Fix Redis persistence crash-loop and provisioning dependencies

- Disable Redis RDB snapshots (--save "") — Redis is cache-only for
  Nextcloud; snapshot writes failed due to directory permissions and
  blocked all Redis writes, causing background jobs to crash-loop at
  400%+ CPU
- Add passlib as a required local dependency (needed for password_hash
  filter in Ansible templates)
- Make dl role SFTP setup conditional on dl_sftp_authorized_keys being
  set in the vault
- Fix check-vault.sh stdin conflict (pipe + heredoc) by passing vault
  content via environment variable
- Remove dl_sftp_authorized_keys from required_scalars (it is optional)

ansible/roles/dl/tasks/main.yml

@@ -24,6 +24,7 @@
     owner: root
     group: root
     mode: "0644"
+  when: dl_sftp_authorized_keys | default('') | length > 0
   notify: Restart dl
   tags: dl
 
@@ -52,6 +53,7 @@
     rule: allow
     port: "{{ dl_sftp_port }}"
     proto: tcp
+  when: dl_sftp_authorized_keys | default('') | length > 0
   tags: dl
 
 - name: Start dl stack

ansible/roles/dl/templates/docker-compose.yml.j2

@@ -17,6 +17,7 @@ services:
       - "traefik.http.services.dl.loadbalancer.server.port=80"
       - "traefik.http.routers.dl.middlewares=rate-limit@docker"
 
+{% if dl_sftp_authorized_keys | default('') | length > 0 %}
   dl-sftp:
     image: atmoz/sftp
     container_name: dl-sftp
@@ -28,6 +29,7 @@ services:
       - "{{ dl_sftp_port }}:22"
     # Empty password disables password auth — key auth only
     command: "{{ dl_upload_user }}::1001:1001:files"
+{% endif %}
 
 networks:
   traefik_public:

ansible/roles/nextcloud/templates/docker-compose.yml.j2

@@ -22,7 +22,7 @@ services:
     image: redis:7-alpine
     container_name: nextcloud-redis
     restart: unless-stopped
-    command: --save 60 1 --loglevel warning
+    command: --save "" --loglevel warning
     volumes:
       - {{ nextcloud_data_dir }}/redis:/data
     networks:

docs/runbook-provisioning.md

@@ -11,6 +11,7 @@ setup of individual services.
 ### Local tools
 
 - Ansible installed (`pip install ansible`)
+- `passlib` installed (`pip install passlib`) — required for bcrypt/SHA-512 password hashing in templates
 - `openssl` available (for generating secrets)
 
 ### SSH keys

scripts/check-vault.sh

@@ -24,10 +24,13 @@ fi
 echo "==> Decrypting vault (you will be prompted for the vault password)"
 VAULT_CONTENT=$(ansible-vault view "${VAULT_FILE}")
 
-echo "${VAULT_CONTENT}" | python3 - <<'PYEOF'
-import sys, yaml
+# Pass vault content via environment variable — avoids a pipe+heredoc stdin conflict
+# where python3 - consumes stdin for the script, leaving sys.stdin.read() empty.
+export VAULT_CONTENT
+python3 - <<'PYEOF'
+import os, sys, yaml
 
-data = yaml.safe_load(sys.stdin.read())
+data = yaml.safe_load(os.environ['VAULT_CONTENT'])
 
 # Required non-empty scalar strings
 required_scalars = [
@@ -41,7 +44,6 @@ required_scalars = [
     "roundcube_db_password",
     "roundcube_des_key",
     "vaultwarden_admin_token",
-    "dl_sftp_authorized_keys",
 ]
 
 # Required non-empty lists (must contain at least one entry)