# Reinstall Runbook

Follow these steps to provision a fresh server from scratch.

## Prerequisites

On your local machine:
- Ansible installed (`pip install ansible`)
- SSH access to the server as root using `keys/root_cloud_ladkau_de`

## Steps

### 1. Install Ansible collections

From the repo root:

```bash
ansible-galaxy collection install -r ansible/requirements.yml
```

Required collections:
- `community.general` — ufw, timezone modules
- `ansible.posix` — authorized_key module

### 2. Initial root login

Connect as root and verify the server is reachable:

```
ssh -i keys/root_cloud_ladkau_de root@217.154.207.148
```

### 3. Create the deploy user (one-time, manual)

On the server as root:

```bash
adduser deploy
usermod -aG sudo deploy
mkdir -p /home/deploy/.ssh
cat >> /home/deploy/.ssh/authorized_keys <<'EOF'
<paste contents of keys/notroot_cloud_ladkau_de.pub>
EOF
chown -R deploy:deploy /home/deploy/.ssh
chmod 700 /home/deploy/.ssh
chmod 600 /home/deploy/.ssh/authorized_keys
```

### 4. Run the Ansible master playbook

From the repo root:

```bash
ansible-playbook -i ansible/inventory.ini ansible/site.yml
```

This runs all roles in order:
1. `base`      — OS hardening, SSH config, ufw firewall
2. `docker`    — Docker Engine + Compose plugin
3. `traefik`   — reverse proxy, TLS via Let's Encrypt
4. `gitea`     — self-hosted Git
5. `nextcloud` — file storage
6. `sso`       — Single Sign-On
7. `mail`      — mail server
8. `registry`  — container registry
9. `k8s`       — k3s node

### 5. DNS

Ensure the following DNS A records point to `217.154.207.148` before running:

- cloud.ladkau.de
- gitea.ladkau.de
- nextcloud.ladkau.de
- sso.ladkau.de
- mail.ladkau.de
- cr.ladkau.de
- k8s.ladkau.de

Traefik will attempt ACME certificate issuance on first start; DNS must resolve first.

## Re-running after changes

The playbook is idempotent. To apply a single role only:

```bash
ansible-playbook -i ansible/inventory.ini ansible/site.yml --tags <role>
```