ansible: asxpio-services is managed by NixOS

With asxpio-services described in nixos/, Ansible only has asxpio-ops
left. Drop the runner, SillyTavern and Minecraft roles, the services
host from both inventories, and the WireGuard client play.

The s3fs role and playbook go as well: the mounts were switched off on
asxpio-ops, and on asxpio-services nothing read them. The credentials
file the role once wrote on asxpio-ops stays, because the backup script
there reads it.

site.yaml against asxpio-ops still changes nothing.

Assisted-by: Claude:fable-5-2

ansible/inventory/ci.yaml

@@ -1,9 +1,6 @@
 ---
-# Inventory for the Forgejo Actions runner. Jobs run in containers on
-# asxpio-services, so asxpio-ops is reached over the VPC. The services
-# host itself is reached through asxpio-ops: a container talking to its
-# own host arrives from a Docker bridge address, which sshd and the
-# firewall both refuse.
+# Inventory for the Forgejo Actions runner: asxpio-ops over the private
+# network, as user deploy.
 
 all:
   vars:
@@ -17,8 +14,3 @@ all:
           hosts:
             asxpio-ops:
               ansible_host: "{{ vpc_ip }}"
-        services_servers:
-          hosts:
-            asxpio-services:
-              ansible_host: "{{ vpc_ip }}"
-              ansible_ssh_common_args: "-o ProxyJump=deploy@{{ asxpio_ops_vpc_ip }}"

ansible/inventory/group_vars/all/s3.yaml

@@ -1,39 +0,0 @@
----
-# S3 Object Storage Configuration
-# These should be overridden in vault or environment-specific vars
-
-# S3 Endpoint Configuration
-s3_region: hel1
-s3_endpoint: "https://{{ s3_region }}.your-objectstorage.com"
-
-# S3 Credentials
-# WARNING: Store these in ansible-vault encrypted file!
-# Override these in group_vars/all/vault.yaml (encrypted)
-s3_access_key: "{{ vault_s3_access_key | default('') }}"
-s3_secret_key: "{{ vault_s3_secret_key | default('') }}"
-
-# S3 Bucket names
-s3_bucket_terraform_main: asxpio-terraform-main
-s3_bucket_terraform_repl: asxpio-terraform-repl
-s3_bucket_backups_main: asxpio-backups-main
-s3_bucket_backups_repl: asxpio-backups-repl
-s3_bucket_immich_main: asxpio-immich-main
-s3_bucket_immich_repl: asxpio-immich-repl
-
-# S3 Buckets to mount on servers (non-replication only)
-s3_buckets:
-  - name: "{{ s3_bucket_terraform_main }}"
-    mount_point: /mnt/s3/terraform
-    owner: root
-    group: root
-    mode: "0755"
-  - name: "{{ s3_bucket_backups_main }}"
-    mount_point: /mnt/s3/backups
-    owner: root
-    group: root
-    mode: "0755"
-  - name: "{{ s3_bucket_immich_main }}"
-    mount_point: /mnt/s3/immich
-    owner: root
-    group: docker
-    mode: "0775"

ansible/inventory/group_vars/services_servers/forgejo_runner.yaml

@@ -1,20 +0,0 @@
----
-# Forgejo Runner (CI/CD) configuration
-
-# Runner version and settings
-forgejo_runner_version: "11"
-forgejo_runner_capacity: 4
-forgejo_runner_timeout: 3h
-
-# Image behind the nix-latest label. Jobs mount a nix-store volume over
-# /nix, seeded from this image on first use; the image's /bin/sh and
-# /etc/nix/nix.conf link into that store, so a volume from another
-# version breaks them. Bumping this also switches to a fresh volume.
-forgejo_runner_nix_version: "2.35.3"
-forgejo_runner_token: "{{ vault_forgejo_runner_token }}"
-
-# Runner installation path
-forgejo_runner_base_path: "{{ services_base_path }}/forgejo-runner"
-
-# The runner talks to Forgejo over the VPC, not through Traefik
-forgejo_http_port: 3000

ansible/inventory/group_vars/services_servers/minecraft.yaml

@@ -1,4 +0,0 @@
----
-minecraft_fossils_owner: asxpi
-minecraft_fossils_rcon_password: "{{ vault_minecraft_fossils_rcon_password }}"
-minecraft_fossils_cf_api_key: "{{ vault_minecraft_fossils_cf_api_key }}"

ansible/inventory/host_vars/asxpio-ops.yaml

@@ -6,7 +6,3 @@ wireguard_ip: "{{ asxpio_ops_wireguard_ip }}"
 # SSH: the git user may connect from anywhere (Forgejo passthrough)
 ssh_allow_public_git: true
 ssh_git_user: git
-
-# s3fs is off here: its ensure_diskfree reserve never fit the 38 GB disk
-s3fs_enabled: false
-s3fs_ensure_diskfree: 20000

ansible/inventory/host_vars/asxpio-services.yaml

@@ -1,8 +0,0 @@
----
-public_ip: 46.62.228.216
-vpc_ip: "{{ asxpio_services_vpc_ip }}"
-wireguard_ip: "{{ asxpio_services_wireguard_ip }}"
-
-ssh_allow_public_git: false
-
-s3fs_ensure_diskfree: 81920  # 80 GB free = max 80 GB cache

ansible/inventory/hosts.yaml

@@ -1,6 +1,7 @@
 ---
 # Default inventory: run from a workstation over WireGuard, as root.
 # CI uses inventory/ci.yaml instead (VPC addresses, user deploy).
+# asxpio-services runs NixOS and is not managed by Ansible; see ../nixos.
 
 all:
   vars:
@@ -14,7 +15,3 @@ all:
           hosts:
             asxpio-ops:
               ansible_host: "{{ wireguard_ip }}"
-        services_servers:
-          hosts:
-            asxpio-services:
-              ansible_host: "{{ wireguard_ip }}"