Capture current Ansible control plane state

Commit the accumulated infrastructure work that was living only in the
working tree: monitoring stack, emergency access/bot, gyro allocator,
grimmory, adguard, backup audit and the OpenCode agent definitions.

Also ignore Python bytecode, local archives and Nix/direnv artifacts.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01GTocXkGUUazHdKKd3r9k71

ansible/roles/emergency_bot/tasks/bootstrap.yml

@@ -0,0 +1,48 @@
+---
+- name: Create emergency bot user
+  ansible.builtin.user:
+    name: "{{ emergency_bot_user }}"
+    system: true
+    shell: /usr/sbin/nologin
+    create_home: false
+
+- name: Create emergency bot state directory
+  ansible.builtin.file:
+    path: "{{ emergency_bot_state_dir }}"
+    state: directory
+    owner: "{{ emergency_bot_user }}"
+    group: "{{ emergency_bot_user }}"
+    mode: "0700"
+
+- name: Generate emergency bot control key
+  ansible.builtin.command:
+    cmd: "ssh-keygen -q -t ed25519 -N '' -f {{ emergency_bot_control_key_path }}"
+    creates: "{{ emergency_bot_control_key_path }}"
+  become: true
+  become_user: "{{ emergency_bot_user }}"
+  no_log: true
+
+- name: Set emergency bot control key ownership
+  ansible.builtin.file:
+    path: "{{ item.path }}"
+    state: file
+    owner: "{{ emergency_bot_user }}"
+    group: "{{ emergency_bot_user }}"
+    mode: "{{ item.mode }}"
+  loop:
+    - path: "{{ emergency_bot_control_key_path }}"
+      mode: "0600"
+    - path: "{{ emergency_bot_control_key_path }}.pub"
+      mode: "0644"
+  no_log: true
+
+- name: Read emergency bot control public key
+  ansible.builtin.slurp:
+    src: "{{ emergency_bot_control_key_path }}.pub"
+  register: emergency_bot_control_key
+  no_log: true
+
+- name: Store emergency bot control public key for mini-pc configuration
+  ansible.builtin.set_fact:
+    emergency_bot_control_public_key: "{{ emergency_bot_control_key.content | b64decode | trim }}"
+  no_log: true

ansible/roles/emergency_bot/tasks/main.yml

@@ -0,0 +1,77 @@
+---
+- name: Bootstrap emergency bot control identity
+  ansible.builtin.import_tasks: bootstrap.yml
+
+- name: Validate emergency bot inputs
+  ansible.builtin.assert:
+    that:
+      - emergency_bot_token is match('^[0-9]+:[A-Za-z0-9_-]+$')
+      - emergency_bot_allowed_user_ids is match('^[0-9]+(,[0-9]+)*$')
+      - emergency_mini_pc_host_key is match('^ssh-(ed25519|rsa|ecdsa-[^ ]+) [A-Za-z0-9+/=]+( [A-Za-z0-9@._:-]+)?$')
+    fail_msg: Set EMERGENCY_BOT_TOKEN, EMERGENCY_ALLOWED_USER_IDS and EMERGENCY_MINI_PC_HOST_KEY.
+  no_log: true
+
+- name: Install emergency bot dependencies
+  ansible.builtin.apt:
+    name:
+      - ca-certificates
+      - openssh-client
+      - python3
+    state: present
+    update_cache: true
+
+- name: Create emergency bot configuration directory
+  ansible.builtin.file:
+    path: "{{ emergency_bot_config_dir }}"
+    state: directory
+    owner: root
+    group: root
+    mode: "0755"
+
+- name: Pin mini-pc SSH host key
+  ansible.builtin.copy:
+    dest: "{{ emergency_bot_state_dir }}/known_hosts"
+    content: "mini-pc-emergency {{ emergency_mini_pc_host_key }}\n"
+    owner: "{{ emergency_bot_user }}"
+    group: "{{ emergency_bot_user }}"
+    mode: "0600"
+  no_log: true
+
+- name: Install emergency bot runtime
+  ansible.builtin.template:
+    src: emergency_bot.py.j2
+    dest: /usr/local/libexec/emergency-bot
+    owner: root
+    group: root
+    mode: "0755"
+  notify: Restart emergency bot
+
+- name: Install emergency bot environment
+  ansible.builtin.template:
+    src: emergency-bot.env.j2
+    dest: "{{ emergency_bot_config_dir }}/bot.env"
+    owner: root
+    group: root
+    mode: "0600"
+  no_log: true
+  notify: Restart emergency bot
+
+- name: Install emergency bot systemd unit
+  ansible.builtin.template:
+    src: emergency-bot.service.j2
+    dest: /etc/systemd/system/emergency-bot.service
+    owner: root
+    group: root
+    mode: "0644"
+  notify:
+    - Reload systemd
+    - Restart emergency bot
+
+- name: Enable and start emergency bot
+  ansible.builtin.meta: flush_handlers
+
+- name: Enable and start emergency bot
+  ansible.builtin.systemd_service:
+    name: emergency-bot.service
+    enabled: true
+    state: started