Establish clean homelab infrastructure baseline

Reorganize the brownfield repository, remove retired and generated artifacts, harden ignore rules, and record the GitOps/IaC redesign.

infrastructure/openbao/ansible/roles/openbao_bootstrap/templates/admin-policy.hcl.j2

@@ -0,0 +1,6 @@
+# {{ ansible_managed }}
+# Broad admin for human OIDC logins (mapped from the {{ openbao_oidc_admin_group }} AD group).
+# Homelab-broad on purpose; scope down to specific mounts if you want least privilege.
+path "*" {
+  capabilities = ["create", "read", "update", "delete", "list", "sudo"]
+}

infrastructure/openbao/ansible/roles/openbao_bootstrap/templates/ai-agent-ssh-policy.hcl.j2

@@ -0,0 +1,5 @@
+# {{ ansible_managed }}
+# The AI agent may sign short-lived SSH client certs for the ai-agent role — nothing else.
+path "{{ openbao_ssh_mount }}/sign/ai-agent" {
+  capabilities = ["create", "update"]
+}

infrastructure/openbao/ansible/roles/openbao_bootstrap/templates/bao-snapshot.sh.j2

@@ -0,0 +1,20 @@
+#!/usr/bin/env bash
+# {{ ansible_managed }}
+# Take a Raft snapshot and prune old ones. Ship {{ openbao_snapshot_dir }} off-box
+# separately (rsync/restic/scp) — a snapshot on the same host is not a backup.
+set -euo pipefail
+
+export BAO_ADDR="{{ openbao_addr }}"
+export BAO_CACERT="{{ openbao_tls_dir }}/cert.pem"
+BAO_TOKEN="$(cat /etc/openbao/snapshot.token)"
+export BAO_TOKEN
+
+dir="{{ openbao_snapshot_dir }}"
+stamp="$(date +%Y%m%d-%H%M%S)"
+out="${dir}/openbao-${stamp}.snap"
+
+bao operator raft snapshot save "${out}"
+chmod 600 "${out}"
+
+# Retention: keep the newest {{ openbao_snapshot_keep }}.
+ls -1t "${dir}"/openbao-*.snap 2>/dev/null | tail -n +{{ openbao_snapshot_keep + 1 }} | xargs -r rm -f

infrastructure/openbao/ansible/roles/openbao_bootstrap/templates/k8s-ai-agent-role.json.j2

@@ -0,0 +1,6 @@
+{
+  "bound_service_account_names": "{{ openbao_k8s_agent_sa }}",
+  "bound_service_account_namespaces": "{{ openbao_k8s_agent_ns }}",
+  "token_policies": ["ai-agent-ssh"],
+  "token_ttl": "10m"
+}

infrastructure/openbao/ansible/roles/openbao_bootstrap/templates/oidc-admin-role.json.j2

@@ -0,0 +1,11 @@
+{
+  "role_type": "oidc",
+  "user_claim": "preferred_username",
+  "groups_claim": "groups",
+  "bound_audiences": "{{ openbao_oidc_client_id }}",
+  "bound_claims": { "groups": "{{ openbao_oidc_admin_group }}" },
+  "oidc_scopes": ["profile", "email", "groups"],
+  "allowed_redirect_uris": {{ openbao_oidc_redirect_uris | to_json }},
+  "token_policies": ["admin"],
+  "token_ttl": "1h"
+}

infrastructure/openbao/ansible/roles/openbao_bootstrap/templates/openbao-snapshot.service.j2

@@ -0,0 +1,9 @@
+# {{ ansible_managed }}
+[Unit]
+Description=OpenBao Raft snapshot
+After=openbao.service
+Wants=openbao.service
+
+[Service]
+Type=oneshot
+ExecStart=/usr/local/bin/bao-snapshot.sh

infrastructure/openbao/ansible/roles/openbao_bootstrap/templates/openbao-snapshot.timer.j2

@@ -0,0 +1,10 @@
+# {{ ansible_managed }}
+[Unit]
+Description=OpenBao Raft snapshot timer
+
+[Timer]
+OnCalendar={{ openbao_snapshot_oncalendar }}
+Persistent=true
+
+[Install]
+WantedBy=timers.target

infrastructure/openbao/ansible/roles/openbao_bootstrap/templates/snapshot-policy.hcl.j2

@@ -0,0 +1,5 @@
+# {{ ansible_managed }}
+# Read-only access to take Raft snapshots — used by the snapshot timer's token.
+path "sys/storage/raft/snapshot" {
+  capabilities = ["read"]
+}

infrastructure/openbao/ansible/roles/openbao_bootstrap/templates/ssh-ai-agent-role.json.j2

@@ -0,0 +1,10 @@
+{
+  "key_type": "ca",
+  "allow_user_certificates": true,
+  "allowed_users": "{{ openbao_ssh_allowed_users }}",
+  "default_user": "{{ openbao_ssh_default_user }}",
+  "allowed_extensions": "",
+  "default_extensions": { "permit-pty": "" },
+  "ttl": "{{ openbao_ssh_cert_ttl }}",
+  "max_ttl": "{{ openbao_ssh_cert_max_ttl }}"
+}