ansible: asxpio-services is managed by NixOS

With asxpio-services described in nixos/, Ansible only has asxpio-ops
left. Drop the runner, SillyTavern and Minecraft roles, the services
host from both inventories, and the WireGuard client play.

The s3fs role and playbook go as well: the mounts were switched off on
asxpio-ops, and on asxpio-services nothing read them. The credentials
file the role once wrote on asxpio-ops stays, because the backup script
there reads it.

site.yaml against asxpio-ops still changes nothing.

Assisted-by: Claude:fable-5-2

ansible/playbooks/01-wireguard-setup.yaml

@@ -43,73 +43,6 @@
   roles:
     - role: wireguard
 
-- name: Deploy WireGuard VPN Client
-  hosts: services_servers
-  become: true
-  gather_facts: true
-
-  vars:
-    # Map each server to its client config name
-    wireguard_client_configs:
-      asxpio-services: asxpio-services
-
-  tasks:
-    - name: Display client deployment information
-      ansible.builtin.debug:
-        msg: |
-          ========================================
-          WireGuard VPN Client Deployment
-          ========================================
-          Target: {{ inventory_hostname }} (VPN Client)
-          Will connect to: {{ asxpio_ops_wireguard_ip }} (asxpio-ops)
-          ========================================
-
-    - name: Get client config name for this host
-      ansible.builtin.set_fact:
-        client_config_name: "{{ wireguard_client_configs[inventory_hostname] }}"
-      when: inventory_hostname in wireguard_client_configs
-
-    - name: Install WireGuard
-      ansible.builtin.apt:
-        name:
-          - wireguard
-          - wireguard-tools
-        state: present
-        update_cache: true
-
-    - name: Create WireGuard config directory
-      ansible.builtin.file:
-        path: /etc/wireguard
-        state: directory
-        mode: '0700'
-        owner: root
-        group: root
-
-    - name: Copy WireGuard client configuration
-      ansible.builtin.copy:
-        src: "{{ playbook_dir }}/wireguard-configs/asxpio-ops/{{ client_config_name }}.conf"
-        dest: "/etc/wireguard/{{ client_config_name }}.conf"
-        mode: '0600'
-        owner: root
-        group: root
-      when: client_config_name is defined
-
-    - name: Enable and start WireGuard interface
-      ansible.builtin.systemd:
-        name: "wg-quick@{{ client_config_name }}"
-        enabled: true
-        state: started
-      when: client_config_name is defined
-      register: wg_client_start
-
-    - name: Display client status
-      ansible.builtin.debug:
-        msg: |
-          ✅ WireGuard client configured on {{ inventory_hostname }}
-          Interface: wg-quick@{{ client_config_name }}
-          Status: {{ 'Started' if wg_client_start.changed else 'Already running' }}
-      when: client_config_name is defined
-
 - name: Post-deployment verification
   hosts: localhost
   gather_facts: false
@@ -123,10 +56,9 @@
 
           Infrastructure deployed:
           ✅ asxpio-ops: WireGuard VPN Server (hub)
-          ✅ asxpio-services: WireGuard VPN Client (connected to ops)
 
           Server-to-server connectivity:
-          - asxpio-ops ↔ asxpio-services via WireGuard (10.20.0.0/24)
+          - asxpio-services is a peer too; its side is configured in ../nixos
 
           IMPORTANT NEXT STEPS FOR YOUR WORKSTATION: