chore: Refresh of repo

ansible/inventory/hcloud.yml

@@ -1,8 +1,7 @@
 ---
 # Dynamic inventory: queries the Hetzner Cloud API directly (HCLOUD_TOKEN),
 # grouping hosts by the `role` label set on each hcloud_server resource in
-# infra/modules/<host>/main.tf (role = dev/prod/vpn). Nothing here reads
-# Terraform state - this always reflects whatever actually exists in Hetzner.
+# infra/modules/<host>/main.tf (role = dev/prod/vpn).
 plugin: hetzner.hcloud.hcloud
 token: "{{ lookup('env', 'HCLOUD_TOKEN') }}"
 connect_with: public_ipv4

ansible/playbooks/group_vars/all.yml

@@ -1,8 +1,4 @@
 ---
-# Non-root sudo user the bootstrap role creates on each host - purely an
-# Ansible-side concept, OpenTofu has no equivalent variable. Override with the
-# DEPLOY_USER env var (control.sh's "Set variables" menu writes it) if you
-# don't want the default.
 deploy_user: "{{ lookup('env', 'DEPLOY_USER') | default('deploy', true) }}"
 ansible_user: "{{ deploy_user }}"
 ansible_ssh_private_key_file: "{{ lookup('env', 'ANSIBLE_SSH_PRIVATE_KEY_FILE') | default('~/.ssh/id_ed25519', true) }}"
@@ -11,11 +7,7 @@ ansible_ssh_private_key_file: "{{ lookup('env', 'ANSIBLE_SSH_PRIVATE_KEY_FILE')
 services_root: "{{ playbook_dir }}/../../services"
 
 # S3-compatible bucket that services/<host>/backup-docker-compose.yml backs up
-# to and restores from - see readme.md. Not provisioned by OpenTofu (the
-# hcloud provider has no Object Storage resource), so these must point at a
-# bucket you've created yourself. AWS_ENDPOINT is only needed for a
-# non-AWS S3-compatible provider (e.g. Hetzner Object Storage); leave it unset
-# to use real AWS S3.
+# to and restores from
 backup_s3_bucket: "{{ lookup('env', 'BACKUP_S3_BUCKET') }}"
 backup_s3_access_key_id: "{{ lookup('env', 'BACKUP_S3_ACCESS_KEY_ID') }}"
 backup_s3_secret_access_key: "{{ lookup('env', 'BACKUP_S3_SECRET_ACCESS_KEY') }}"

ansible/roles/bootstrap/tasks/main.yml

@@ -1,7 +1,5 @@
 ---
-# Post-install bootstrap - replaces infra/scripts/bootstrap.sh.tftpl. Runs as
-# root (see ansible_user override in playbooks/bootstrap.yml) since the deploy
-# user doesn't exist yet on a freshly created server. Idempotent: safe to
+# Post-install bootstrap - Idempotent: safe to
 # re-run against an already-bootstrapped host.
 
 - name: Update apt cache and upgrade packages
@@ -10,10 +8,6 @@
     upgrade: dist
     cache_valid_time: 3600
 
-# Docker straight from Ubuntu's own repositories - no external apt repo, GPG
-# key or architecture juggling. docker.io is the engine, docker-compose-v2 is
-# the `docker compose` plugin. A little behind Docker's own channel, but far
-# simpler and plenty for these hosts.
 - name: Install Docker Engine and the Compose plugin
   ansible.builtin.apt:
     name:

ansible/roles/deploy/tasks/main.yml

@@ -1,10 +1,8 @@
 ---
 # Copies services/<service_group>/ to the server and renders the files that
-# used to be generated by OpenTofu (services/<host>/.env and, for dev,
-# Runners/docker-compose.yml) - replaces the null_resource.deploy_services +
-# local_file provisioners previously in infra/modules/<host>/main.tf.
+# need templating (e.g. .env, docker-compose.yml).
 #
-# Persistent data lives in named Docker volumes now, not on a Hetzner volume -
+# Persistent data lives in named Docker volumes
 # see services/<host>/backup-docker-compose.yml. .env only carries the S3
 # credentials that backup/restore need, rendered for every host.