Establish clean homelab infrastructure baseline

Reorganize the brownfield repository, remove retired and generated artifacts, harden ignore rules, and record the GitOps/IaC redesign.

infrastructure/openbao/ansible/roles/openbao_acme/templates/openbao-acme-deploy.sh.j2

@@ -0,0 +1,14 @@
+#!/usr/bin/env bash
+# {{ ansible_managed }}
+# Install the freshly issued/renewed cert into bao's listener and reload (SIGHUP —
+# no restart, no reseal). Invoked by lego's --deploy-hook on create/renew; lego passes
+# the cert paths in LEGO_CERT_PATH / LEGO_CERT_KEY_PATH.
+set -euo pipefail
+
+CRT="${LEGO_CERT_PATH:-{{ openbao_acme_dir }}/certificates/{{ openbao_acme_domain }}.crt}"
+KEY="${LEGO_CERT_KEY_PATH:-{{ openbao_acme_dir }}/certificates/{{ openbao_acme_domain }}.key}"
+
+install -o {{ openbao_user }} -g {{ openbao_group }} -m 0644 "${CRT}" "{{ openbao_acme_tls_dir }}/cert.pem"
+install -o {{ openbao_user }} -g {{ openbao_group }} -m 0640 "${KEY}" "{{ openbao_acme_tls_dir }}/key.pem"
+
+systemctl reload openbao

infrastructure/openbao/ansible/roles/openbao_acme/templates/openbao-acme.service.j2

@@ -0,0 +1,10 @@
+# {{ ansible_managed }}
+[Unit]
+Description=OpenBao ACME certificate (lego, Cloudflare DNS-01)
+After=network-online.target openbao.service
+Wants=network-online.target
+
+[Service]
+Type=oneshot
+EnvironmentFile={{ openbao_acme_dir }}/cloudflare.env
+ExecStart=/usr/local/bin/openbao-acme.sh

infrastructure/openbao/ansible/roles/openbao_acme/templates/openbao-acme.sh.j2

@@ -0,0 +1,20 @@
+#!/usr/bin/env bash
+# {{ ansible_managed }}
+# Obtain or renew bao's Let's Encrypt cert via Cloudflare DNS-01. lego's `run` does both:
+# it renews only when due (ARI + --renew-days) and fires --deploy-hook on any actual
+# create/renew to install the cert and reload bao. CLOUDFLARE_DNS_API_TOKEN comes from
+# the environment (systemd EnvironmentFile, or Ansible on the first run).
+set -euo pipefail
+
+exec {{ openbao_acme_bin }} run \
+  --accept-tos \
+  --email "{{ openbao_acme_email }}" \
+  --dns cloudflare \
+  --dns.resolvers "{{ openbao_acme_dns_resolvers }}" \
+  --dns.timeout {{ openbao_acme_dns_timeout }} \
+  --dns.propagation.wait "{{ openbao_acme_propagation_wait }}" \
+  --domains "{{ openbao_acme_domain }}" \
+  --path "{{ openbao_acme_dir }}" \
+  --renew-days 30 \
+  --deploy-hook /usr/local/bin/openbao-acme-deploy.sh{% if openbao_acme_server %} \
+  --server "{{ openbao_acme_server }}"{% endif %}

infrastructure/openbao/ansible/roles/openbao_acme/templates/openbao-acme.timer.j2

@@ -0,0 +1,11 @@
+# {{ ansible_managed }}
+[Unit]
+Description=OpenBao ACME renewal timer
+
+[Timer]
+OnCalendar={{ openbao_acme_renew_oncalendar }}
+RandomizedDelaySec=3600
+Persistent=true
+
+[Install]
+WantedBy=timers.target