Fix provisioning errors found during first real run

- ansible.cfg: suppress Python interpreter discovery warning
- ansible/inventory.ini: add ansible_host; server IP is now defined in
  one place and read dynamically by run-bootstrap.sh
- group_vars/all/ → directory layout so vault.yml is auto-loaded by Ansible
  (previously vault.yml did not match any group name and was silently ignored)
- scripts/run-bootstrap.sh: read server IP from inventory, chmod 600 private
  keys automatically, show actual SSH error when root login fails
- scripts/bootstrap-deploy-user.sh: add sudoers.d entry for passwordless sudo
  (deploy user has no password so sudo group membership alone was not enough)
- nextcloud: fix Redis healthcheck (CMD-SHELL pipe was unreliable in Alpine,
  switched to CMD form with start_period)
- group_vars/all/vars.yml: fix Roundcube image tag (1.6-apache and 1.6 do not
  exist; correct tag is 1.6.x-apache)
- docs/runbook.md: expand prerequisites (SSH keys section), add step 1 for
  setting the server IP, expand bootstrap step with preflight detail, fix
  step numbering

docs/runbook.md

@@ -32,12 +32,24 @@ ssh-keygen -t ed25519 -f keys/notroot_cloud_ladkau_de -C "deploy@cloud.ladkau.de
 ```
 
 Upload the root public key to the server via the Strato control panel (or paste
-it during the initial OS install) so that `root@217.154.207.148` is accessible
-before running anything.
+it during the initial OS install) so that root SSH access is available before
+running anything. The server IP is defined in `ansible/inventory.ini`
+(`ansible_host`).
 
 ## Steps
 
-### 1. Install Ansible collections
+### 1. Set the server IP
+
+Open `ansible/inventory.ini` and set `ansible_host` to the server's public IP:
+
+```ini
+cloud.ladkau.de ansible_host=<server-ip> ansible_user=deploy ansible_ssh_private_key_file=keys/notroot_cloud_ladkau_de
+```
+
+This is the only place the IP needs to be set — the bootstrap script and all
+Ansible roles read it from here.
+
+### 2. Install Ansible collections
 
 From the repo root:
 
@@ -50,28 +62,28 @@ Required collections:
 - `ansible.posix` — authorized_key module
 - `community.docker` — docker_network, docker_compose_v2 modules
 
-### 2. Configure DNS
+### 3. Configure DNS
 
-Ensure the following DNS A records point to `217.154.207.148` before running
-the playbook. Traefik requests Let's Encrypt certificates on first start and
-DNS must resolve at that point.
+Ensure the following DNS A records all point to the server IP (`ansible_host`
+in `ansible/inventory.ini`) before running the playbook. Traefik requests
+Let's Encrypt certificates on first start and DNS must resolve at that point.
 
 | Domain              | Record |
 |---------------------|--------|
-| cloud.ladkau.de     | A → 217.154.207.148 |
-| gitea.ladkau.de     | A → 217.154.207.148 |
-| nextcloud.ladkau.de | A → 217.154.207.148 |
-| sso.ladkau.de       | A → 217.154.207.148 |
-| mail.ladkau.de      | A → 217.154.207.148 |
-| cr.ladkau.de        | A → 217.154.207.148 |
-| k8s.ladkau.de       | A → 217.154.207.148 |
+| cloud.ladkau.de     | A → server IP |
+| gitea.ladkau.de     | A → server IP |
+| nextcloud.ladkau.de | A → server IP |
+| sso.ladkau.de       | A → server IP |
+| mail.ladkau.de      | A → server IP |
+| cr.ladkau.de        | A → server IP |
+| k8s.ladkau.de       | A → server IP |
 
-### 3. Create the vault and populate secrets
+### 4. Create the vault and populate secrets
 
-Create `ansible/group_vars/vault.yml` (gitignored) and encrypt it with Ansible Vault:
+Create `ansible/group_vars/all/vault.yml` (gitignored) and encrypt it with Ansible Vault:
 
 ```bash
-ansible-vault create ansible/group_vars/vault.yml
+ansible-vault create ansible/group_vars/all/vault.yml
 ```
 
 Populate all required secrets:
@@ -114,19 +126,34 @@ bash scripts/check-vault.sh
 To edit the vault later:
 
 ```bash
-ansible-vault edit ansible/group_vars/vault.yml
+ansible-vault edit ansible/group_vars/all/vault.yml
 ```
 
-### 4. Bootstrap the deploy user
-
-Copies the bootstrap script to the server, runs it as root, and verifies the
-deploy user can log in. Also runs `check-vault.sh` as a preflight check.
+### 5. Bootstrap the deploy user
 
 ```bash
 bash scripts/run-bootstrap.sh
 ```
 
-### 5. Run the Ansible master playbook
+The script runs the following steps in order:
+
+**Preflight checks (local)**
+1. Verifies all four key files exist under `keys/` (both root and deploy key pairs)
+2. Verifies `scripts/bootstrap-deploy-user.sh` exists
+3. Sets `chmod 600` on the private key files (SSH refuses keys with open permissions)
+4. Runs `scripts/check-vault.sh` — decrypts the vault and confirms all 11 required
+   secrets are present and non-empty
+
+**Remote actions**
+5. Opens a test SSH connection as `root` to confirm the root key works
+6. Copies `bootstrap-deploy-user.sh` to `/root/` on the server via `scp`
+7. Executes it as root — creates the `deploy` user, grants passwordless sudo,
+   and installs `keys/notroot_cloud_ladkau_de.pub` as the only authorized key
+8. Opens a test SSH connection as `deploy` to confirm the new user can log in
+
+If any step fails the script exits immediately with a descriptive error message.
+
+### 6. Run the Ansible master playbook
 
 ```bash
 ansible-playbook -i ansible/inventory.ini ansible/site.yml --ask-vault-pass
@@ -160,7 +187,7 @@ ansible-playbook -i ansible/inventory.ini ansible/site.yml --tags <role> --ask-v
 it to `false` in `vault.yml` so the setup wizard can create the admin account:
 
 ```bash
-ansible-vault edit ansible/group_vars/vault.yml
+ansible-vault edit ansible/group_vars/all/vault.yml
 # add: gitea_disable_registration: false
 ansible-playbook -i ansible/inventory.ini ansible/site.yml --tags gitea --ask-vault-pass
 ```