Capture current Ansible control plane state

Commit the accumulated infrastructure work that was living only in the
working tree: monitoring stack, emergency access/bot, gyro allocator,
grimmory, adguard, backup audit and the OpenCode agent definitions.

Also ignore Python bytecode, local archives and Nix/direnv artifacts.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01GTocXkGUUazHdKKd3r9k71

ansible/playbooks/pve-gitea.yml

@@ -25,6 +25,19 @@
       changed_when: false
       failed_when: false
 
+    - name: Refuse to modify a foreign Gitea VMID
+      ansible.builtin.assert:
+        that:
+          - gitea_pct_config.rc != 0 or gitea_existing_hostname == 'gitea'
+        fail_msg: VMID {{ gitea_vmid }} already exists and is not the Gitea container.
+      vars:
+        gitea_existing_hostname: >-
+          {{ gitea_pct_config.stdout_lines
+             | select('match', '^hostname: ')
+             | map('regex_replace', '^hostname: ', '')
+             | first
+             | default('') }}
+
     - name: Install Gitea LXC SSH public key on PVE host
       ansible.builtin.copy:
         dest: /tmp/gitea-lxc.pub
@@ -103,7 +116,7 @@
   vars:
     ansible_become: false
     gitea_data_dir: /opt/gitea/data
-    gitea_image: gitea/gitea:latest
+    gitea_image: gitea/gitea:1.27.1@sha256:b64126cf5c3f4e5f0f231b510bb13715f6cb8e508188b44de90bdb9a04f3055d
     gitea_container_name: gitea
     gitea_http_port: 3000
     gitea_ssh_port: 2222
@@ -154,6 +167,18 @@
         group: "1000"
         mode: "0750"
 
+    - name: Check if the configured Gitea image is present
+      ansible.builtin.command: "docker image inspect {{ gitea_image }}"
+      register: gitea_image_inspect
+      changed_when: false
+      failed_when: false
+
+    - name: Pull the configured Gitea image
+      ansible.builtin.command: "docker pull {{ gitea_image }}"
+      when: gitea_image_inspect.rc != 0
+      register: gitea_image_pull
+      changed_when: true
+
     - name: Install Gitea systemd unit
       ansible.builtin.copy:
         dest: /etc/systemd/system/gitea.service
@@ -172,7 +197,7 @@
           ExecStartPre=-/usr/bin/docker rm -f {{ gitea_container_name }}
           ExecStart=/usr/bin/docker run --rm \
             --name {{ gitea_container_name }} \
-            --pull always \
+            --pull never \
             -p {{ gitea_http_port }}:3000 \
             -p {{ gitea_ssh_port }}:22 \
             -v {{ gitea_data_dir }}:/data \
@@ -193,5 +218,14 @@
     - name: Enable and start Gitea
       ansible.builtin.systemd:
         name: gitea
-        state: started
+        state: "{{ 'restarted' if gitea_unit.changed or gitea_image_pull.changed else 'started' }}"
         enabled: true
+
+    - name: Wait for Gitea HTTP health endpoint
+      ansible.builtin.uri:
+        url: "http://127.0.0.1:{{ gitea_http_port }}/api/healthz"
+        status_code: 200
+      register: gitea_health
+      retries: 24
+      delay: 5
+      until: gitea_health.status == 200