Clean up inventory, group_vars, and prefill READMEs

- hosts.ini: underscore group names, hostname aliases with ansible_host
- move ansible_user/ansible_port to group_vars/all.yml
- rename group_vars files to match underscore group names
- trim sftp group_vars to its only override (password auth off)
- run.yml: load moved secrets file (group_vars/secrets.yml)
- untrack .DS_Store, extend .gitignore
- prefill root/ansible/server READMEs, add jira + cloud server folders
- update CLAUDE.md to match

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

ansible/group_vars/all.yml

@@ -1,4 +1,8 @@
 ---
+# connection settings (identical for all hosts)
+ansible_user: sbxadmin
+ansible_port: 22
+
 # generic settings
 main_username: sbxadmin
 main_groupname: "{{ main_username }}"

ansible/group_vars/phy-z-dmz-sftp01.yml

@@ -1,43 +0,0 @@
----
-# generic settings
-main_username: sbxadmin
-main_groupname: "{{ main_username }}"
-main_uid: "1000"
-main_gid: "{{ main_uid }}"
-
-# weareinteractive.environment
-environment_config: { "PUID": "{{ main_gid }}", "PGID": "{{ main_gid }}" }
-
-global_env_vars:
-  - "PUID={{ main_uid }}"
-  - "PGID={{ main_gid }}"
-  - "TZ={{ ntp_timezone }}"
-
-# geerlingguy.ntp
-ntp_timezone: "Europe/Berlin"
-
-# geerlingguy.nfs
-#nfs_exports: [ "/home/public    *(rw,sync,no_root_squash)" ]
-
-# geerlingguy.security
-security_ssh_port: 22
-security_ssh_password_authentication: "yes"
-security_ssh_permit_root_login: "no"
-security_ssh_usedns: "no"
-security_ssh_permit_empty_password: "no"
-security_ssh_challenge_response_auth: "no"
-security_ssh_gss_api_authentication: "no"
-security_ssh_x11_forwarding: "no"
-security_ssh_allowed_users:
-  - "{{ main_username }}"
-security_ssh_allowed_groups: []
-security_sudoers_passwordless:
-  - "{{ main_username }}"
-security_autoupdate_enabled: true
-security_autoupdate_blacklist: []
-security_autoupdate_reboot: reboot
-security_autoupdate_reboot_time: "03:00"
-security_autoupdate_mail_to: "service@softbox.de"
-security_autoupdate_mail_on_error: true
-security_fail2ban_enabled: true
-security_fail2ban_custom_configuration_template: "jail.local.j2"

ansible/group_vars/phy-z-srv-cloud.yml

@@ -1,47 +0,0 @@
-# generic settings
-main_username: sbxadmin
-main_groupname: "{{ main_username }}"
-main_uid: "1000"
-main_gid: "{{ main_uid }}"
-
-# weareinteractive.environment
-environment_config: { "PUID": "{{ main_gid }}", "PGID": "{{ main_gid }}" }
-
-global_env_vars:
-  - "PUID={{ main_uid }}"
-  - "PGID={{ main_gid }}"
-  - "TZ={{ ntp_timezone }}"
-
-# geerlingguy.ntp
-ntp_timezone: "Europe/Berlin"
-
-# geerlingguy.nfs
-#nfs_exports: [ "/home/public    *(rw,sync,no_root_squash)" ]
-
-# geerlingguy.security
-security_ssh_port: 22
-security_ssh_password_authentication: "yes"
-security_ssh_permit_root_login: "no"
-security_ssh_usedns: "no"
-security_ssh_permit_empty_password: "no"
-security_ssh_challenge_response_auth: "no"
-security_ssh_gss_api_authentication: "no"
-security_ssh_x11_forwarding: "no"
-security_ssh_allowed_users:
-  - "{{ main_username }}"
-security_ssh_allowed_groups: []
-security_sudoers_passwordless:
-  - "{{ main_username }}"
-security_autoupdate_enabled: true
-security_autoupdate_blacklist: []
-security_autoupdate_reboot: reboot
-security_autoupdate_reboot_time: "03:00"
-security_autoupdate_mail_to: "service@softbox.de"
-security_autoupdate_mail_on_error: true
-security_fail2ban_enabled: true
-security_fail2ban_custom_configuration_template: "jail.local.j2"
-
-#cloud.phytron.de
-hostname: cloud
-php_version: 8.2
-domain_base: "phytron.de"

ansible/group_vars/phy-z-srv-git.yml

@@ -1,43 +0,0 @@
----
-# generic settings
-main_username: sbxadmin
-main_groupname: "{{ main_username }}"
-main_uid: "1000"
-main_gid: "{{ main_uid }}"
-
-# weareinteractive.environment
-environment_config: { "PUID": "{{ main_gid }}", "PGID": "{{ main_gid }}" }
-
-global_env_vars:
-  - "PUID={{ main_uid }}"
-  - "PGID={{ main_gid }}"
-  - "TZ={{ ntp_timezone }}"
-
-# geerlingguy.ntp
-ntp_timezone: "Europe/Berlin"
-
-# geerlingguy.nfs
-#nfs_exports: [ "/home/public    *(rw,sync,no_root_squash)" ]
-
-# geerlingguy.security
-security_ssh_port: 22
-security_ssh_password_authentication: "yes"
-security_ssh_permit_root_login: "no"
-security_ssh_usedns: "no"
-security_ssh_permit_empty_password: "no"
-security_ssh_challenge_response_auth: "no"
-security_ssh_gss_api_authentication: "no"
-security_ssh_x11_forwarding: "no"
-security_ssh_allowed_users:
-  - "{{ main_username }}"
-security_ssh_allowed_groups: []
-security_sudoers_passwordless:
-  - "{{ main_username }}"
-security_autoupdate_enabled: true
-security_autoupdate_blacklist: []
-security_autoupdate_reboot: reboot
-security_autoupdate_reboot_time: "03:00"
-security_autoupdate_mail_to: "service@softbox.de"
-security_autoupdate_mail_on_error: true
-security_fail2ban_enabled: true
-security_fail2ban_custom_configuration_template: "jail.local.j2"

