Implemented all service roles

- docker: install Docker Engine from official apt repo, configure log rotation,
  create shared traefik_public network
- traefik: reverse proxy with automatic Let's Encrypt TLS, dashboard on
  cloud.ladkau.de behind basic auth
- gitea: self-hosted Git with PostgreSQL, Git-over-SSH on port 2222
- sso: Keycloak with PostgreSQL for OIDC/OAuth2 single sign-on
- nextcloud: file storage with PostgreSQL, Redis, cron sidecar, CalDAV/CardDAV
  well-known redirects
- mail: Roundcube webmail client with PostgreSQL
- registry: Docker Registry v2 with htpasswd auth, no upload size limit
- k8s: placeholder nginx page

All secrets documented in vault.yml; runbook updated with per-service
first-run notes.

This commit is contained in:

2026-06-27 15:35:15 +02:00

parent 6115d9d48f

commit 75a0f21f74

30 changed files with 979 additions and 10 deletions

									
										ansible/requirements.yml
									
		+1
		
												View File
												
				@@ -2,3 +2,4 @@

				collections:

				  - name: community.general   # ufw, timezone modules

				  - name: ansible.posix       # authorized_key module

				  - name: community.docker    # docker_network module