Fix provisioning errors found during first real run

- ansible.cfg: suppress Python interpreter discovery warning
- ansible/inventory.ini: add ansible_host; server IP is now defined in
  one place and read dynamically by run-bootstrap.sh
- group_vars/all/ → directory layout so vault.yml is auto-loaded by Ansible
  (previously vault.yml did not match any group name and was silently ignored)
- scripts/run-bootstrap.sh: read server IP from inventory, chmod 600 private
  keys automatically, show actual SSH error when root login fails
- scripts/bootstrap-deploy-user.sh: add sudoers.d entry for passwordless sudo
  (deploy user has no password so sudo group membership alone was not enough)
- nextcloud: fix Redis healthcheck (CMD-SHELL pipe was unreliable in Alpine,
  switched to CMD form with start_period)
- group_vars/all/vars.yml: fix Roundcube image tag (1.6-apache and 1.6 do not
  exist; correct tag is 1.6.x-apache)
- docs/runbook.md: expand prerequisites (SSH keys section), add step 1 for
  setting the server IP, expand bootstrap step with preflight detail, fix
  step numbering

scripts/bootstrap-deploy-user.sh

@@ -22,6 +22,10 @@ fi
 echo "==> Adding '${DEPLOY_USER}' to sudo group"
 usermod -aG sudo "${DEPLOY_USER}"
 
+echo "==> Granting '${DEPLOY_USER}' passwordless sudo"
+echo "${DEPLOY_USER} ALL=(ALL) NOPASSWD: ALL" > "/etc/sudoers.d/${DEPLOY_USER}"
+chmod 440 "/etc/sudoers.d/${DEPLOY_USER}"
+
 echo "==> Installing SSH authorized key"
 SSH_DIR="/home/${DEPLOY_USER}/.ssh"
 AUTH_KEYS="${SSH_DIR}/authorized_keys"

scripts/check-vault.sh

@@ -7,7 +7,7 @@ set -euo pipefail
 
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 REPO_ROOT="$(cd "${SCRIPT_DIR}/.." && pwd)"
-VAULT_FILE="${REPO_ROOT}/ansible/group_vars/vault.yml"
+VAULT_FILE="${REPO_ROOT}/ansible/group_vars/all/vault.yml"
 
 REQUIRED_KEYS=(
   traefik_dashboard_users

scripts/run-bootstrap.sh

@@ -9,7 +9,12 @@ set -euo pipefail
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 REPO_ROOT="$(cd "${SCRIPT_DIR}/.." && pwd)"
 
-SERVER="217.154.207.148"
+SERVER=$(grep -oP '(?<=ansible_host=)\S+' "${REPO_ROOT}/ansible/inventory.ini" | head -1)
+if [ -z "${SERVER}" ]; then
+  echo "ERROR: could not find ansible_host in ansible/inventory.ini" >&2
+  exit 1
+fi
+
 ROOT_KEY="${REPO_ROOT}/keys/root_cloud_ladkau_de"
 DEPLOY_KEY="${REPO_ROOT}/keys/notroot_cloud_ladkau_de"
 DEPLOY_PUBKEY="${REPO_ROOT}/keys/notroot_cloud_ladkau_de.pub"
@@ -37,6 +42,9 @@ if [ ! -f "${BOOTSTRAP_SCRIPT}" ]; then
   exit 1
 fi
 
+# SSH private keys must not be group/world readable
+chmod 600 "${ROOT_KEY}" "${DEPLOY_KEY}"
+
 # --- Vault check ---
 
 bash "${SCRIPT_DIR}/check-vault.sh"
@@ -46,10 +54,18 @@ SSH_OPTS="-o StrictHostKeyChecking=accept-new -o ConnectTimeout=10"
 # --- Verify root access ---
 
 echo "==> Verifying root SSH access to ${SERVER}"
-if ! ssh ${SSH_OPTS} -i "${ROOT_KEY}" "root@${SERVER}" "echo ok" &>/dev/null; then
+if ! ssh ${SSH_OPTS} -i "${ROOT_KEY}" "root@${SERVER}" "echo ok" 2>/tmp/ssh_root_err; then
   echo "ERROR: cannot connect as root to ${SERVER}" >&2
+  echo "       SSH error: $(cat /tmp/ssh_root_err)" >&2
+  echo "" >&2
+  echo "Possible causes:" >&2
+  echo "  - Root public key not uploaded to the server (Strato control panel)" >&2
+  echo "  - Wrong key file: ${ROOT_KEY}" >&2
+  echo "  - Server not yet reachable (still booting?)" >&2
+  rm -f /tmp/ssh_root_err
   exit 1
 fi
+rm -f /tmp/ssh_root_err
 
 # --- Copy and run the bootstrap script ---