Implemented all service roles

- docker: install Docker Engine from official apt repo, configure log rotation,
  create shared traefik_public network
- traefik: reverse proxy with automatic Let's Encrypt TLS, dashboard on
  cloud.ladkau.de behind basic auth
- gitea: self-hosted Git with PostgreSQL, Git-over-SSH on port 2222
- sso: Keycloak with PostgreSQL for OIDC/OAuth2 single sign-on
- nextcloud: file storage with PostgreSQL, Redis, cron sidecar, CalDAV/CardDAV
  well-known redirects
- mail: Roundcube webmail client with PostgreSQL
- registry: Docker Registry v2 with htpasswd auth, no upload size limit
- k8s: placeholder nginx page

All secrets documented in vault.yml; runbook updated with per-service
first-run notes.

ansible/roles/registry/handlers/main.yml

@@ -0,0 +1,7 @@
+---
+- name: Restart registry
+  community.docker.docker_compose_v2:
+    project_src: "{{ registry_data_dir }}"
+    state: present
+    pull: missing
+    recreate: always

ansible/roles/registry/tasks/main.yml

@@ -1,2 +1,41 @@
 ---
-# TODO: implement registry role
+- name: Create registry data directories
+  ansible.builtin.file:
+    path: "{{ item }}"
+    state: directory
+    owner: root
+    group: root
+    mode: "0750"
+  loop:
+    - "{{ registry_data_dir }}"
+    - "{{ registry_data_dir }}/data"
+    - "{{ registry_data_dir }}/auth"
+  tags: registry
+
+# htpasswd content is stored in vault and deployed as a file
+- name: Deploy htpasswd file
+  ansible.builtin.copy:
+    content: "{{ registry_htpasswd }}\n"
+    dest: "{{ registry_data_dir }}/auth/htpasswd"
+    owner: root
+    group: root
+    mode: "0600"
+  notify: Restart registry
+  tags: registry
+
+- name: Deploy Docker Compose file
+  ansible.builtin.template:
+    src: docker-compose.yml.j2
+    dest: "{{ registry_data_dir }}/docker-compose.yml"
+    owner: root
+    group: root
+    mode: "0644"
+  notify: Restart registry
+  tags: registry
+
+- name: Start registry
+  community.docker.docker_compose_v2:
+    project_src: "{{ registry_data_dir }}"
+    state: present
+    pull: missing
+  tags: registry

ansible/roles/registry/templates/docker-compose.yml.j2

@@ -0,0 +1,29 @@
+# Managed by Ansible — do not edit manually
+services:
+  registry:
+    image: registry:2
+    container_name: registry
+    restart: unless-stopped
+    environment:
+      REGISTRY_AUTH: htpasswd
+      REGISTRY_AUTH_HTPASSWD_REALM: Container Registry
+      REGISTRY_AUTH_HTPASSWD_PATH: /auth/htpasswd
+      REGISTRY_STORAGE_DELETE_ENABLED: "true"
+    volumes:
+      - {{ registry_data_dir }}/data:/var/lib/registry
+      - {{ registry_data_dir }}/auth:/auth:ro
+    networks:
+      - traefik_public
+    labels:
+      - "traefik.enable=true"
+      - "traefik.http.routers.registry.rule=Host(`{{ domain_registry }}`)"
+      - "traefik.http.routers.registry.entrypoints=websecure"
+      - "traefik.http.routers.registry.tls.certresolver=letsencrypt"
+      - "traefik.http.services.registry.loadbalancer.server.port=5000"
+      - "traefik.http.routers.registry.middlewares=registry-buffering"
+      # Remove body size limit so large image layers can be pushed
+      - "traefik.http.middlewares.registry-buffering.buffering.maxRequestBodyBytes=0"
+
+networks:
+  traefik_public:
+    external: true