ansible rework

ansible/inventory/host_vars/asxpio-ops.yaml

@@ -1,5 +1,10 @@
 ---
-# WireGuard VPN Configuration for asxpio-ops
+# Host-specific configuration for asxpio-ops
+# Operations server: Forgejo, Traefik, WireGuard VPN hub
+
+# ============================================================================
+# WireGuard VPN Configuration
+# ============================================================================
 wireguard_port: 60101
 wireguard_interface: wg0
 wireguard_ipv4: 10.20.0.10
@@ -22,34 +27,41 @@ wireguard_clients:
     ipv6: fd69:69:69::2
     preshared_key: true
     persistent_keepalive: 25
-  - name: phone
-    ipv4: 10.20.0.3
-    ipv6: fd69:69:69::3
-    preshared_key: true
-    persistent_keepalive: 25
-  - name: pixel9
-    ipv4: 10.20.0.4
-    ipv6: fd69:69:69::4
-    preshared_key: true
-    persistent_keepalive: 25
 
 # Optional: DNS servers for clients
 wireguard_dns_servers:
-   - 1.1.1.1
-   - 1.0.0.1
+  - 1.1.1.1
+  - 1.0.0.1
 
 # Optional: Additional routes for split tunneling
 # wireguard_additional_routes:
 #   - 192.168.1.0/24
 
+# ============================================================================
 # SSH Hardening Configuration
+# ============================================================================
 # Allow public SSH access for Forgejo git operations
 ssh_allow_public_git: true
 ssh_git_user: git
 
-# Forgejo secrets (from old server)
-forgejo_secret_key: "***REDACTED***"
-forgejo_internal_token: "***REDACTED***"
-forgejo_jwt_secret: "***REDACTED***"
-forgejo_lfs_jwt_secret: "***REDACTED***"
-letsencrypt_email: "me@asxp.io"
+# ============================================================================
+# Forgejo Configuration
+# ============================================================================
+# Secrets are stored in encrypted vault (group_vars/all/vault.yaml)
+forgejo_secret_key: "{{ vault_forgejo_secret_key }}"
+forgejo_internal_token: "{{ vault_forgejo_internal_token }}"
+forgejo_jwt_secret: "{{ vault_forgejo_jwt_secret }}"
+forgejo_lfs_jwt_secret: "{{ vault_forgejo_lfs_jwt_secret }}"
+
+# ============================================================================
+# SSL/TLS Configuration
+# ============================================================================
+letsencrypt_email: "{{ vault_letsencrypt_email }}"
+
+# ============================================================================
+# S3FS Configuration
+# ============================================================================
+# ops server: CX22 with 40GB disk, limit cache to 10GB
+# Formula: Total_Disk - Desired_Cache_Size = ensure_diskfree
+# 40GB - 10GB = 30GB free
+s3fs_ensure_diskfree: 30720  # 30GB free = max 10GB cache