ansible: asxpio-services is managed by NixOS

With asxpio-services described in nixos/, Ansible only has asxpio-ops
left. Drop the runner, SillyTavern and Minecraft roles, the services
host from both inventories, and the WireGuard client play.

The s3fs role and playbook go as well: the mounts were switched off on
asxpio-ops, and on asxpio-services nothing read them. The credentials
file the role once wrote on asxpio-ops stays, because the backup script
there reads it.

site.yaml against asxpio-ops still changes nothing.

Assisted-by: Claude:fable-5-2

ansible/playbooks/01-wireguard-setup.yaml

@@ -43,73 +43,6 @@
   roles:
     - role: wireguard
 
-- name: Deploy WireGuard VPN Client
-  hosts: services_servers
-  become: true
-  gather_facts: true
-
-  vars:
-    # Map each server to its client config name
-    wireguard_client_configs:
-      asxpio-services: asxpio-services
-
-  tasks:
-    - name: Display client deployment information
-      ansible.builtin.debug:
-        msg: |
-          ========================================
-          WireGuard VPN Client Deployment
-          ========================================
-          Target: {{ inventory_hostname }} (VPN Client)
-          Will connect to: {{ asxpio_ops_wireguard_ip }} (asxpio-ops)
-          ========================================
-
-    - name: Get client config name for this host
-      ansible.builtin.set_fact:
-        client_config_name: "{{ wireguard_client_configs[inventory_hostname] }}"
-      when: inventory_hostname in wireguard_client_configs
-
-    - name: Install WireGuard
-      ansible.builtin.apt:
-        name:
-          - wireguard
-          - wireguard-tools
-        state: present
-        update_cache: true
-
-    - name: Create WireGuard config directory
-      ansible.builtin.file:
-        path: /etc/wireguard
-        state: directory
-        mode: '0700'
-        owner: root
-        group: root
-
-    - name: Copy WireGuard client configuration
-      ansible.builtin.copy:
-        src: "{{ playbook_dir }}/wireguard-configs/asxpio-ops/{{ client_config_name }}.conf"
-        dest: "/etc/wireguard/{{ client_config_name }}.conf"
-        mode: '0600'
-        owner: root
-        group: root
-      when: client_config_name is defined
-
-    - name: Enable and start WireGuard interface
-      ansible.builtin.systemd:
-        name: "wg-quick@{{ client_config_name }}"
-        enabled: true
-        state: started
-      when: client_config_name is defined
-      register: wg_client_start
-
-    - name: Display client status
-      ansible.builtin.debug:
-        msg: |
-          ✅ WireGuard client configured on {{ inventory_hostname }}
-          Interface: wg-quick@{{ client_config_name }}
-          Status: {{ 'Started' if wg_client_start.changed else 'Already running' }}
-      when: client_config_name is defined
-
 - name: Post-deployment verification
   hosts: localhost
   gather_facts: false
@@ -123,10 +56,9 @@
 
           Infrastructure deployed:
           ✅ asxpio-ops: WireGuard VPN Server (hub)
-          ✅ asxpio-services: WireGuard VPN Client (connected to ops)
 
           Server-to-server connectivity:
-          - asxpio-ops ↔ asxpio-services via WireGuard (10.20.0.0/24)
+          - asxpio-services is a peer too; its side is configured in ../nixos
 
           IMPORTANT NEXT STEPS FOR YOUR WORKSTATION:
 

ansible/playbooks/03-setup-s3fs.yaml

@@ -1,134 +0,0 @@
----
-# Stage 3: Setup S3FS on all servers
-#
-# This playbook sets up s3fs to mount S3 buckets as local filesystems.
-# Must be run after Stage 2 (full deployment) to ensure Docker is installed.
-#
-# Mounts the following buckets:
-# - asxpio-terraform-main -> /mnt/s3/terraform
-# - asxpio-backups-main -> /mnt/s3/backups
-# - asxpio-immich-main -> /mnt/s3/immich
-#
-# Cache sizes (per-host):
-# - asxpio-ops (40GB disk): 10GB cache max
-# - asxpio-services (160GB disk): 80GB cache max
-#
-# Usage:
-#   ansible-playbook playbooks/03-setup-s3fs.yaml
-#
-# IMPORTANT: Ensure S3 credentials are set in group_vars/all/vault.yaml:
-#   vault_s3_access_key: "your-access-key"
-#   vault_s3_secret_key: "your-secret-key"
-#
-
-- name: Setup S3FS on all servers
-  hosts: ops_servers,services_servers
-  become: true
-  gather_facts: true
-
-  pre_tasks:
-    - name: Validate S3 credentials are set
-      ansible.builtin.assert:
-        that:
-          - s3_access_key is defined
-          - s3_access_key != ""
-          - s3_secret_key is defined
-          - s3_secret_key != ""
-        fail_msg: |
-          S3 credentials not set!
-          Please set vault_s3_access_key and vault_s3_secret_key in:
-          - group_vars/all/vault.yaml (encrypted with ansible-vault)
-          OR
-          - Pass via command line: -e "s3_access_key=xxx s3_secret_key=yyy"
-        success_msg: "S3 credentials validated"
-
-    - name: Display S3 configuration
-      ansible.builtin.debug:
-        msg: |
-          ========================================
-          S3FS Setup on {{ inventory_hostname }}
-          ========================================
-          Target: {{ inventory_hostname }}
-          S3 Region: {{ s3_region }}
-          S3 Endpoint: {{ s3_endpoint }}
-
-          Buckets to mount:
-          {% for bucket in s3_buckets %}
-          - {{ bucket.name }} -> {{ bucket.mount_point }}
-          {% endfor %}
-          ========================================
-
-  roles:
-    - role: s3fs
-
-  post_tasks:
-    - name: Display mounted filesystems
-      ansible.builtin.command:
-        cmd: df -h
-      register: df_output
-      changed_when: false
-
-    - name: Show S3 mounts
-      ansible.builtin.debug:
-        msg: "{{ df_output.stdout_lines | select('search', 's3fs') | list }}"
-
-    - name: Create immich library directory structure
-      ansible.builtin.file:
-        path: "{{ item }}"
-        state: directory
-        mode: '0775'
-        owner: root
-        group: docker
-      loop:
-        - /mnt/s3/immich/library
-        - /mnt/s3/immich/library/backups
-        - /mnt/s3/immich/library/encoded-video
-        - /mnt/s3/immich/library/library
-        - /mnt/s3/immich/library/profile
-        - /mnt/s3/immich/library/thumbs
-        - /mnt/s3/immich/library/upload
-      when: inventory_hostname in groups['services_servers']
-
-    - name: Display post-setup information
-      ansible.builtin.debug:
-        msg: |
-          ========================================
-          S3FS Setup Complete on {{ inventory_hostname }}!
-          ========================================
-
-          ✅ All S3 buckets mounted successfully
-
-          Mount points:
-          {% for bucket in s3_buckets %}
-          - {{ bucket.mount_point }} ({{ bucket.name }})
-          {% endfor %}
-
-          Cache configuration:
-          - Location: /var/cache/s3fs
-          - Max size: ~{{ (40 - (s3fs_ensure_diskfree / 1024)) | int }}GB
-          - Free space reserved: {{ (s3fs_ensure_diskfree / 1024) | int }}GB
-
-          {% if inventory_hostname in groups['services_servers'] %}
-          Immich library structure created at:
-          /mnt/s3/immich/library/
-          ├── backups/
-          ├── encoded-video/
-          ├── library/
-          ├── profile/
-          ├── thumbs/
-          └── upload/
-
-          Next steps for Immich migration:
-          1. Manually sync data from legacy server:
-             rsync -avz --info=progress2 \
-               asxpio-old:/srv/immich/library/ \
-               /mnt/s3/immich/library/
-
-          2. Backup Immich PostgreSQL database on legacy server:
-             docker exec immich_postgres pg_dumpall -U postgres | gzip > /tmp/immich-db.sql.gz
-
-          3. Deploy Immich service configured to use S3 storage:
-             IMMICH_MEDIA_LOCATION=/mnt/s3/immich/library
-          {% endif %}
-
-          ========================================