Set up repo structure and implement base role

- Document architecture decisions in README (Ansible + Docker Compose + Traefik)
- Scaffold Ansible layout: inventory, site.yml, group_vars, 9 service roles
- Implement base role: package install, deploy user, SSH hardening,
  UFW firewall (22/80/443), fail2ban, unattended-upgrades
- Add reinstall runbook in docs/runbook.md
- Add ansible/requirements.yml for community.general and ansible.posix

docs/runbook.md

@@ -0,0 +1,88 @@
+# Reinstall Runbook
+
+Follow these steps to provision a fresh server from scratch.
+
+## Prerequisites
+
+On your local machine:
+- Ansible installed (`pip install ansible`)
+- SSH access to the server as root using `keys/root_cloud_ladkau_de`
+
+## Steps
+
+### 1. Install Ansible collections
+
+From the repo root:
+
+```bash
+ansible-galaxy collection install -r ansible/requirements.yml
+```
+
+Required collections:
+- `community.general` — ufw, timezone modules
+- `ansible.posix` — authorized_key module
+
+### 2. Initial root login
+
+Connect as root and verify the server is reachable:
+
+```
+ssh -i keys/root_cloud_ladkau_de root@217.154.207.148
+```
+
+### 3. Create the deploy user (one-time, manual)
+
+On the server as root:
+
+```bash
+adduser deploy
+usermod -aG sudo deploy
+mkdir -p /home/deploy/.ssh
+cat >> /home/deploy/.ssh/authorized_keys <<'EOF'
+<paste contents of keys/notroot_cloud_ladkau_de.pub>
+EOF
+chown -R deploy:deploy /home/deploy/.ssh
+chmod 700 /home/deploy/.ssh
+chmod 600 /home/deploy/.ssh/authorized_keys
+```
+
+### 4. Run the Ansible master playbook
+
+From the repo root:
+
+```bash
+ansible-playbook -i ansible/inventory.ini ansible/site.yml
+```
+
+This runs all roles in order:
+1. `base`      — OS hardening, SSH config, ufw firewall
+2. `docker`    — Docker Engine + Compose plugin
+3. `traefik`   — reverse proxy, TLS via Let's Encrypt
+4. `gitea`     — self-hosted Git
+5. `nextcloud` — file storage
+6. `sso`       — Single Sign-On
+7. `mail`      — mail server
+8. `registry`  — container registry
+9. `k8s`       — k3s node
+
+### 5. DNS
+
+Ensure the following DNS A records point to `217.154.207.148` before running:
+
+- cloud.ladkau.de
+- gitea.ladkau.de
+- nextcloud.ladkau.de
+- sso.ladkau.de
+- mail.ladkau.de
+- cr.ladkau.de
+- k8s.ladkau.de
+
+Traefik will attempt ACME certificate issuance on first start; DNS must resolve first.
+
+## Re-running after changes
+
+The playbook is idempotent. To apply a single role only:
+
+```bash
+ansible-playbook -i ansible/inventory.ini ansible/site.yml --tags <role>
+```