ansible/group_vars/phy-z-srv-gpu01.yml

@@ -1,43 +0,0 @@
----
-# generic settings
-main_username: sbxadmin
-main_groupname: "{{ main_username }}"
-main_uid: "1000"
-main_gid: "{{ main_uid }}"
-
-# weareinteractive.environment
-environment_config: { "PUID": "{{ main_gid }}", "PGID": "{{ main_gid }}" }
-
-global_env_vars:
-  - "PUID={{ main_uid }}"
-  - "PGID={{ main_gid }}"
-  - "TZ={{ ntp_timezone }}"
-
-# geerlingguy.ntp
-ntp_timezone: "Europe/Berlin"
-
-# geerlingguy.nfs
-#nfs_exports: [ "/home/public    *(rw,sync,no_root_squash)" ]
-
-# geerlingguy.security
-security_ssh_port: 22
-security_ssh_password_authentication: "yes"
-security_ssh_permit_root_login: "no"
-security_ssh_usedns: "no"
-security_ssh_permit_empty_password: "no"
-security_ssh_challenge_response_auth: "no"
-security_ssh_gss_api_authentication: "no"
-security_ssh_x11_forwarding: "no"
-security_ssh_allowed_users:
-  - "{{ main_username }}"
-security_ssh_allowed_groups: []
-security_sudoers_passwordless:
-  - "{{ main_username }}"
-security_autoupdate_enabled: true
-security_autoupdate_blacklist: []
-security_autoupdate_reboot: reboot
-security_autoupdate_reboot_time: "03:00"
-security_autoupdate_mail_to: "service@softbox.de"
-security_autoupdate_mail_on_error: true
-security_fail2ban_enabled: true
-security_fail2ban_custom_configuration_template: "jail.local.j2"

ansible/group_vars/phy-z-srv-jira.yml

@@ -1,43 +0,0 @@
----
-# generic settings
-main_username: sbxadmin
-main_groupname: "{{ main_username }}"
-main_uid: "1000"
-main_gid: "{{ main_uid }}"
-
-# weareinteractive.environment
-environment_config: { "PUID": "{{ main_gid }}", "PGID": "{{ main_gid }}" }
-
-global_env_vars:
-  - "PUID={{ main_uid }}"
-  - "PGID={{ main_gid }}"
-  - "TZ={{ ntp_timezone }}"
-
-# geerlingguy.ntp
-ntp_timezone: "Europe/Berlin"
-
-# geerlingguy.nfs
-#nfs_exports: [ "/home/public    *(rw,sync,no_root_squash)" ]
-
-# geerlingguy.security
-security_ssh_port: 22
-security_ssh_password_authentication: "yes"
-security_ssh_permit_root_login: "no"
-security_ssh_usedns: "no"
-security_ssh_permit_empty_password: "no"
-security_ssh_challenge_response_auth: "no"
-security_ssh_gss_api_authentication: "no"
-security_ssh_x11_forwarding: "no"
-security_ssh_allowed_users:
-  - "{{ main_username }}"
-security_ssh_allowed_groups: []
-security_sudoers_passwordless:
-  - "{{ main_username }}"
-security_autoupdate_enabled: true
-security_autoupdate_blacklist: []
-security_autoupdate_reboot: reboot
-security_autoupdate_reboot_time: "03:00"
-security_autoupdate_mail_to: "service@softbox.de"
-security_autoupdate_mail_on_error: true
-security_fail2ban_enabled: true
-security_fail2ban_custom_configuration_template: "jail.local.j2"

ansible/group_vars/phy_z_dmz_sftp01.yml

@@ -0,0 +1,5 @@
+---
+# overrides of group_vars/all.yml
+
+# geerlingguy.security — DMZ host: no SSH password login, keys only
+security_ssh_password_authentication: "no"

ansible/group_vars/phy_z_srv_cloud.yml

@@ -0,0 +1,4 @@
+#cloud.phytron.de
+hostname: cloud
+php_version: 8.2
+domain_base: "phytron.de"

ansible/group_vars/phy_z_srv_git.yml

@@ -0,0 +1,2 @@
+---
+

ansible/group_vars/phy_z_srv_gpu01.yml

@@ -0,0 +1,2 @@
+---
+

ansible/group_vars/phy_z_srv_jira.yml

@@ -0,0 +1,2 @@
+---
+

ansible/group_vars/secrets.yml

@@ -0,0 +1,14 @@
+$ANSIBLE_VAULT;1.1;AES256
+31353435633062366461353231666566366662373733656337356339626234313966366139613161
+3533646266393033316330323737303638303162356161610a393337313837653835396162633030
+30313066326337393831643833663237643966383163363866386133373264373933633133653462
+6636376563336433640a356231363764363834626431616435633436306662313932313164623733
+62383062653166613661303939346135643661646630386532306161393365393133626164303337
+31623962623931353365346365623333386638313266356131326565613730303338643863396237
+39353261616339356563393236633232646361326234333533643338656331623732636432383434
+63653963336333366462366562633631336636643935646632323031666366633136383732643733
+63366433363136666131386434333431333062363238633064646336626463623730616238646136
+31333839623538306161393862306231656466613231326165666562616432363136396332646533
+30663130336438623463336333343830656138316236353963373833386434393337356262313934
+63323030323837373066323337363633636236353931643636643337393161303965613438363638
+3532