chore: Cleaned up ansible and added control script

ansible/README.md

@@ -16,7 +16,7 @@ to S3, not on a Hetzner volume - see `../readme.md`.
   (`role_dev`, `role_prod`, `role_vpn` - set in `infra/modules/<host>/main.tf`).
 - `group_vars/` - `all.yml` (shared: `deploy_user`, SSH key path,
   `backup_s3_*` S3 backup credentials), `role_dev.yml` / `role_prod.yml` /
-  `role_vpn.yml` (per-role vars, e.g. `dev_runner_count`).
+  `role_vpn.yml` (per-role vars, e.g. `service_group`).
 - `roles/bootstrap/` - Docker install, `deploy` user creation, SSH hardening,
   unattended-upgrades. Replaces `infra/scripts/bootstrap.sh.tftpl`.
 - `roles/deploy/` - copies `services/<host>/` to the server and renders `.env`
@@ -65,9 +65,10 @@ ansible-playbook playbooks/spinup.yml    -l role_dev,role_prod
 ansible-playbook playbooks/site.yml -l role_dev,role_prod
 ```
 
-Re-run `deploy.yml` + `spinup.yml` any time a compose file changes or
-`dev_runner_count` in `group_vars/role_dev.yml` is bumped - `spinup.sh` only
-starts/updates what's changed, same as before.
+Re-run `deploy.yml` + `spinup.yml` any time a compose file changes - `spinup.sh`
+only starts/updates what's changed, same as before. `dev` always runs three
+Gitea Actions runners (fixed in
+`roles/deploy/templates/runners-docker-compose.yml.j2`).
 
 `spindown.yml` runs `spindown.sh`, which does a full `docker system/volume
 prune -a` on the host - it prompts for a `yes` confirmation before running,

ansible/group_vars/role_dev.yml

@@ -1,7 +1,2 @@
 ---
 service_group: dev
-
-# Number of Gitea Actions runner containers rendered into
-# services/dev/Runners/docker-compose.yml by the deploy role - see
-# roles/deploy/templates/runners-docker-compose.yml.j2.
-dev_runner_count: 3

ansible/roles/bootstrap/tasks/main.yml

@@ -10,50 +10,22 @@
     upgrade: dist
     cache_valid_time: 3600
 
-- name: Install Docker prerequisites
+# Docker straight from Ubuntu's own repositories - no external apt repo, GPG
+# key or architecture juggling. docker.io is the engine, docker-compose-v2 is
+# the `docker compose` plugin. A little behind Docker's own channel, but far
+# simpler and plenty for these hosts.
+- name: Install Docker Engine and the Compose plugin
   ansible.builtin.apt:
     name:
-      - ca-certificates
-      - curl
-      - gnupg
+      - docker.io
+      - docker-compose-v2
     state: present
 
-- name: Create apt keyrings directory
-  ansible.builtin.file:
-    path: /etc/apt/keyrings
-    state: directory
-    mode: "0755"
-
-- name: Download Docker's GPG key
-  ansible.builtin.get_url:
-    url: https://download.docker.com/linux/ubuntu/gpg
-    dest: /etc/apt/keyrings/docker.asc
-    mode: "0644"
-    force: false
-
-- name: Determine dpkg architecture
-  ansible.builtin.command: dpkg --print-architecture
-  register: _dpkg_arch
-  changed_when: false
-
-- name: Add Docker apt repository
-  ansible.builtin.apt_repository:
-    repo: >-
-      deb [arch={{ _dpkg_arch.stdout }} signed-by=/etc/apt/keyrings/docker.asc]
-      https://download.docker.com/linux/ubuntu {{ ansible_distribution_release }} stable
-    filename: docker
-    state: present
-
-- name: Install Docker Engine and Compose plugin
-  ansible.builtin.apt:
-    update_cache: true
-    name:
-      - docker-ce
-      - docker-ce-cli
-      - containerd.io
-      - docker-buildx-plugin
-      - docker-compose-plugin
-    state: present
+- name: Ensure Docker is enabled and running
+  ansible.builtin.systemd:
+    name: docker
+    enabled: true
+    state: started
 
 - name: Create non-root sudo user, given the same key root was provisioned with
   ansible.builtin.user:

ansible/roles/deploy/templates/runners-docker-compose.yml.j2

@@ -1,7 +1,6 @@
-# Generated by Ansible from dev_runner_count - do not hand-edit.
-# To change the number of runners, edit dev_runner_count in
-# ansible/group_vars/role_dev.yml and re-run playbooks/deploy.yml.
-# To change their shape, edit this template instead.
+# Generated by Ansible - do not hand-edit. Three Gitea Actions runners, always.
+# To change their shape (image, volumes, env), edit this template and re-run
+# playbooks/deploy.yml.
 #
 # GITEA_RUNNER_REGISTRATION_TOKEN is intentionally left as a compose variable
 # (not baked in here) - services/dev/spinup.sh generates a fresh token and
@@ -10,8 +9,9 @@
 # /data is a disposable local cache (runner identity re-registers on every
 # spinup.sh run anyway), so it's a plain named volume - not part of the S3
 # backup/restore stack in services/dev/backup-docker-compose.yml.
+{% set runner_count = 3 %}
 services:
-{% for i in range(1, dev_runner_count + 1) %}
+{% for i in range(1, runner_count + 1) %}
   runner-{{ i }}:
     image: gitea/act_runner:latest
     container_name: gitea_runner_{{ i }}
@@ -34,7 +34,7 @@ networks:
     external: true
 
 volumes:
-{% for i in range(1, dev_runner_count + 1) %}
+{% for i in range(1, runner_count + 1) %}
   gitea_runner_{{ i }}_data:
     name: gitea_runner_{{ i }}_data
 {% endfor %}