Capture current Ansible control plane state

Commit the accumulated infrastructure work that was living only in the
working tree: monitoring stack, emergency access/bot, gyro allocator,
grimmory, adguard, backup audit and the OpenCode agent definitions.

Also ignore Python bytecode, local archives and Nix/direnv artifacts.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01GTocXkGUUazHdKKd3r9k71

ansible/playbooks/pve-docker-test.yml

@@ -0,0 +1,125 @@
+---
+- name: Create Docker test LXC on cloud-pc
+  hosts: cloud-pc
+  gather_facts: false
+  vars:
+    docker_test_vmid: 145
+    docker_test_hostname: docker-test
+    docker_test_ip: 192.168.1.29/24
+    docker_test_gateway: 192.168.1.1
+    docker_test_rootfs: data:8
+    docker_test_ostemplate: local:vztmpl/debian-13-standard_13.1-2_amd64.tar.zst
+    docker_test_pubkey_file: ~/.ssh/id_ed25519_homelab.pub
+  handlers:
+    - name: restart docker test lxc
+      ansible.builtin.shell: "pct stop {{ docker_test_vmid }} || true; pct start {{ docker_test_vmid }}"
+      changed_when: true
+  tasks:
+    - name: Check if Docker test LXC exists
+      ansible.builtin.command: "pct config {{ docker_test_vmid }}"
+      register: docker_test_pct_config
+      changed_when: false
+      failed_when: false
+
+    - name: Install Docker test LXC SSH public key on PVE host
+      ansible.builtin.copy:
+        dest: /tmp/docker-test-lxc.pub
+        owner: root
+        group: root
+        mode: "0600"
+        content: "{{ lookup('file', docker_test_pubkey_file) }}\n"
+      when: docker_test_pct_config.rc != 0
+
+    - name: Create Docker test LXC
+      ansible.builtin.command: >-
+        pct create {{ docker_test_vmid }} {{ docker_test_ostemplate }}
+        --hostname {{ docker_test_hostname }}
+        --rootfs {{ docker_test_rootfs }}
+        --cores 1
+        --memory 512
+        --swap 512
+        --net0 name=eth0,bridge=vmbr0,gw={{ docker_test_gateway }},ip={{ docker_test_ip }},firewall=1
+        --nameserver 1.1.1.1
+        --unprivileged 1
+        --features nesting=1,keyctl=1
+        --onboot 1
+        --startup order=50
+        --cmode shell
+        --ssh-public-keys /tmp/docker-test-lxc.pub
+      when: docker_test_pct_config.rc != 0
+
+    - name: Start Docker test LXC
+      ansible.builtin.command: "pct start {{ docker_test_vmid }}"
+      register: docker_test_pct_start
+      changed_when: docker_test_pct_start.rc == 0
+      failed_when: docker_test_pct_start.rc not in [0, 255]
+
+    - name: Allow FUSE device in Docker test LXC config
+      ansible.builtin.lineinfile:
+        path: "/etc/pve/lxc/{{ docker_test_vmid }}.conf"
+        line: "lxc.cgroup2.devices.allow: c 10:229 rwm"
+        state: present
+      notify: restart docker test lxc
+
+    - name: Bind mount FUSE device in Docker test LXC config
+      ansible.builtin.lineinfile:
+        path: "/etc/pve/lxc/{{ docker_test_vmid }}.conf"
+        line: "lxc.mount.entry: /dev/fuse dev/fuse none bind,create=file"
+        state: present
+      notify: restart docker test lxc
+
+    - name: Apply pending LXC config changes
+      ansible.builtin.meta: flush_handlers
+
+    - name: Wait for Docker test SSH through ru-vps
+      ansible.builtin.wait_for_connection:
+        timeout: 120
+      delegate_to: docker-test
+      vars:
+        ansible_become: false
+
+- name: Configure Docker test host
+  hosts: docker-test
+  gather_facts: true
+  vars:
+    ansible_become: false
+  tasks:
+    - name: Install Docker packages
+      ansible.builtin.apt:
+        name:
+          - docker.io
+          - fuse-overlayfs
+          - ca-certificates
+          - curl
+        state: present
+        update_cache: true
+
+    - name: Ensure Docker config directory exists
+      ansible.builtin.file:
+        path: /etc/docker
+        state: directory
+        owner: root
+        group: root
+        mode: "0755"
+
+    - name: Configure Docker storage driver for unprivileged LXC
+      ansible.builtin.copy:
+        dest: /etc/docker/daemon.json
+        owner: root
+        group: root
+        mode: "0644"
+        content: |
+          {
+            "storage-driver": "fuse-overlayfs"
+          }
+      register: docker_test_daemon_config
+
+    - name: Enable Docker service
+      ansible.builtin.systemd:
+        name: docker
+        state: "{{ 'restarted' if docker_test_daemon_config.changed else 'started' }}"
+        enabled: true
+
+    - name: Verify Docker can run a container
+      ansible.builtin.command: docker run --rm hello-world
+      changed_when: false