Capture current Ansible control plane state

Commit the accumulated infrastructure work that was living only in the
working tree: monitoring stack, emergency access/bot, gyro allocator,
grimmory, adguard, backup audit and the OpenCode agent definitions.

Also ignore Python bytecode, local archives and Nix/direnv artifacts.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01GTocXkGUUazHdKKd3r9k71

ansible/roles/openvpn_gateway/tasks/main.yml

@@ -41,13 +41,13 @@
   no_log: true
   notify: restart openvpn
 
-- name: Enable IPv4 forwarding on gateway
+- name: Enable IPv4 forwarding for routed traffic
   ansible.posix.sysctl:
     name: net.ipv4.ip_forward
     value: "1"
     state: present
     reload: true
-  when: openvpn_role == 'gateway'
+  when: openvpn_role == 'gateway' or openvpn_forwarded_services | length > 0
 
 - name: Allow OpenVPN TCP in UFW on server
   ansible.builtin.command: "ufw allow {{ openvpn_listen_port }}/tcp"
@@ -65,7 +65,7 @@
     mode: "0600"
   notify: restart openvpn
 
-- name: Render OpenVPN gateway up script
+- name: Render OpenVPN up script
   ansible.builtin.template:
     src: up.sh.j2
     dest: "{{ openvpn_config_dir }}/up.sh"
@@ -73,9 +73,9 @@
     group: root
     mode: "0700"
   notify: restart openvpn
-  when: openvpn_role == 'gateway'
+  when: openvpn_role == 'gateway' or openvpn_forwarded_services | length > 0
 
-- name: Render OpenVPN gateway down script
+- name: Render OpenVPN down script
   ansible.builtin.template:
     src: down.sh.j2
     dest: "{{ openvpn_config_dir }}/down.sh"
@@ -83,7 +83,7 @@
     group: root
     mode: "0700"
   notify: restart openvpn
-  when: openvpn_role == 'gateway'
+  when: openvpn_role == 'gateway' or openvpn_forwarded_services | length > 0
 
 - name: Render OpenVPN systemd service
   ansible.builtin.template: