Implemented all service roles

- docker: install Docker Engine from official apt repo, configure log rotation,
  create shared traefik_public network
- traefik: reverse proxy with automatic Let's Encrypt TLS, dashboard on
  cloud.ladkau.de behind basic auth
- gitea: self-hosted Git with PostgreSQL, Git-over-SSH on port 2222
- sso: Keycloak with PostgreSQL for OIDC/OAuth2 single sign-on
- nextcloud: file storage with PostgreSQL, Redis, cron sidecar, CalDAV/CardDAV
  well-known redirects
- mail: Roundcube webmail client with PostgreSQL
- registry: Docker Registry v2 with htpasswd auth, no upload size limit
- k8s: placeholder nginx page

All secrets documented in vault.yml; runbook updated with per-service
first-run notes.

ansible/group_vars/all.yml

@@ -20,3 +20,67 @@ timezone: Europe/Berlin
 
 # Docker network shared by all services and Traefik
 traefik_network: traefik_public
+
+# Traefik
+traefik_version: v3.3
+traefik_data_dir: /opt/traefik
+# htpasswd-formatted user list for the dashboard.
+# Generate with: echo $(htpasswd -nB admin) | sed -e 's/\$/\$\$/g'
+# Store the actual value in ansible/group_vars/vault.yml (Ansible Vault).
+traefik_dashboard_users: ""
+
+# Gitea
+gitea_version: "1"          # major-only tag — always pulls latest 1.x patch
+gitea_db_version: "16"      # PostgreSQL major version
+gitea_data_dir: /opt/gitea
+# Set to false for the very first deploy so the admin account can be created,
+# then flip to true and redeploy to close public registration.
+gitea_disable_registration: true
+# Secrets — store values in ansible/group_vars/vault.yml (Ansible Vault)
+# gitea_db_password: ""
+# gitea_secret_key: ""      # generate: openssl rand -hex 32
+# gitea_internal_token: ""  # generate: openssl rand -hex 32
+
+# SSO (Keycloak)
+keycloak_version: "26.2"
+keycloak_db_version: "16"
+sso_data_dir: /opt/sso
+keycloak_admin_user: admin
+# Secrets — store values in ansible/group_vars/vault.yml (Ansible Vault)
+# keycloak_db_password: ""
+# keycloak_admin_password: ""
+
+# Nextcloud
+nextcloud_version: "31-apache"  # apache variant includes a working web server
+nextcloud_db_version: "16"
+nextcloud_data_dir: /opt/nextcloud
+nextcloud_admin_user: admin
+# Secrets — store values in ansible/group_vars/vault.yml (Ansible Vault)
+# nextcloud_db_password: ""
+# nextcloud_admin_password: ""
+
+# Mail (Roundcube webmail client)
+roundcube_version: "1.6-apache"
+roundcube_db_version: "16"
+mail_data_dir: /opt/mail
+# IMAP/SMTP — set to the mail server Roundcube should connect to.
+# Leave imap_host empty to let users enter their own server at login.
+# Use "ssl://hostname" for implicit TLS (port 993), or plain hostname for STARTTLS (port 143).
+roundcube_imap_host: ""
+roundcube_imap_port: "993"
+roundcube_smtp_host: ""
+roundcube_smtp_port: "587"
+# Secrets — store values in ansible/group_vars/vault.yml (Ansible Vault)
+# roundcube_db_password: ""
+# roundcube_des_key: ""   # generate: openssl rand -hex 12  (must be exactly 24 chars)
+
+# Container registry (Docker Registry v2)
+registry_data_dir: /opt/registry
+# registry_htpasswd — full htpasswd file content, store in vault.yml
+# Generate with: docker run --entrypoint htpasswd httpd:2 -Bbn <user> <password>
+# Multiple users: run the command once per user and concatenate the lines.
+# Secrets — store values in ansible/group_vars/vault.yml (Ansible Vault)
+# registry_htpasswd: ""
+
+# k8s (placeholder)
+k8s_data_dir: /opt/k8s