Add public download server at dl.ladkau.de and improve vault validation

- New dl role — nginx serves files publicly over HTTPS with directory
  listing; atmoz/sftp on port 2223 for key-only uploads; both containers
  share /opt/dl/files volume
- check-vault.sh gains a third tier: optional secrets are validated when
  present — vaultwarden_sso_client_secret must be non-empty,
  dl_sftp_authorized_keys must begin with a recognised SSH public key prefix
- dl.ladkau.de added to DNS table, check-services.sh, and status dashboard
- Configuration runbook section 7: deploy key generation, Gitea Actions
  scp workflow example, and SFTP client connection settings
- Provisioning runbook documents the three-tier vault validation behaviour

scripts/check-vault.sh

@@ -1,6 +1,7 @@
 #!/usr/bin/env bash
 # Decrypts ansible/group_vars/vault.yml and checks all required secrets are present
-# and non-empty. Exits non-zero if any are missing.
+# and non-empty, and validates optional secrets when they are present.
+# Exits non-zero if any check fails.
 # Usage: bash scripts/check-vault.sh
 
 set -euo pipefail
@@ -40,6 +41,7 @@ required_scalars = [
     "roundcube_db_password",
     "roundcube_des_key",
     "vaultwarden_admin_token",
+    "dl_sftp_authorized_keys",
 ]
 
 # Required non-empty lists (must contain at least one entry)
@@ -49,26 +51,46 @@ required_lists = [
     "dovecot_users",
 ]
 
-missing = []
+# Optional scalars: validated only when present — (key, validator_fn, hint)
+SSH_KEY_PREFIXES = ("ssh-rsa", "ssh-ed25519", "ssh-ecdsa", "ecdsa-sha2-", "sk-ssh-")
+
+def is_nonempty(val):
+    return bool(str(val).strip())
+
+def is_ssh_pubkey(val):
+    return any(str(val).strip().startswith(p) for p in SSH_KEY_PREFIXES)
+
+optional_scalars = [
+    ("vaultwarden_sso_client_secret", is_nonempty,  "must be a non-empty string"),
+    ("dl_sftp_authorized_keys",       is_ssh_pubkey, "must be a valid SSH public key (ssh-ed25519 / ssh-rsa / ecdsa-sha2-*)"),
+]
+
+errors = []
 
 for key in required_scalars:
     val = data.get(key, "")
     if not val or str(val).strip() in ("", '""', "''"):
-        missing.append(key)
+        errors.append(f"{key}: missing or empty (required)")
 
 for key in required_lists:
     val = data.get(key)
     if not isinstance(val, list) or len(val) == 0:
-        missing.append(key)
+        errors.append(f"{key}: missing or empty list (required)")
 
-if missing:
+for key, validator, hint in optional_scalars:
+    if key in data:
+        val = data[key]
+        if not val or not validator(str(val).strip()):
+            errors.append(f"{key}: present but invalid — {hint}")
+
+if errors:
     print("", file=sys.stderr)
-    print("ERROR: the following secrets are missing or empty in vault.yml:", file=sys.stderr)
-    for key in missing:
-        print(f"       - {key}", file=sys.stderr)
+    print("ERROR: vault.yml has the following issues:", file=sys.stderr)
+    for msg in errors:
+        print(f"       - {msg}", file=sys.stderr)
     print("", file=sys.stderr)
     print("Edit the vault with: ansible-vault edit ansible/group_vars/all/vault.yml", file=sys.stderr)
     sys.exit(1)
 
-print("    OK — all required secrets are present")
+print("    OK — all secrets are present and valid")
 PYEOF