos/, Ansible only has asxpio-ops
left. Drop the runner, SillyTavern and Minecraft roles, the services
host from both inventories, and the WireGuard client play.

The s3fs role and playbook go as well: the mounts were switched off on
asxpio-ops, and on asxpio-services nothing read them. The credentials
file the role once wrote on asxpio-ops stays, because the backup script
there reads it.

site.yaml against asxpio-ops still changes nothing.

Assisted-by: Claude:fable-5-2

ansible/README.md

@@ -1,7 +1,8 @@
 # Ansible
 
-`site.yaml` is the desired state of both servers and is applied by the
-deploy pipeline on every push to `main`. The playbooks under
+`site.yaml` is the desired state of asxpio-ops and is applied by the
+deploy pipeline on every push to `main`. asxpio-services runs NixOS and
+is described in `../nixos`. The playbooks under
 `playbooks/` are host bootstrap and are run by hand.
 
 ## Running
@@ -23,9 +24,10 @@ Templates that carry secrets are never shown in `--diff` output.
 - `inventory/hosts.yaml`: default. Connects as root to the WireGuard
   addresses.
 - `inventory/ci.yaml`: used by the pipeline. Connects as `deploy` over
-  the private network, reaching asxpio-services through asxpio-ops.
+  the private network.
 
-`known_hosts` pins both servers' SSH host keys for the pipeline.
+`known_hosts` pins both servers' SSH host keys for the pipelines (the
+NixOS one uses it too).
 
 ## Variables
 
@@ -34,16 +36,12 @@ inventory/
 ├── group_vars/all/
 │   ├── network.yaml         # VPC and WireGuard addresses
 │   ├── paths.yaml           # /opt
-│   ├── s3.yaml              # object storage buckets and s3fs mounts
 │   ├── wireguard.yaml       # WireGuard peers
 │   └── vault.yaml           # encrypted secrets
 ├── group_vars/ops_servers/
 │   ├── traefik.yaml         # traefik_version
 │   └── forgejo.yaml         # forgejo_version, domain and aliases
-├── group_vars/services_servers/
-│   ├── forgejo_runner.yaml  # runner version, labels' nix image
-│   └── minecraft.yaml
-└── host_vars/               # per-host addresses, SSH and s3fs settings
+└── host_vars/               # per-host addresses and SSH settings
 ```
 
 Compose files without variables are plain files under
@@ -51,8 +49,7 @@ Compose files without variables are plain files under
 
 ## Roles in site.yaml
 
-`base`, `traefik`, `crawler_alert`, `forgejo`, `forgejo_runner`,
-`sillytavern`, `minecraft`, `minecraft_fossils`. Service roles go
+`base`, `traefik`, `crawler_alert`, `forgejo`. Service roles go
 through `docker_service`, which writes the files, runs
 `docker compose up -d`, restarts on a config change and waits for the
 service to answer.
@@ -65,22 +62,12 @@ update `roles/crawler_alert/files/` from there.
 
 | Playbook | Purpose |
 |----------|---------|
-| `01-wireguard-setup.yaml` | WireGuard hub on asxpio-ops, peer on asxpio-services, client configs |
+| `01-wireguard-setup.yaml` | WireGuard hub on asxpio-ops, client configs |
 | `02-ssh-hardening.yaml` | restrict SSH to WireGuard and the private network |
-| `03-setup-s3fs.yaml` | s3fs mounts on asxpio-services (off on asxpio-ops) |
 | `04-add-user-zerrtika.yaml` | add a user to running servers |
 | `05-swap.yaml` | 2 GB swapfile on asxpio-ops |
 
 Always dry-run these first with `--check --diff`.
 
-- `03-setup-s3fs.yaml` rewrites `/etc/s3fs/.passwd-s3fs`, which the
-  backup script on asxpio-ops also reads.
-- On asxpio-services the WireGuard interface is named
-  `asxpio-services`, not `wg0`. Check `01-wireguard-setup.yaml` against
-  the host before re-running it there.
-
-## Runner notes
-
-The `nix-latest` label runs `nixos/nix:<forgejo_runner_nix_version>`
-with a `nix-store-<version>` volume over `/nix`. To bump it: change the
-variable, let the pipeline apply it, then remove the old volume.
+`/etc/s3fs/.passwd-s3fs` on asxpio-ops is a leftover of the removed s3fs
+role and is still read by the backup script there; nothing manages it.