Add public download server at dl.ladkau.de and improve vault validation

- New dl role — nginx serves files publicly over HTTPS with directory
  listing; atmoz/sftp on port 2223 for key-only uploads; both containers
  share /opt/dl/files volume
- check-vault.sh gains a third tier: optional secrets are validated when
  present — vaultwarden_sso_client_secret must be non-empty,
  dl_sftp_authorized_keys must begin with a recognised SSH public key prefix
- dl.ladkau.de added to DNS table, check-services.sh, and status dashboard
- Configuration runbook section 7: deploy key generation, Gitea Actions
  scp workflow example, and SFTP client connection settings
- Provisioning runbook documents the three-tier vault validation behaviour

ansible/group_vars/all/vars.yml

@@ -9,6 +9,7 @@ domain_mail:       "mail.{{ domain_base }}"
 domain_registry:   "cr.{{ domain_base }}"
 domain_k8s:        "k8s.{{ domain_base }}"
 domain_vault:      "vault.{{ domain_base }}"
+domain_dl:         "dl.{{ domain_base }}"
 
 # Let's Encrypt
 acme_email: matthias.ladkau@gmail.com
@@ -105,5 +106,13 @@ vaultwarden_data_dir: /opt/vaultwarden
 # vaultwarden_admin_token: ""       # generate: openssl rand -hex 32
 # vaultwarden_sso_client_secret: "" # added after Keycloak is configured — see runbook-configuration.md step 2.6
 
+# Download server (nginx HTTPS + SFTP)
+dl_data_dir: /opt/dl
+dl_upload_user: uploader
+dl_sftp_port: 2223
+# Secrets — store values in ansible/group_vars/all/vault.yml (Ansible Vault)
+# dl_sftp_authorized_keys: |
+#   ssh-ed25519 AAAA...  gitea-actions
+
 # Status dashboard (public — cloud.ladkau.de root)
 dashboard_data_dir: /opt/dashboard

ansible/roles/dashboard/templates/app.py.j2

@@ -24,6 +24,7 @@ SERVICES = [
     ("Registry",  "https://{{ domain_registry }}/v2/",      401, "https://{{ domain_registry }}"),
     ("k8s",          "https://{{ domain_k8s }}",                200, "https://{{ domain_k8s }}"),
     ("Vaultwarden",  "https://{{ domain_vault }}",             200, "https://{{ domain_vault }}"),
+    ("Downloads",    "https://{{ domain_dl }}",               200, "https://{{ domain_dl }}"),
 ]
 {% raw %}
 

ansible/roles/dl/handlers/main.yml

@@ -0,0 +1,7 @@
+---
+- name: Restart dl
+  community.docker.docker_compose_v2:
+    project_src: "{{ dl_data_dir }}"
+    state: present
+    pull: missing
+    recreate: always

ansible/roles/dl/tasks/main.yml

@@ -0,0 +1,62 @@
+---
+- name: Create dl data directory
+  ansible.builtin.file:
+    path: "{{ dl_data_dir }}"
+    state: directory
+    owner: root
+    group: root
+    mode: "0755"
+  tags: dl
+
+- name: Create dl files directory (sftp user UID 1001)
+  ansible.builtin.file:
+    path: "{{ dl_data_dir }}/files"
+    state: directory
+    owner: "1001"
+    group: "1001"
+    mode: "0755"
+  tags: dl
+
+- name: Deploy SFTP authorized keys
+  ansible.builtin.copy:
+    content: "{{ dl_sftp_authorized_keys }}"
+    dest: "{{ dl_data_dir }}/authorized_keys"
+    owner: root
+    group: root
+    mode: "0644"
+  notify: Restart dl
+  tags: dl
+
+- name: Deploy nginx config
+  ansible.builtin.template:
+    src: nginx.conf.j2
+    dest: "{{ dl_data_dir }}/nginx.conf"
+    owner: root
+    group: root
+    mode: "0644"
+  notify: Restart dl
+  tags: dl
+
+- name: Deploy Docker Compose file
+  ansible.builtin.template:
+    src: docker-compose.yml.j2
+    dest: "{{ dl_data_dir }}/docker-compose.yml"
+    owner: root
+    group: root
+    mode: "0644"
+  notify: Restart dl
+  tags: dl
+
+- name: Allow SFTP port through firewall
+  community.general.ufw:
+    rule: allow
+    port: "{{ dl_sftp_port }}"
+    proto: tcp
+  tags: dl
+
+- name: Start dl stack
+  community.docker.docker_compose_v2:
+    project_src: "{{ dl_data_dir }}"
+    state: present
+    pull: missing
+  tags: dl

ansible/roles/dl/templates/docker-compose.yml.j2

@@ -0,0 +1,34 @@
+# Managed by Ansible — do not edit manually
+services:
+  dl-web:
+    image: nginx:alpine
+    container_name: dl-web
+    restart: unless-stopped
+    volumes:
+      - {{ dl_data_dir }}/nginx.conf:/etc/nginx/conf.d/default.conf:ro
+      - {{ dl_data_dir }}/files:/var/www/dl:ro
+    networks:
+      - traefik_public
+    labels:
+      - "traefik.enable=true"
+      - "traefik.http.routers.dl.rule=Host(`{{ domain_dl }}`)"
+      - "traefik.http.routers.dl.entrypoints=websecure"
+      - "traefik.http.routers.dl.tls.certresolver=letsencrypt"
+      - "traefik.http.services.dl.loadbalancer.server.port=80"
+      - "traefik.http.routers.dl.middlewares=rate-limit@docker"
+
+  dl-sftp:
+    image: atmoz/sftp
+    container_name: dl-sftp
+    restart: unless-stopped
+    volumes:
+      - {{ dl_data_dir }}/files:/home/{{ dl_upload_user }}/files
+      - {{ dl_data_dir }}/authorized_keys:/home/{{ dl_upload_user }}/.ssh/keys/authorized_keys:ro
+    ports:
+      - "{{ dl_sftp_port }}:22"
+    # Empty password disables password auth — key auth only
+    command: "{{ dl_upload_user }}::1001:1001:files"
+
+networks:
+  traefik_public:
+    external: true

ansible/roles/dl/templates/nginx.conf.j2

@@ -0,0 +1,19 @@
+# Managed by Ansible — do not edit manually
+server {
+    listen 80;
+    server_name _;
+
+    root /var/www/dl;
+    charset utf-8;
+
+    location / {
+        autoindex on;
+        autoindex_exact_size off;
+        autoindex_localtime on;
+    }
+
+    # Deny access to hidden files
+    location ~ /\. {
+        deny all;
+    }
+}

ansible/site.yml

@@ -13,4 +13,5 @@
     - registry
     - k8s
     - vaultwarden
+    - dl
     - dashboard