Establish clean homelab infrastructure baseline

Reorganize the brownfield repository, remove retired and generated artifacts, harden ignore rules, and record the GitOps/IaC redesign.

infrastructure/openbao/ansible/roles/openbao_bootstrap/tasks/snapshots.yml

@@ -0,0 +1,70 @@
+---
+# Automated Raft snapshots via a systemd timer + a scoped periodic token.
+
+- name: Write the snapshot policy (read raft snapshots only)
+  ansible.builtin.command: "bao policy write snapshot -"
+  args:
+    stdin: "{{ lookup('template', 'snapshot-policy.hcl.j2') }}"
+  environment: "{{ openbao_cli_env }}"
+  register: snap_pol
+  changed_when: snap_pol.rc == 0
+  no_log: "{{ openbao_no_log }}"
+  # Terraform owns this (../terraform). See openbao_config_managed_by_terraform.
+  when: not openbao_config_managed_by_terraform | bool
+
+- name: Check whether the snapshot token already exists
+  ansible.builtin.stat:
+    path: /etc/openbao/snapshot.token
+  register: snap_tok_stat
+
+- name: Create a periodic snapshot token (once)
+  ansible.builtin.command: "bao token create -policy=snapshot -period=768h -orphan -field=token"
+  environment: "{{ openbao_cli_env }}"
+  register: snap_tok_new
+  when: not snap_tok_stat.stat.exists
+  changed_when: snap_tok_new.rc == 0
+  no_log: true
+
+- name: Store the snapshot token (root-only)
+  ansible.builtin.copy:
+    content: "{{ snap_tok_new.stdout }}"
+    dest: /etc/openbao/snapshot.token
+    owner: root
+    group: root
+    mode: "0600"
+  when: not snap_tok_stat.stat.exists
+  no_log: true
+
+- name: Ensure the snapshot output directory exists
+  ansible.builtin.file:
+    path: "{{ openbao_snapshot_dir }}"
+    state: directory
+    owner: root
+    group: root
+    mode: "0700"
+
+- name: Install the snapshot script
+  ansible.builtin.template:
+    src: bao-snapshot.sh.j2
+    dest: /usr/local/bin/bao-snapshot.sh
+    owner: root
+    group: root
+    mode: "0755"
+
+- name: Install the snapshot systemd service + timer
+  ansible.builtin.template:
+    src: "{{ item }}.j2"
+    dest: "/etc/systemd/system/{{ item }}"
+    owner: root
+    group: root
+    mode: "0644"
+  loop:
+    - openbao-snapshot.service
+    - openbao-snapshot.timer
+
+- name: Enable and start the snapshot timer
+  ansible.builtin.systemd:
+    name: openbao-snapshot.timer
+    state: started
+    enabled: true
+    daemon_reload: true