Implemented all service roles

- docker: install Docker Engine from official apt repo, configure log rotation,
  create shared traefik_public network
- traefik: reverse proxy with automatic Let's Encrypt TLS, dashboard on
  cloud.ladkau.de behind basic auth
- gitea: self-hosted Git with PostgreSQL, Git-over-SSH on port 2222
- sso: Keycloak with PostgreSQL for OIDC/OAuth2 single sign-on
- nextcloud: file storage with PostgreSQL, Redis, cron sidecar, CalDAV/CardDAV
  well-known redirects
- mail: Roundcube webmail client with PostgreSQL
- registry: Docker Registry v2 with htpasswd auth, no upload size limit
- k8s: placeholder nginx page

All secrets documented in vault.yml; runbook updated with per-service
first-run notes.

ansible/roles/nextcloud/handlers/main.yml

@@ -0,0 +1,7 @@
+---
+- name: Restart nextcloud
+  community.docker.docker_compose_v2:
+    project_src: "{{ nextcloud_data_dir }}"
+    state: present
+    pull: missing
+    recreate: always

ansible/roles/nextcloud/tasks/main.yml

@@ -1,2 +1,31 @@
 ---
-# TODO: implement nextcloud role
+- name: Create Nextcloud data directories
+  ansible.builtin.file:
+    path: "{{ item }}"
+    state: directory
+    owner: root
+    group: root
+    mode: "0750"
+  loop:
+    - "{{ nextcloud_data_dir }}"
+    - "{{ nextcloud_data_dir }}/html"
+    - "{{ nextcloud_data_dir }}/db"
+    - "{{ nextcloud_data_dir }}/redis"
+  tags: nextcloud
+
+- name: Deploy Docker Compose file
+  ansible.builtin.template:
+    src: docker-compose.yml.j2
+    dest: "{{ nextcloud_data_dir }}/docker-compose.yml"
+    owner: root
+    group: root
+    mode: "0644"
+  notify: Restart nextcloud
+  tags: nextcloud
+
+- name: Start Nextcloud
+  community.docker.docker_compose_v2:
+    project_src: "{{ nextcloud_data_dir }}"
+    state: present
+    pull: missing
+  tags: nextcloud

ansible/roles/nextcloud/templates/docker-compose.yml.j2

@@ -0,0 +1,102 @@
+# Managed by Ansible — do not edit manually
+services:
+  nextcloud-db:
+    image: postgres:{{ nextcloud_db_version }}
+    container_name: nextcloud-db
+    restart: unless-stopped
+    environment:
+      POSTGRES_USER: nextcloud
+      POSTGRES_PASSWORD: "{{ nextcloud_db_password }}"
+      POSTGRES_DB: nextcloud
+    volumes:
+      - {{ nextcloud_data_dir }}/db:/var/lib/postgresql/data
+    networks:
+      - nextcloud_internal
+    healthcheck:
+      test: ["CMD-SHELL", "pg_isready -U nextcloud"]
+      interval: 10s
+      timeout: 5s
+      retries: 5
+
+  nextcloud-redis:
+    image: redis:7-alpine
+    container_name: nextcloud-redis
+    restart: unless-stopped
+    command: --save 60 1 --loglevel warning
+    volumes:
+      - {{ nextcloud_data_dir }}/redis:/data
+    networks:
+      - nextcloud_internal
+    healthcheck:
+      test: ["CMD-SHELL", "redis-cli ping | grep PONG"]
+      interval: 10s
+      timeout: 5s
+      retries: 5
+
+  nextcloud:
+    image: nextcloud:{{ nextcloud_version }}
+    container_name: nextcloud
+    restart: unless-stopped
+    environment:
+      # Database
+      POSTGRES_HOST: nextcloud-db
+      POSTGRES_DB: nextcloud
+      POSTGRES_USER: nextcloud
+      POSTGRES_PASSWORD: "{{ nextcloud_db_password }}"
+      # Redis — used for file locking and memcache
+      REDIS_HOST: nextcloud-redis
+      # Admin bootstrap (only used on first start)
+      NEXTCLOUD_ADMIN_USER: "{{ nextcloud_admin_user }}"
+      NEXTCLOUD_ADMIN_PASSWORD: "{{ nextcloud_admin_password }}"
+      # URLs — must match external domain; tells Nextcloud it's behind an HTTPS proxy
+      NEXTCLOUD_TRUSTED_DOMAINS: "{{ domain_nextcloud }}"
+      OVERWRITEPROTOCOL: https
+      OVERWRITECLIURL: "https://{{ domain_nextcloud }}"
+      OVERWRITEHOST: "{{ domain_nextcloud }}"
+      # PHP limits for large file uploads
+      PHP_MEMORY_LIMIT: 512M
+      PHP_UPLOAD_LIMIT: 512M
+    volumes:
+      - {{ nextcloud_data_dir }}/html:/var/www/html
+    networks:
+      - traefik_public
+      - nextcloud_internal
+    labels:
+      - "traefik.enable=true"
+      - "traefik.http.routers.nextcloud.rule=Host(`{{ domain_nextcloud }}`)"
+      - "traefik.http.routers.nextcloud.entrypoints=websecure"
+      - "traefik.http.routers.nextcloud.tls.certresolver=letsencrypt"
+      - "traefik.http.services.nextcloud.loadbalancer.server.port=80"
+      - "traefik.http.routers.nextcloud.middlewares=nextcloud-wellknown,nextcloud-headers"
+      # Redirect .well-known CalDAV/CardDAV to the proper Nextcloud endpoint
+      - "traefik.http.middlewares.nextcloud-wellknown.redirectregex.regex=^https://([^/]*)/.well-known/(card|cal)dav"
+      - "traefik.http.middlewares.nextcloud-wellknown.redirectregex.replacement=https://$$1/remote.php/dav/"
+      - "traefik.http.middlewares.nextcloud-wellknown.redirectregex.permanent=true"
+      # Security headers recommended by Nextcloud
+      - "traefik.http.middlewares.nextcloud-headers.headers.stsSeconds=15552000"
+      - "traefik.http.middlewares.nextcloud-headers.headers.stsIncludeSubdomains=true"
+      - "traefik.http.middlewares.nextcloud-headers.headers.stsPreload=true"
+    depends_on:
+      nextcloud-db:
+        condition: service_healthy
+      nextcloud-redis:
+        condition: service_healthy
+
+  # Runs Nextcloud background jobs on a 5-minute schedule (replaces webcron/ajax cron)
+  nextcloud-cron:
+    image: nextcloud:{{ nextcloud_version }}
+    container_name: nextcloud-cron
+    restart: unless-stopped
+    entrypoint: /cron.sh
+    volumes:
+      - {{ nextcloud_data_dir }}/html:/var/www/html
+    networks:
+      - nextcloud_internal
+    depends_on:
+      - nextcloud
+
+networks:
+  traefik_public:
+    external: true
+  nextcloud_internal:
+    internal: true