Capture current Ansible control plane state

Commit the accumulated infrastructure work that was living only in the
working tree: monitoring stack, emergency access/bot, gyro allocator,
grimmory, adguard, backup audit and the OpenCode agent definitions.

Also ignore Python bytecode, local archives and Nix/direnv artifacts.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01GTocXkGUUazHdKKd3r9k71

ansible/roles/emergency_access/templates/emergency-control.j2

@@ -0,0 +1,27 @@
+#!/bin/sh
+set -eu
+
+case "${SSH_ORIGINAL_COMMAND:-}" in
+  start)
+    /usr/bin/sudo /usr/bin/systemctl start emergency-reverse-ssh.service
+    /usr/bin/sudo /usr/bin/systemctl restart emergency-reverse-ssh.timer
+    /usr/bin/systemctl is-active --quiet emergency-reverse-ssh.service
+    printf 'started; expires in {{ emergency_tunnel_ttl }}\nConnect:\nssh -i ~/.ssh/id_ed25519_homelab_ansible -o IdentitiesOnly=yes -J vps -p 22010 ansible@127.0.0.1\n'
+    ;;
+  stop)
+    /usr/bin/sudo /usr/bin/systemctl stop emergency-reverse-ssh.timer
+    /usr/bin/sudo /usr/bin/systemctl stop emergency-reverse-ssh.service
+    printf 'stopped\n'
+    ;;
+  status)
+    if /usr/bin/systemctl is-active --quiet emergency-reverse-ssh.service; then
+      /usr/bin/systemctl show --property=ActiveState --property=ActiveEnterTimestamp --value emergency-reverse-ssh.service
+    else
+      printf 'stopped\n'
+    fi
+    ;;
+  *)
+    printf 'unsupported command\n' >&2
+    exit 64
+    ;;
+esac

ansible/roles/emergency_access/templates/emergency-control.sudoers.j2

@@ -0,0 +1 @@
+{{ emergency_control_user }} ALL=(root) NOPASSWD: /usr/bin/systemctl start emergency-reverse-ssh.service, /usr/bin/systemctl restart emergency-reverse-ssh.timer, /usr/bin/systemctl stop emergency-reverse-ssh.timer, /usr/bin/systemctl stop emergency-reverse-ssh.service

ansible/roles/emergency_access/templates/emergency-reverse-ssh-expire.service.j2

@@ -0,0 +1,6 @@
+[Unit]
+Description=Close expired HomeLab reverse SSH rescue tunnel
+
+[Service]
+Type=oneshot
+ExecStart=/usr/bin/systemctl stop emergency-reverse-ssh.service

ansible/roles/emergency_access/templates/emergency-reverse-ssh.service.j2

@@ -0,0 +1,19 @@
+[Unit]
+Description=Temporary HomeLab reverse SSH rescue tunnel
+After=network-online.target
+Wants=network-online.target
+
+[Service]
+Type=simple
+User={{ emergency_reverse_tunnel_user }}
+ExecStart=/usr/bin/ssh -N -i {{ emergency_reverse_key_path }} -o BatchMode=yes -o ExitOnForwardFailure=yes -o ServerAliveInterval=30 -o ServerAliveCountMax=3 -o StrictHostKeyChecking=yes -o UserKnownHostsFile={{ emergency_tunnel_state_dir }}/known_hosts -o HostKeyAlias=ru-vps-emergency -p 3422 -R {{ emergency_reverse_bind_address }}:{{ emergency_reverse_port }}:127.0.0.1:22 {{ emergency_reverse_user }}@157.22.231.198
+Restart=on-failure
+RestartSec=10
+NoNewPrivileges=yes
+PrivateTmp=yes
+ProtectSystem=strict
+ProtectHome=yes
+ReadWritePaths={{ emergency_tunnel_state_dir }}
+
+[Install]
+WantedBy=multi-user.target

ansible/roles/emergency_access/templates/emergency-reverse-ssh.timer.j2

@@ -0,0 +1,10 @@
+[Unit]
+Description=Expire HomeLab reverse SSH rescue tunnel after {{ emergency_tunnel_ttl }}
+
+[Timer]
+OnActiveSec={{ emergency_tunnel_ttl }}
+AccuracySec=1s
+Unit=emergency-reverse-ssh-expire.service
+
+[Install]
+WantedBy=timers.target