Establish clean homelab infrastructure baseline

Reorganize the brownfield repository, remove retired and generated artifacts, harden ignore rules, and record the GitOps/IaC redesign.

infrastructure/openbao/ansible/roles/openbao_ssh_ca_trust/defaults/main.yml

@@ -0,0 +1,17 @@
+---
+# openbao_ssh_ca_trust — make a (root-managed) host trust bao's SSH USER CA, so sshd
+# accepts the short-lived certs bao signs. Additive: normal key auth is unaffected.
+# For no-root hosts, use a `cert-authority` line in ~/.ssh/authorized_keys instead.
+
+openbao_ssh_mount: "ssh-client-signer"
+openbao_addr: "https://bao.ad.ddupan.top:8200"
+
+# The CA public key. Leave empty to fetch it (once, from the control node) from bao's
+# UNAUTHENTICATED public_key endpoint — so it stays current even after a CA rotation.
+# Set it explicitly to pin a key or work offline.
+openbao_ssh_ca_pubkey: ""
+openbao_ssh_ca_url: "{{ openbao_addr }}/v1/{{ openbao_ssh_mount }}/public_key"
+
+openbao_ssh_ca_file: "/etc/ssh/openbao_user_ca.pub"
+openbao_ssh_ca_dropin: "/etc/ssh/sshd_config.d/50-openbao-ca.conf"
+openbao_ssh_service: "ssh"        # Debian/Ubuntu; RHEL-family = "sshd"

infrastructure/openbao/ansible/roles/openbao_ssh_ca_trust/handlers/main.yml

@@ -0,0 +1,14 @@
+---
+# Validate the config BEFORE reloading — a broken sshd config must never be applied
+# (lock-out risk). If `sshd -t` fails the play errors here and the reload never runs,
+# so the running sshd keeps its current (good) config.
+- name: reload sshd
+  ansible.builtin.command: sshd -t
+  changed_when: false
+  listen: reload sshd
+
+- name: reload sshd service
+  ansible.builtin.service:
+    name: "{{ openbao_ssh_service }}"
+    state: reloaded
+  listen: reload sshd

infrastructure/openbao/ansible/roles/openbao_ssh_ca_trust/meta/main.yml

@@ -0,0 +1,11 @@
+---
+galaxy_info:
+  role_name: openbao_ssh_ca_trust
+  description: Trust bao's SSH user CA on a host (TrustedUserCAKeys), so sshd accepts short-lived certs bao signs.
+  min_ansible_version: "2.15"
+  platforms:
+    - name: Debian
+      versions: [bookworm]
+    - name: Ubuntu
+      versions: [jammy, noble]
+dependencies: []

infrastructure/openbao/ansible/roles/openbao_ssh_ca_trust/tasks/main.yml

@@ -0,0 +1,61 @@
+---
+# Trust bao's SSH user CA on this host. Requires root (writes sshd config).
+
+- name: Fetch bao's SSH CA public key (once, on the control node)
+  ansible.builtin.uri:
+    url: "{{ openbao_ssh_ca_url }}"
+    return_content: true
+  delegate_to: localhost
+  run_once: true
+  become: false
+  register: _ssh_ca_fetch
+  when: openbao_ssh_ca_pubkey | length == 0
+
+- name: Resolve the CA public key (an explicit var wins over the fetched one)
+  ansible.builtin.set_fact:
+    _openbao_ssh_ca: >-
+      {{ openbao_ssh_ca_pubkey if (openbao_ssh_ca_pubkey | length > 0)
+         else (_ssh_ca_fetch.content | default('') | trim) }}
+
+- name: Assert we have a real SSH CA public key
+  ansible.builtin.assert:
+    that:
+      - _openbao_ssh_ca is search('^ssh-(rsa|ed25519|ecdsa)')
+    fail_msg: >-
+      No valid SSH CA public key. Set openbao_ssh_ca_pubkey, or make
+      {{ openbao_ssh_ca_url }} reachable from the control node.
+
+- name: Install the SSH CA public key
+  ansible.builtin.copy:
+    content: "{{ _openbao_ssh_ca }}\n"
+    dest: "{{ openbao_ssh_ca_file }}"
+    owner: root
+    group: root
+    mode: "0644"
+  notify: reload sshd
+
+- name: Detect sshd drop-in support
+  ansible.builtin.command: grep -qiE '^[[:space:]]*Include[[:space:]]+/etc/ssh/sshd_config.d/' /etc/ssh/sshd_config
+  register: _sshd_dropins
+  changed_when: false
+  failed_when: false
+
+- name: Trust the CA via an sshd drop-in
+  ansible.builtin.copy:
+    content: |
+      # OpenBao SSH CA ({{ openbao_addr }}) — accept short-lived user certs it signs.
+      TrustedUserCAKeys {{ openbao_ssh_ca_file }}
+    dest: "{{ openbao_ssh_ca_dropin }}"
+    owner: root
+    group: root
+    mode: "0644"
+  when: _sshd_dropins.rc == 0
+  notify: reload sshd
+
+- name: Trust the CA in the main sshd_config (no drop-in support)
+  ansible.builtin.blockinfile:
+    path: /etc/ssh/sshd_config
+    marker: "# {mark} OPENBAO SSH CA"
+    block: "TrustedUserCAKeys {{ openbao_ssh_ca_file }}"
+  when: _sshd_dropins.rc != 0
+  notify: reload sshd