Fix all issues found during first live provisioning run

Traefik:
- Upgrade v3.3 → v3.6 to fix Docker API version negotiation failure
  with Docker Engine 29 (which dropped support for API < 1.40)

Directory permissions:
- Change all service parent directories from 0750 to 0755 so container
  processes can traverse them after dropping from root to a lower UID
- Create db directories owned by postgres UID 999 (mode 0700) so
  PostgreSQL can access its data files across Ansible runs
- Create /opt/gitea/data owned by git UID 1000 (Gitea writes there
  after dropping privileges)

Healthchecks:
- Fix Redis healthcheck: use CMD form instead of CMD-SHELL pipe
  (pipe was unreliable in Alpine)
- Fix Keycloak healthcheck: use bash /dev/tcp on management port 9000
  (curl not available in UBI image; was incorrectly targeting port 8080)

Image tags:
- Fix Roundcube: 1.6 and 1.6-apache do not exist; correct tag is 1.6.x-apache

Bootstrap scripts:
- bootstrap-deploy-user.sh: add sudoers.d entry for passwordless sudo
  (deploy user has no password so sudo group alone was not enough)
- run-bootstrap.sh: read server IP from inventory.ini, chmod 600 keys
  automatically, show actual SSH error on failure

Inventory / config:
- Add ansible_host to inventory.ini — server IP now defined in one place
- Restructure group_vars/ into all/ directory so vault.yml is
  auto-loaded (previously it did not match any group name)
- Move ansible.cfg to repo root (Ansible looks in cwd, not playbook dir)

Docs:
- Split runbook.md into runbook-provisioning.md and
  runbook-configuration.md
- Add step 1 (set server IP) to provisioning runbook
- Expand prerequisites with SSH key generation and upload instructions
- Expand bootstrap step with preflight check details

ansible/group_vars/all/vars.yml

@@ -22,7 +22,7 @@ timezone: Europe/Berlin
 traefik_network: traefik_public
 
 # Traefik
-traefik_version: v3.3
+traefik_version: v3.6
 traefik_data_dir: /opt/traefik
 # htpasswd-formatted user list for the dashboard.
 # Generate with: echo $(htpasswd -nB admin) | sed -e 's/\$/\$\$/g'

ansible/roles/gitea/tasks/main.yml

@@ -1,15 +1,30 @@
 ---
-- name: Create Gitea data directories
+- name: Create Gitea data directory
   ansible.builtin.file:
-    path: "{{ item }}"
+    path: "{{ gitea_data_dir }}"
     state: directory
     owner: root
     group: root
-    mode: "0750"
-  loop:
-    - "{{ gitea_data_dir }}"
-    - "{{ gitea_data_dir }}/data"
-    - "{{ gitea_data_dir }}/db"
+    mode: "0755"
+  tags: gitea
+
+# Gitea runs as git (UID 1000) and writes directly to this directory
+- name: Create Gitea app data directory (git UID 1000)
+  ansible.builtin.file:
+    path: "{{ gitea_data_dir }}/data"
+    state: directory
+    owner: "1000"
+    group: "1000"
+    mode: "0755"
+  tags: gitea
+
+- name: Create Gitea database directory (postgres UID 999)
+  ansible.builtin.file:
+    path: "{{ gitea_data_dir }}/db"
+    state: directory
+    owner: "999"
+    group: "999"
+    mode: "0700"
   tags: gitea
 
 # Git-over-SSH runs on 2222 to avoid conflict with the host SSH on 22

ansible/roles/mail/tasks/main.yml

@@ -6,10 +6,18 @@
     state: directory
     owner: root
     group: root
-    mode: "0750"
+    mode: "0755"
   loop:
     - "{{ mail_data_dir }}"
-    - "{{ mail_data_dir }}/db"
+  tags: mail
+
+- name: Create Roundcube database directory (postgres UID 999)
+  ansible.builtin.file:
+    path: "{{ mail_data_dir }}/db"
+    state: directory
+    owner: "999"
+    group: "999"
+    mode: "0700"
   tags: mail
 
 - name: Deploy Docker Compose file

ansible/roles/nextcloud/tasks/main.yml

@@ -5,14 +5,22 @@
     state: directory
     owner: root
     group: root
-    mode: "0750"
+    mode: "0755"
   loop:
     - "{{ nextcloud_data_dir }}"
     - "{{ nextcloud_data_dir }}/html"
-    - "{{ nextcloud_data_dir }}/db"
     - "{{ nextcloud_data_dir }}/redis"
   tags: nextcloud
 
+- name: Create Nextcloud database directory (postgres UID 999)
+  ansible.builtin.file:
+    path: "{{ nextcloud_data_dir }}/db"
+    state: directory
+    owner: "999"
+    group: "999"
+    mode: "0700"
+  tags: nextcloud
+
 - name: Deploy Docker Compose file
   ansible.builtin.template:
     src: docker-compose.yml.j2

ansible/roles/registry/tasks/main.yml

@@ -5,7 +5,7 @@
     state: directory
     owner: root
     group: root
-    mode: "0750"
+    mode: "0755"
   loop:
     - "{{ registry_data_dir }}"
     - "{{ registry_data_dir }}/data"

ansible/roles/sso/tasks/main.yml

@@ -5,10 +5,18 @@
     state: directory
     owner: root
     group: root
-    mode: "0750"
+    mode: "0755"
   loop:
     - "{{ sso_data_dir }}"
-    - "{{ sso_data_dir }}/db"
+  tags: sso
+
+- name: Create Keycloak database directory (postgres UID 999)
+  ansible.builtin.file:
+    path: "{{ sso_data_dir }}/db"
+    state: directory
+    owner: "999"
+    group: "999"
+    mode: "0700"
   tags: sso
 
 - name: Deploy Docker Compose file

ansible/roles/sso/templates/docker-compose.yml.j2

@@ -48,7 +48,7 @@ services:
       - "traefik.http.routers.sso.tls.certresolver=letsencrypt"
       - "traefik.http.services.sso.loadbalancer.server.port=8080"
     healthcheck:
-      test: ["CMD-SHELL", "curl -f http://localhost:8080/health/ready || exit 1"]
+      test: ["CMD", "bash", "-c", "exec 3<>/dev/tcp/localhost/9000"]
       interval: 30s
       timeout: 10s
       retries: 5

ansible/roles/traefik/tasks/main.yml

@@ -5,7 +5,7 @@
     state: directory
     owner: root
     group: root
-    mode: "0750"
+    mode: "0755"
   tags: traefik
 
 # acme.json must be 0600 or Traefik refuses to start